CVE-2026-129141

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. This allows an authenticated attacker to inject a clo...

EUVD-2026-125619

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for...