CVE-2023-44758_GDidees-CMS-Stored-XSS---Title

GDidees Stored XSS v3.0 Author: Sergio Description: Cross Site Scripting vulnerability in GDidees v.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Page Title. Attack Vectors: Scripting A vulnerability in the sanitization of the entry in the Page Title allows...

CVE-2026-111820

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-111820 Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-111820

The Analytics Insights – Google Analytics Dashboard for WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.3.12 . The root cause is insufficient input sanitization and output escaping specifically within the Page Title field. This flaw allows...

EUVD-2026-110599

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

CVE-2026-111820 Analytics Insights <= 6.3.12 - Unauthenticated Stored Cross-Site Scripting via GA4 Realtime Page Title

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

WordPress Analytics Insights cross-site scripting vulnerability

WordPress Analytics Insights versions 6.3.12 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping, resulting in stored cross-site scripting. Unauthenticated attackers can inject arbitrary web scripts into pages...

PT-2026-125869

The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title in all versions up to, and including, 6.3.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...

Artalk server request forgery vulnerability

Versions prior to Artalk 2.10.1 contain a server-side request forgery vulnerability. This vulnerability arises from unauthenticated server-side request forgery; attackers can submit anonymous comments to /api/v2/comments by setting pagekey to an internal URL. GetTitleByURL then performs only...

PT-2026-104074

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the page title parameter of the ahcpro track visitor AJAX action. The action is registered for logged-out callers wp ajax...

PT-2026-98387

Name of the Vulnerable Software and Affected Versions WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More versions prior to 2.0.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...

EUVD-2026-83504

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-85680

The Ultimate Member WordPress plugin (versions before 2.13.1 ) is vulnerable to an unauthenticated stored XSS flaw. The root cause is the failure to escape values derived from user-supplied profile names before they are output in the page title, combined with the decoding of HTML entities after s...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-92814

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

CVE-2026-92814: Improper Neutralization of Input During Web Page Generation

changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in monitored page titles that reaches notification channels like email and Telegram as live content when the watchtitle token i...

silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

GHSA-M4G4-86QC-V8W7 silverstripe/versioned has XSS in archive admin restore

Impact It's possible to use the page title as an XSS vector when restoring a page in ArchiveAdmin Reporter Steve Boyd Silverstripe Ltd...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the ArchiveAdmin restore process. An attacker can execute arbitrary scripts in the context of a user's browser by injecting malicious content into the page title field during the restore operation. Details...