WordPress EONSR AEO Agent Cross-Site Script Vulnerability

WordPress is a free and open-source content management system CMS and blog platform built on PHP/MySQL. The WordPress EONSR AEO Agent has a cross-site scripting vulnerability. This vulnerability stems from the lack of authorization checks in the REST API routing, and HTML content cleaning is...

ROS-20260812-73-0019

The vulnerability in dnsdist relates to the failure to take measures to eliminate script-related HTML tags on web pages. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

ROS-20260812-73-0037

The vulnerability of the XStream library used by Jenkins automation servers is related to deficiencies in the deserialization mechanism. Exploiting this vulnerability allows a malicious actor to replace HTTP requests, gain unauthorized access to the Script Console, execute arbitrary code, or...

MAL-2026-13933 Malicious code in cc-skills-helper (npm)

The npm package cc-skills-helper is a Windows-only supply-chain dropper published as seven versions 1.0.0 through 1.0.6 in a single 8-hour burst on 2026-04-25 by npm user betatester44676 [email protected], then abandoned. dist-tags.latest points at 1.0.6. All seven versions share the same...

PT-2026-71017

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013: Improper Neutralization of Input During Web Page Generation

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-65937: Improper Neutralization of Input During Web Page Generation

In WhatsUp Gold versions released before 2026.0.2, an authenticated attacker can bypass frontend controls and inject persistent script content...

PT-2026-71118

Name of the Vulnerable Software and Affected Versions WhatsUp Gold versions prior to 2026.0.2 Description An authenticated attacker can bypass frontend controls to inject persistent script content. This allows for a stored cross-site scripting attack, where malicious scripts are permanently store...

VulnCheck KEV: CVE-2026-72530

TrueConf Server contains a code injection vulnerability that could allow an unauthorized remote attacker with network access via port 4307/TCP to use a specially crafted script to break out of the isolated environment and execute arbitrary code on the host system...

CVE-2026-73490: Improper Neutralization of Input During Web Page Generation

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...

PT-2026-71008

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

WordPress AI Engine Cross-Site Script Vulnerability

WordPress AI Engine is an official WordPress plugin developed by developer JordyMeow. It aims to seamlessly integrate mainstream large language models such as OpenAI, Anthropic, and Google into the WordPress backend, providing core features like chatbots, content generation, AI forms, and...

CVE-2026-18099: Improper Neutralization of Input During Web Page Generation

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary script code due to improper neutralization of user-controlled input...

PT-2026-75981

Summary LegacyController.php:75 writes the page title into a document.title JS assignment using string interpolation. apps/proxmox.inc.php pushes $vars'instance' and $vars'vmid' GET params, only strip tags applied directly into $pagetitle. A single quote terminates the JS string, executing...

WordPress Forminator cross-site scripting vulnerability

WordPress Forminator is a free and open-source content management system CMS and blog platform built on PHP/MySQL. WordPress Forminator has a cross-site scripting vulnerability. This vulnerability arises from ForminatorCore::sanitizearray, which skips fields starting with “select”, and setfieldda...

RHEL 7 : rhc-worker-script (RHSA-2026:54191)

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:54191 advisory. Remote Host Configuration rhc worker for executing scripts on hosts managed by Red Hat Lightspeed. Security Fixes: net/url: Incorrect parsi...

CVE-2026-73250

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, the Notepad++ Windows 11 x64 and ARM64 installer passes the attacker-influenced installation directory $INSTDIR from PowerEditor/installer/nppSetup.nsi into a PowerShell -Command string used by RegisterMSIX to invoke...

MAL-2026-13753 Malicious code in dcfarguscert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...

Malicious code in dcfarguscert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6b0841cccc5aa4961351a4cf991d7744a1d7acc4da3824321fed50e1e7b8657d [email protected] registers both preinstall and postinstall lifecycle scripts that invoke src/telemetry.js. On install, telemetry.js collects host...

CVE-2026-73084

Activepieces is an open source AI workflow automation platform. Prior to 0.83.0, the /api/redirect OAuth callback endpoint embeds the user-supplied code query parameter directly into an inline script block without proper escaping. A crafted request to /api/redirect with a malicious code value can...