9235 matches found
PT-2026-36961
Name of the Vulnerable Software and Affected Versions Blog Settings plugin for WordPress versions prior to 1.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. This occurs via the page parameter, enabling scripts to...
This Week in Spring - May 5th, 2026
Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...
CVE-2026-6704: Improper Neutralization of Input During Web Page Generation
The Blog Settings plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...
11x-wagtail-blog (>=0.0.0, <=0.2.0), 2dify (1.0.1) +5425 more potentially affected by CVE-2026-25990 +1 more via pillow (>=10.3.0, <=12.1.1)
pillow PYPI version =10.3.0, =0.0.0, =2.12.0, =0.1.0, =0.1.3, =0.0.1, =1.0.0, =0.3.2, =0.1.0, =0.1.3, =0.2.0a0, =0.1.0, =0.1.1 and more Source cves: CVE-2026-25990, CVE-2026-42311 Source advisory: SNYK:PYTHON-PILLOW-16419303...
CVE-2026-38669
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
The New Ouroboros Technique and How It Fits in dMSA’s Security Model
...
WCMS 跨站脚本漏洞
WCMS is a content management system CMS developed by Vedegis for individual users. Version wCMS v.1.4 has a cross-site scripting vulnerability, which stems from cross-site scripting attacks when creating new blogs...
CVE-2026-38669
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
CVE-2026-38669
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
CVE-2026-38669
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
CVE-2026-38669
The content management system wCMS v.1.4 , developed by Vedegis , is vulnerable to a Cross-Site Scripting (XSS) flaw. This vulnerability occurs when users are creating a new blog , stemming from the improper neutralization of input during web page generation. Exploitation details and specific rem...
PT-2026-36832
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
EUVD-2026-27001
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
CVE-2026-38669: Improper Neutralization of Input During Web Page Generation
wCMS v.1.4 is vulnerable to Cross Site Scripting XSS when creating a new blog...
CVE-2026-5077
The CVE-2026-5077 entry affects the WordPress Total theme. Vulnerable component: rendering of the_title() inside HTML attribute context in the Home Page blog section template. Root cause: insufficient output escaping in post titles, allowing Stored XSS. Impact: authenticated attackers with contri...
CVE-2026-5077
The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering thetitle inside HTML attribute context in the home blog section template. This makes it possible for authenticated...
CVE-2026-5077 Total <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in Blog Section Image alt Attribute
The Total theme for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.2.1 due to insufficient output escaping when rendering thetitle inside HTML attribute context in the home blog section template. This makes it possible for authenticated...
WordPress Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News plugin <= 3.4.9 - Unauthenticated Reflected Cross-Site Scripting vulnerability
Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin News & Blog Designer Pack versions = 3.4.9...
