1125839 matches found
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Music Player for WooCommerce versions = 1.8.9...
WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Aydan Arabadzha in WordPress Plugin Realtyna Organic IDX plugin versions = 5.4.1...
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin CP Media Player versions = 1.3.0...
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by G0053 in WordPress Theme CozyStay versions = 1.10.0...
WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.16...
CVE-2026-56704
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...
EUVD-2026-65202
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...
CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...
CVE-2026-56704 Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String
Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing...
CVE-2026-56704
Adminer versions before 5.4.3 are vulnerable to cross-site scripting (XSS) caused by unsanitized database server version strings being inserted into [removed] tags that carry valid CSP nonces. An attacker who controls a rogue MySQL server can return a crafted version string that breaks out of the...
EUVD-2026-65176
Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...
EUVD-2026-65170
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...
EUVD-2026-65171
Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...
EUVD-2026-65163
Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...
RHEL 9 : golang (RHSA-2026:57649)
The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:57649 advisory. The golang packages provide the Go programming language compiler. Security Fixes: net/mail: golang: net/mail: Denial of Service via...
CVE-2026-78264
Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...
CVE-2026-78263
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...
CVE-2026-78282
Unauthenticated Cross Site Scripting XSS in Stripe Payments = 2.1.2 versions...