EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

CVE-2026-92538 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-92538: Improper Neutralization of Input During Web Page Generation

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-103909: Improper Neutralization of Input During Web Page Generation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url. ' parameter in all versions up to, and including, 5.5.1.5 du...

PT-2026-104503

Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

PT-2026-104489

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-97341: Improper Neutralization of Input During Web Page Generation

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2022-45472

CVE-2022-45472 DOM Based XSS 소프트웨어: CAE Learning Space Enterprise with Intuity License 이미지 버전: 267r 패치 레벨: 639 취약점: DOM Based XSS 설명 CAE Learning Space Enterprise 관리 소프트웨어는 DOM Based XSS 공격에 취약합니다. DOM Based XSS 공격은 사용자가 실행된 페이로드를 호스트에 전송하고, 그 결과 원래의 클라이언트 측 스크립트에서 피해자 브라우저의 DOM 환경을 수정하는 것입니다. 이...

CVE-2020-11023

CVE-2020-11023 POC Dom XSS 이 개념 증명은 JQuery DOM 메서드.append, .text, .html 등를 조작하여 사용하는 DOM 기반 XSS의 보안 결함을 시연합니다. 사용한 페이로드: alert"Text: " + $"test".text; 취약점을 테스트하려면 다음을 수행하세요: 1. 브라우저와 대상 사이트에서 웹 콘솔을 엽니다. 2. 콘솔 창으로 이동하여 다음 페이로드를 입력합니다: 3. 페이로드: alert"Text: " + $"test".text;...

CVE-2026-85492

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

EUVD-2026-91336

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

findom-xss

FinDOM-XSS FinDOM-XSS는 가능한 DOM 기반 XSS 취약점을 빠르게 찾을 수 있는 도구입니다. 설치 $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules 의존성: LinkFinder 사용법 대상에 대해 도구를 실행하려면 다음 명령어를 사용하세요. $ ./findom-xss.sh https://domain.tld/about-us.html 그러면 domain.tld에 대해 도구가 실행됩니다. 또한 URL을 파이프로...

PT-2026-104176

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.1.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform DOM-Based Cross-Site Scripting XSS via the URL pathname. This occurs when a user with the aiose...

CVE-2026-85492: Improper Neutralization of Input During Web Page Generation

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

WordPress Appointment Hour Booking – Booking Calendar plugin <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Zackary Loevseth in WordPress Plugin Appointment Hour Booking versions = 1.5.97...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

WordPress Social Media Share Buttons & Social Sharing Icons plugin <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Muhamad Visat in WordPress Plugin Social Media & Share Icons versions = 3.0.1...