📄 WordPress 7.0.2 Code Execution / Cross Site Scripting

A proof of concept exploit for a reflected cross site scripting vulnerability in WordPress version 7.0.2. The vulnerability results from a parser differential between PHP striptags and WordPress KSES processing of usernames supplied to wp-login.php, allowing attacker-controlled markup to survive...

CVE-2026-19378

CVE-2026-19378 affects code-projects Task Management System 1.0. The issue concerns unknown processing of the file path /user/CommentSave.php where manipulating arguments comment/task_id/mineId/recId/myName/myImage triggers a cross-site scripting (XSS) vulnerability. This vulnerability can be exp...

CVE-2026-19378 code-projects Task Management System CommentSave.php cross site scripting

A vulnerability was found in code-projects Task Management System 1.0. This issue affects some unknown processing of the file /user/CommentSave.php. The manipulation of the argument comment/taskid/mineId/recId/myName/myImage results in cross site scripting. It is possible to launch the attack...

EUVD-2026-54259

CTI-Transmute contains a stored cross-site scripting vulnerability caused by insufficient neutralization of Vue template expression delimiters in server-rendered user-controlled data. An unauthenticated attacker can create a public conversion whose name or description contains a malicious Vue...

Cross-site Scripting (XSS)

Silverstripe CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of page titles when rendered in CMS breadcrumbs, which allows an attacker to inject malicious JavaScript that executes in the browser when the affected page list view is accessed...

Exploit for CVE-2026-64638

CVE-2026-64638 Reflected XSS on Login Screen Leading to PH...

Exploit for CVE-2026-64638

XSS2Shell — CVE-2026-64638 PoC WordPress Pre-Auth XSS → RCE e...

XSS2SHELL-POC

CVE-2026-64638 — XSS2Shell PoC Proof-of-concept tool for test...

Exploit for CVE-2026-64638

CVE-2026-64638 – XSS2Shell: WordPress login page pre-authentic...

CVE-2026-16535 Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

EUVD-2026-54732

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-16559 YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when...

CVE-2026-18988

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...

CVE-2026-18988 Easy Accordion <= 3.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'accordionTitleTag' Block Attribute

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...

CVE-2026-18988

The CVE-2026-18988 entry concerns the Easy Accordion plugin for WordPress, affected in versions up to and including 3.1.8. The underlying issue is insufficient input sanitization and output escaping in accordion_header_renderer(), which emits attacker-supplied tag names using esc_attr() in an HTM...

Exploit for CVE-2026-64638

CVE-2026-64638 — XSS2Shell Pre-Authentication Reflected X...

openSUSE 16 Security Update : python-Django (openSUSE-SU-2026:21543-1)

The remote openSUSE 16 host has a package installed that is affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21543-1 advisory. Changes in python-Django: - CVE-2026-15307: server-side file-write and request forgery via spatial lookups bsc1272997 - CVE-2026-15337: potentia...

Exploit for CVE-2026-64638

CVE-2026-64638 — Nuclei Detection Template Template Nuclei...

CVE-2026-48026 lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...

CVE-2026-48026 lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...