CVE-2026-83545

CVE-2026-83545 affects the CoolClock WordPress plugin in versions before 4.3.8 . The root cause is improper escaping of a custom skin setting before output within an inline script, enabling stored XSS . Users with contributor-level access or above can inject arbitrary JavaScript that executes whe...

CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

EUVD-2026-75956

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2022-21661

CVE-2022-21661 Exploit de CVE-2022-21661 para Elementor custom skin...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Entorno de vulnerabilidad Este entorno está configurado con el plugin Elementor Custom Skin para probar la CVE-2022-21661. Para iniciar el entorno: console wp-lab$ ./start.sh Para obtener la contraseña de administrador, obtén el registro del contenedor en ejecución;...

CVE-2026-14230 ECS < 4.3.8 - Contributor+ Stored XSS via Dynamic Repeater Bindings

The ECS WordPress plugin before 4.3.8 does not perform capability or object-ownership checks on its Dynamic Repeater AJAX handlers gated only by a capability-agnostic nonce that any editposts user obtains from the Elementor editor, so a Contributor can write a data-source binding into any post —...

EUVD-2000-1097

Malware in sbrugna...

CVE-2024-31987

XWiki Platform is a generic wiki platform. Starting in version 6.4-milestone-1 and prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, any user who can edit any page like their profile can create a custom skin with a template override that is executed with programming right, thus allowing remote...

CVE-2024-31987

CVE-2024-31987 affects XWiki Platform. Vulnerable in versions 6.4-milestone-1 through 4.10.18, and in 4.x prior to 4.10.19, 15.5.4, or 15.10-rc-1. The root cause is that any user who can edit a page can create a custom skin with a template override that is executed with programming rights, enabli...

Exploit for SQL Injection in Wordpress

CVE-2022-21661 CVE-2022-216...

Exploit for SQL Injection in Wordpress

CVE-2022-21661 CVE-2022-216...

CVE-2000-1112

Microsoft Windows Media Player 7 executes scripts in custom skin .WMS files, which could allow remote attackers to gain privileges via a skin that contains a malicious script, aka the ".WMS Script Execution" vulnerability...