64 matches found
CVE-2026-118071
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...
EUVD-2026-113728
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...
CVE-2026-118071
The Joinchat WordPress plugin (versions 6.3.2 - 6.4.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to escape the message of its button block before outputting it into an HTML attribute on the front end. This vulnerability allows users with the Author role or higher to inj...
CVE-2026-118071 Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...
CVE-2026-118071 Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...
CVE-2026-118071: Unknown Joinchat: The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an…
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...
PT-2026-133289
The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including...
CVE-2026-116400
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7...
CVE-2026-116400 WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7...
CVE-2026-116400
The bPlugins Button Block WordPress plugin (versions n/a through 1.2.7 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation within the button-block component. This flaw allows an attacker to store m...
EUVD-2026-110043
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7...
CVE-2026-116400 WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7...
WordPress Button Block plugin <= 1.2.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Button Block versions = 1.2.7...
bplugins button block cross-site scripting vulnerability
Versions 1.2.7 and earlier of bplugins button block contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to stored cross-site scripting attacks...
PT-2026-125036
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Button Block button-block allows Stored XSS.This issue affects Button Block: from n/a through 1.2.7...
EUVD-2024-33446
Malicious code in bioql PyPI...
EUVD-2025-3019
Malicious code in bioql PyPI...
EUVD-2025-2996
Malicious code in bioql PyPI...