4207 matches found
CVE-2026-109933
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...
CVE-2026-109933 Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...
CVE-2026-109933
The Otter Blocks WordPress plugin, in versions prior to 3.2.8 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient sanitization and escaping of user-supplied block styling values before they are written into an inline stylesheet . This allows users with ...
EUVD-2026-108586
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...
PT-2026-121759
The Otter Blocks WordPress plugin before 3.2.8 does not properly sanitize and escape user-supplied block styling values before writing them into an inline stylesheet, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when any visitor, including...
CVE-2026-114570
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...
CVE-2026-114570
WordPress Core versions up to and including 7.0.2 are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the insufficient escaping of user display names within the Quick Edit functionality. An authenticated attacker with Contributor-level access or higher can inject arbitra...
CVE-2026-114570 WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...
CVE-2026-114570 WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...
EUVD-2026-108007
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...
PT-2026-121274
WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2 due to insufficient escaping of user display names. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts i...
EUVD-2026-104011
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bstcontent shortcode. The bstcontent shortcode handler in inc/bstabs.php emits the id attribute value into an unquoted HTML attribute. escattr is applied, but it does not encode spac...
CVE-2026-112111
The Bootstrap Shortcodes plugin for WordPress (versions before 3.4.6 ) is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The root cause is located in the bs_tcontent() handler within inc/bs_tabs.php, which emits the id attribute into an unquoted HTML attribute. Whil...
PT-2026-117162
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the bs tcontent shortcode. The bs tcontent shortcode handler in inc/bs tabs.php emits the id attribute value into an unquoted HTML attribute. esc attr is applied, but it does not encode...
CVE-2026-104122
The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...
CVE-2026-91074
The BSK PDF Manager WordPress plugin through 3.8.1 does not properly sanitise and escape a parameter before using it in a SQL statement, which could allow authenticated users with contributor-level access and above to perform SQL injection attacks and read sensitive data such as administrator...
CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name
The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...