212 matches found
Cross-site Scripting (XSS)
Overview camaleoncms is a dynamic and advanced content management system based on Ruby on Rails as an alternative to Wordpress. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the post title field. An attacker can execute arbitrary JavaScript in the context of oth...
CVE-2025-41102
HTML injection vulnerability found in Fairsketch's RISE CRM Framework v3.8.1, which consist of an HTML code injection due to lack of proper validation of user inputs by sending a POST request in parameter 'title' in '/events/save'...
CVE-2025-12118
The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This makes it possible for...
CVE-2025-12118
The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This makes it possible for...
CVE-2025-12118 Schema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema
The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This makes it possible for...
CVE-2025-12118 Schema Scalpel <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title in JSON-LD Schema
The Schema Scalpel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title in all versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping when outputting user-supplied data into JSON-LD schema markup. This makes it possible for...
EUVD-2020-23408
Malware in sbrugna...
CVE-2025-9206
The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
EUVD-2023-44341
Malicious code in bioql PyPI...
EUVD-2024-52910
Malicious code in bioql PyPI...
EUVD-2023-33689
Malicious code in bioql PyPI...
EUVD-2024-47554
Malicious code in bioql PyPI...
EUVD-2025-32267
Malicious code in bioql PyPI...
CVE-2025-9206
The Meks Easy Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post title field in all version up to, and including, 2.1.4. This is due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...
CVE-2025-9206
CVE-2025-9206 (Meks Easy Maps for WordPress) : A stored Cross-Site Scripting (XSS) vulnerability affects Meks Easy Maps plugin up to version 2.1.4. The issue arises from insufficient input sanitization and output escaping in the post title field, allowing authenticated users with contributor-leve...
CVE-2025-2942
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...
CVE-2025-2942
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...
CVE-2025-2942
CVE-2025-2942 affects the Order Delivery Date WordPress plugin prior to version 12.6.0. An unauthenticated AJAX action discloses arbitrary post titles (including drafts/private posts), enabling information disclosure. The root cause is an insecure AJAX endpoint that returns post title data withou...
CVE-2025-2942 Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...
CVE-2025-2942 Order Delivery Date Pro for WooCommerce < 12.6.0 - Unauthenticated Arbitrary Post Title Disclosure
The Order Delivery Date WordPress plugin before 12.6.0 discloses arbitrary post title such as from draft and private posts via an unauthenticated AJAX action, allowing attackers to retrieve such information...