CVE-2026-96573 Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CVE-2026-96573 Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

The Appointment Hour Booking – Booking Calendar plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer in all versions up to, and including, 1.5.97 due to insufficient input sanitization and output escapin...

CVE-2026-100179

The Calculated Fields Form (AI Form Builder for WordPress) plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.3 . The root cause is insufficient input sanitization and output escaping when processing the 'x' URL parameter (or any param...

EUVD-2026-90561

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'x any URL parameter consumed by the form's calculated equation' parameter in all versions up to, and including,...

CVE-2026-89047 Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-89047

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) via URL in versions up to and including 3.0.1 . The root cause is insufficient input sanitization and output escaping . Unauthenticated attackers can inject a...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

security-advisories

🔐 Minhajul Taivin의 보안 권고 제가 공개한 CVE 공개 정보의 공식 저장소에 오신 것을 환영합니다. 이 저장소에는 제가 발견한 취약점에 대한 상세 보안 권고, 개념 증명PoC 정보, 완화 전략, 기술 분석이 포함되어 있습니다. 📌 공개된 CVE 1️⃣ CVE-2025-63892 — SourceCodester 학생 성적 관리 시스템의 저장형 XSS 📄 권고: CVE-2025-63892.md 교실 설명 필드의 저장형 XSS 취약점으로 인해 임의 JavaScript 실행, 세션 하이재킹, 사용자 가장이 가능합니다. 2️⃣...

WordPress Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms plugin <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.3.4...

CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)

The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...

Linux Distros Unpatched Vulnerability : CVE-2026-102279

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a...

EUVD-2026-88508

Laravel: XSS in Debug Page Information...

Laravel: XSS in Debug Page Information

Impact When APPDEBUG=true, attacker-controlled input is passed to a Tippy.js tooltip configured with allowHTML: true, enabling DOM-based XSS during mouse hover. Patches 61381...

CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

DEBIAN-CVE-2026-102279

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279 Laravel: XSS in Debug Page Information

Laravel is a web application framework. Prior to 12.69.0 and 13.30.0, Laravel exception debug pages with APPDEBUG=true pass attacker-controlled input to a Tippy.js tooltip configured with allowHTML true, enabling DOM-based cross-site scripting when a user hovers over the tooltip. This issue is...

CVE-2026-102279

The Laravel web application framework is vulnerable to DOM-based cross-site scripting (XSS) in versions prior to 12.69.0 and 13.30.0 . When APP_DEBUG=true , the exception debug pages pass attacker-controlled input to a Tippy.js tooltip with allowHTML set to true. This allows an attacker to execut...