Joomla! Component ZiMB Comment 0.8.1 - Local File Inclusion

A directory traversal vulnerability in the ZiMB Comment comzimbcomment component 0.8.1 for Joomla! allows remote attackers to read arbitrary files and possibly have unspecified other impacts via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1602 info: name: Joomla! Component...

WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting

The createComment mutation in the WPGraphQL 0.2.3 plugin for WordPress allows unauthenticated users to post comments on any article, even when 'allow comment' is disabled. id: CVE-2019-9881 info: name: WPEngine WPGraphQL 0.2.3 - Unauthenticated Comment Posting author: intelligent-ears severity:...

Advanced Comment System 1.0 - Local File Inclusion

ACS Advanced Comment System 1.0 is affected by local file inclusion via an advancedcomponentsystem/index.php?ACSpath=..%2f URI. id: CVE-2020-35598 info: name: Advanced Comment System 1.0 - Local File Inclusion author: daffainfo severity: high description: ACS Advanced Comment System 1.0 is affect...

YT-Spammer-Purge

YouTube Spammer Purge What Is This? - Allows you to filter and search for spammer comments on your channel and other's channels in many different ways AND delete/report them all at once see features below. How to Download: Click the "Releases" link on the right, then on the latest release, under...

CVE-2021-39473

CVE-2021-39473 Affected Product Code Base HotelManager - v1.2 Affected Component Kernel.php; Middleware Attack Type Remote Attack Vectors To exploit this vulnerability the user needs to create "rooms" or "guests" or "reservations" or "users" and in the "comment" or "contact" field can execute a x...

CVE-2026-120537

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment storage; originals / language / originallanguage exfiltration from endpoint' parameter in all versions up to, and including, 3.3.8 due to...

EUVD-2026-118974

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment storage; originals / language / originallanguage exfiltration from endpoint' parameter in all versions up to, and including, 3.3.8 due to...

CVE-2026-117525

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any...

EUVD-2026-118932

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any...

CVE-2026-117525 FV Player < 7.5.57.7212 - Unauthenticated Stored XSS via Comment Popup

The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not escape shortcode attribute values embedded in comments before rendering them into the media player markup, allowing an unauthenticated visitor to store a script payload in a comment that executes in the session of any...

CVE-2026-117525

The FV Flowplayer Video Player WordPress plugin (versions before 7.5.57.7212 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure to escape shortcode attribute values embedded within comments before they are rendered into the media player markup. This allows an...

CVE-2026-119167

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-118907

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119167

The TranslatePress WordPress plugin (versions

CVE-2026-119167 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-120677

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

CVE-2026-120677

The Optimole WordPress plugin (versions up to and including 4.2.18 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the comment parameter. This allows an unauthenticated attacker to inject arbitrary web...

EUVD-2026-118603

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

CVE-2026-119158 Pie Register <= 3.8.4.16 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter via Comment Avatar

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 3.8.4.16 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-119158

The Pie Register – User Registration, Profiles & Content Restriction plugin for WordPress (versions up to and including 3.8.4.16 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the first_name parameter. An unauthentic...