CVE-2026-116900

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REXINPUTMEDIA or REXINPUTLINK values that break out of the value...

CVE-2026-116900

REDAXO versions before 5.21.4 are vulnerable to a stored cross-site scripting (XSS) flaw. The issue arises because the software fails to escape certain values rendered by the media, medialist, link, and linklist widgets . Specifically, an attacker can submit crafted REX_INPUT_MEDIA or REX_INPUT_L...

EUVD-2026-110796

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REXINPUTMEDIA or REXINPUTLINK values that break out of the value...

PT-2026-126365

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX INPUT MEDIA or REX INPUT LINK values that break out of the val...

EUVD-2023-50842

Malicious code in bioql PyPI...

CVE-2023-46640

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in D. Relton Medialist plugin = 1.3.9 versions...

CVE-2023-5942

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-5942

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-5942

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross site scripting

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-5942 Medialist < 1.4.1 - Contributor+ Stored XSS

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-5942 Medialist < 1.4.1 - Contributor+ Stored XSS

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-5942

The CVE-2023-5942 entry corresponds to the Medialist WordPress plugin prior to 1.4.1. The vulnerability is due to not validating/escaping certain shortcode attributes before output, enabling a stored XSS when the shortcode is embedded in a page or post. Impact is described for users with the cont...

PT-2023-32432 · WordPress · Medialist

Name of the Vulnerable Software and Affected Versions: Medialist WordPress plugin versions prior to 1.4.1 Description: The issue concerns the Medialist WordPress plugin, which does not properly validate and escape certain shortcode attributes before outputting them in a page or post. This could...

WordPress plugin Medialist security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

CVE-2023-5942: Improper Neutralization of Input During Web Page Generation

The Medialist WordPress plugin before 1.4.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2023-46640

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in D. Relton Medialist plugin = 1.3.9 versions...

CVE-2023-46640

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in D. Relton Medialist plugin = 1.3.9 versions...

Cross site scripting

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in D. Relton Medialist plugin = 1.3.9 versions...

CVE-2023-46640 WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in D. Relton Medialist plugin = 1.3.9 versions...