POC_CVE-2024-40492

CVE-2024-40492: Stored XSS to ATO Description Stored Cross-Site Scripting XSS is a type of security vulnerability typically found in web applications. It occurs when an attacker is able to inject malicious scripts into a web application, and those scripts are stored on the server. When other user...

CVE-2025-14221

Description 1. CVE-2025-14221 2. Discoverer: Fatma Trabelsi 3. Vendor of Product: SourceCodester 4. Affected Product: Online Banking System 1.0 POC A Stored Cross-Site Scripting XSS vulnerability exists in the User Profile Update functionality of the application. The application fails to properly...

CVE-2022-24227-updated

CVE-2022-24227 Updated - BoltWire v8.00 - Stored Cross-site Scripting XSS Description CVE-2022-24227 Updated : In version 8.00 of BoltWire CMS , the First Name and Last Name fields on the member registration completion page are also vulnerable to stored cross-site scripting XSS attacks, just like...

PT-2026-139456

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpdm regfirst name, wpdm reglast name, wpdm reguser login' parameter in all versions up to, and including, 7.5.9 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-132082

The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing first name, billing last name' parameter in all versions up to, and including, 3.7.29 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

PT-2026-123449

A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some unknown processing of the file /edit profile of the component Profile. The manipulation of the argument first name/last name leads to cross site scripting. The attack may be...

CVE-2026-100186

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-100186 User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-100186

The User Profile Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 4.0.3 . The flaw originates from insufficient input sanitization and output escaping within the First Name Field . An unauthenticated attacker can i...

CVE-2026-100186 User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-102682

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-100186: Improper Neutralization of Input During Web Page Generation

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes ...

PT-2026-115441

Name of the Vulnerable Software and Affected Versions User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor versions prior to 4.0.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site...

WordPress User Profile Builder Cross-Site Script Vulnerability

WordPress User Profile Builder 4.0.3 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the First Name field, resulting in a storage-based cross-site script. Unauthenticated attackers can inject any web...

PT-2026-113708

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.3 via the 'paramscustomerfirst name' parameter. This makes it possible for authenticated attackers, with...

PT-2026-109543

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-109483

The Download Manager plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.3.71 via the 'first name' parameter. This makes it possible for authenticated attackers, with subscriber-level access and above, to extract the administrator's full...

PT-2026-109592

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping first name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-92244

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-92244 PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields in all versions up to, and including, 5.16.1 due to insufficient input sanitization and output escaping. This makes it possible fo...