CVE-2026-118189

The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-118022

The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-118189

The Posts Table with Search & Sort plugin for WordPress (versions up to and including 1.4.14 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the date_format parameter within the plugin's shortcode attributes. This all...

CVE-2026-118189 Posts Table with Search & Sort <= 1.4.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

The Posts Table with Search & Sort plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, 1.4.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-109972

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, = 261011 due to insufficient input sanitization...

CVE-2026-109972

The s2Member WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including

CVE-2026-109972 s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, = 261011 due to insufficient input sanitization...

EUVD-2026-111741

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, = 261011 due to insufficient input sanitization...

CVE-2026-109972 s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, = 261011 due to insufficient input sanitization...

WordPress S2Member cross-site scripting vulnerability

WordPress S2Member versions 261011 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and inadequate output escaping for the dateformat parameter, potentially enabling stored cross-site scripting attacks. Authenticated attackers with...

CVE-2026-109972: clavaque: The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions…

The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'dateformat' parameter in all versions up to, and including, = 261011 due to insufficient input sanitization...

CVE-2026-89089

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

EUVD-2026-75729

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089 OpenNMS SQL injection in shipped Asset Management JasperReports via the DATE_FORMAT parameter (ROLE_USER)

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

CVE-2026-89089

A SQL injection vulnerability in OpenNMS Meridian and Horizon allows a low-privileged authenticated user (ROLE_USER ) to exploit the DATE_FORMAT parameter in two shipped JasperReports ("Maintenance contracts expired" and "Maintenance contracts strategy") via the reporting REST API (POST /rest/rep...

CVE-2026-89089: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection vulnerability exists in the JasperReports-based reporting feature of multiple versions of OpenNMS Meridian and Horizon. A low-privileged authenticated user ROLEUSER can run the shipped, default-enabled online reports "Maintenance contracts expired" AssetManagementMaintExpired and...

SUSE CVE-2006-3469

Format string vulnerability in time.cc in MySQL Server 4.1 before 4.1.21 and 5.0 before 1 April 2006 allows remote authenticated users to cause a denial of service crash via a format string instead of a date as the first parameter to the dateformat function, which is later used in a formatted pri...

CVE-2020-8594: Improper Neutralization of Input During Web Page Generation

The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninjaformsrecaptchasitekey, ninjaformsrecaptchasecretkey, ninjaformsrecaptchalang, or ninjaformsdateformat...