CVE-2026-84219

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

CVE-2026-84219 Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

CVE-2026-84219

The Kirki WordPress plugin (versions before 6.3.0 , specifically identified as 6.2.1-6.2.5 in some records) is vulnerable to Unauthenticated Stored XSS . The root cause is that the plugin fails to restrict the various spellings of HTML entities it decodes during rendering. This allows an unauthen...

EUVD-2026-72065

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on...

PT-2026-86485

🚨 CVE-2026-84219 The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an...

CVE-2022-51009: Uncaught Exception

PocketMine-MP before 4.7.2 fails to properly handle exceptions from the adhocore/json-comment library when parsing skin geometry data. Attackers can send login or skin packets with invalid geometry JSON to trigger an unhandled RuntimeException, causing server crash...

PT-2026-86521

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

CVE-2026-86174

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

EUVD-2026-71973

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-86174

Plane (project management platform) through version 1.4.2 has a validation flaw in its public deploy-board comment endpoint . The endpoint fails to verify that a supplied issue_id belongs to the deploy board's own project, allowing authenticated attackers to post comments to arbitrary issues acro...

CVE-2026-86174 Plane through 1.4.2 Arbitrary Comment Write via Public Deploy Board

Plane through 1.4.2 fails to validate that issues belong to the deploy board's project in the public comment endpoint. Authenticated attackers can post comments to arbitrary issues across workspaces by supplying an issueid parameter to the public deploy-board comment endpoint...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-78438

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-78438 W3 Total Cache <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via LazyLoad Background Mutator

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-71882

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-77830 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk WordPress plugin (versions ≤ 6.86 ) contains a Stored Cross-Site Scripting vulnerability in the Comment Content aria-label Placeholder , caused by insufficient input sanitization and output escaping. Authenticated attackers with custom-level a...

CVE-2026-77830 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...