EUVD-2026-42098

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, dashboard text components render stored component content with Vue v-html without server-side HTML sanitization, allowing an authenticated user who can edit dashboard component data to inject HTML with executable...

CVE-2024-8284

The Download Manager WordPress plugin before 3.2.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

PT-2024-37548 · WordPress · Easy Table Of Contents

Name of the Vulnerable Software and Affected Versions: Easy Table of Contents WordPress plugin versions prior to 2.0.67.1 Description: The issue allows high privilege users, such as editors, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not...

CVE-2023-0328

The WPCode WordPress plugin before 2.0.7 does not have adequate privilege checks in place for several AJAX actions, only checking the nonce. This may lead to allowing any authenticated user who can edit posts to call the endpoints related to WPCode Library authentication such as update and delete...