CVE-2023-34840

CVE-2023-34840 Vulnerability Explanation All versions in angular-ui-notification are vulnerable to XSS due to the library not sanitizing the input provided by the user. In order to safely use this library, sanitizing / encoding the parameters passed to this library is highly recommended, such as...

Shield Security <= 21.0.8 - Unauthenticated Reflected XSS

Shield Security WordPress plugin = 21.0.8 contains a reflected cross-site scripting caused by insufficient input sanitization and output escaping in the 'message' parameter, letting unauthenticated attackers inject scripts, exploit requires user interaction. id: CVE-2026-0561 info: name: Shield...

CVE-2025-0924-different

Other Vulnerabilities Discovered During CVE-2025-0924 Analysis 01. Overview of Stored XSS and WordPress, WP Activity Log 1 Overview of Stored XSS and WordPress, WP Activity Log Stored XSS is a type of vulnerability where a malicious script is stored on the server and later automatically executed...

poc-cve-xss-encoded-wp-inventory-manager-plugin

Update - 5/10/2023 The CVE-2023-2123 ID was reserved and the PoC was published in the WPScan website: https://wpscan.com/vulnerability/44448888-cd5d-482e-859e-123e442ce5c1 Details Title: Unauthenticated Reflected Cross-Site Scripting in WP Inventory Manager Plugin for WordPress CMS Date: 2023-04-...

CVE-2026-76931

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931

The Zephyr Project Manager WordPress plugin (all versions up to and including 3.3.205 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'message' parameter , caused by insufficient input sanitization and output escaping. Authenticated attackers with Custom-level access or higher can in...

CVE-2026-76931 Zephyr Project Manager <= 3.3.205 - Authenticated (Custom+) Stored Cross-Site Scripting via 'message' Parameter

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

EUVD-2026-72696

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

PT-2026-87033

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-76931: Improper Neutralization of Input During Web Page Generation

The Zephyr Project Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘message’ parameter in all versions up to, and including, 3.3.205 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Custom-level...

CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

CVE-2026-57857

The Flow Payment plugin for WordPress (flow.cl) v3.0.8 is affected by a reflected cross-site scripting (XSS) on the WooCommerce checkout page. The vulnerability arises because error_message from an order-cancellation flow is passed directly to wc_add_notice() in flowpayment-fl.php (lines 57–58) w...

EUVD-2026-45400

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

EUVD-2026-38447

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmauthormessage' parameter in the pmsendmessagetoauthor function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output...

CVE-2026-4610 ProfileGrid <= 5.9.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Message Content

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pmauthormessage' parameter in the pmsendmessagetoauthor function in all versions up to, and including, 5.9.9.2 due to insufficient input sanitization and output...

CVE-2016-20063

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to...

CVE-2016-20063 Single Personal Message 1.0.3 WordPress Plugin SQL Injection

Single Personal Message 1.0.3 contains an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL queries by injecting malicious code through the message parameter. Attackers can access the admin interface and supply crafted SQL statements in the message parameter to...

PT-2026-47763

Name of the Vulnerable Software and Affected Versions Single Personal Message version 1.0.3 Description Authenticated users can execute arbitrary SQL queries by injecting malicious code through the message parameter. This allows attackers to access the admin interface and use crafted SQL statemen...