CVE-2026-111069

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress (versions up to and including 2.8.192 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'twitterusername' custom field due to insufficient input sanitization and outp...

CVE-2026-110664

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 7.2.8 . The flaw exists in the 'note' parameter due to insufficient input sanitization and output escaping. Attackers with subscriber-level...

Vulnerabilities found in IBM DataPower Gateway and its underlying components

IBM has addressed several security issues in DataPower Gateway versions 10.5 through 11.0, along with numerous underlying components. The vulnerabilities involve a wide range of problems, such as use-after-free bugs, race conditions, buffer overflows, null pointer dereferences, integer overflows,...

WSO2-2021-1261

WSO2-2021-1261: Multiple Cross-Site Scripting in WSO2 ESB Due to improper output encoding, multiple Cross Site Scripting XSS attacks have been identified in WSO2 ESB. Vendor Disclosure: The vendor's disclosure and fix for this vulnerability can be found here. Why no CVE? Neither me nor the vendor...

CVE-2023-37191

CVE-2023-37191 — Issabel PBX 4.0.0-6: Stored Cross-Site Scripting XSS Overview Field| Details ---|--- CVE ID| CVE-2023-37191 Product| Issabel PBX issabel-pbx Affected Version| 4.0.0-6 Vulnerability Type| Stored Cross-Site Scripting XSS Severity| Medium Discovery Date| 7 July 2023 Discovered By|...

sudowp-hooks-visualizer

SudoWP Hooks Visualizer Contributors: SudoWP, WP Republic Original Authors: Stuart O'Brien, cxThemes Tags: hooks, actions, filters, developer-tool, debug, security-fork, cve-2024-6297 Requires at least: 5.8 Tested up to: 6.7 Stable tag: 1.3.2 License: GPLv2 or later Security Notice CVE-2024-6297...

CVE-2026-107764

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.6.7 . The root cause is insufficient input sanitization and output escaping of the url (comment_author_url) parameter. Because WordPress core's esc_url() func...

CVE-2026-95686 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...

CVE-2026-100158

The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.0.6 . The root cause is insufficient input sanitization and output escaping within the X-axis column value parameter. An authenticated attacker with Subscriber-level...

CVE-2026-21013-PDF-JavaScript-Injection-via-Embedded-Script

CVE-2026-21013 – PDF JavaScript Injection via Embedded Script Program Code Python generating malicious PDF generatepdfjsinject.py - Creates a PDF with embedded JavaScript pdf = b"""%PDF-1.7 1 0 obj endobj trailer %%EOF """ with open"malicious.pdf", "wb" as f: f.writepdf print"malicious.pdf create...

CVE-2023-33731

CVE-2023-33731 — eScan Management Console: Reflected Cross-Site Scripting XSS -orange Table of Contents Overview Vulnerability Details Severity & CVSS Score Affected Product Technical Analysis Proof of Concept Impact Mitigation & Remediation Disclosure Timeline References Author Overview A...

1CRM-CVE

1CRM-CVE 1CRM Software Vulnerability Vulnerabilities List CVE-2019-14221: Stored Cross Site Scripting...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Vulnearability Report of the New Jersey official site Bootstrap 4.0.0 Found in https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Vulnerability info: Medium 28236 XSS in data-template, data-content and data-title properties of tooltip/popover...

CVE-2026-109990 Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109990

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.2.4 . The root cause is insufficient input sanitization and output escaping within the 'comment' parameter. Attackers ...

CVE-2024-37383_PoC

This is a repository for hands-on practice of the CVE-2024-37383 vulnerability. Analysis Report: blog / pdf CVE-2024-37383 Detail Name : Roundcube Webmail SVG Parsing XSS Target : Roundcube Webmail v1.5.7 or v1.6.x tag into an email, arbitrary scripts are executed in the browser. Exploit git clon...

PAN-OS - Reflected Cross-Site Scripting

A reflected cross-site scripting XSS vulnerability in the GlobalProtect™ gateway and portal features of Palo Alto Networks PAN-OS® software enables execution of malicious JavaScript in the context of an authenticated Captive Portal user's browser when they click on a specially crafted link.The...

Nagios XI < 5.8.6 - Cross-Site Scripting

In Nagios XI before 5.8.6, XSS exists in the dashboard page /dashboards/ when administrative users attempt to edit a dashboard. id: CVE-2021-38156 info: name: Nagios XI 5.8.6 - Cross-Site Scripting author: ritikchaddha severity: medium description: | In Nagios XI before 5.8.6, XSS exists in the...

Simple File List < 4.4.12 - Cross Site Scripting

The plugin does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting id: CVE-2022-3062 info: name: Simple File List 4.4.12 - Cross Site Scripting author: r3Y3r53 severity: medium description: | The plugin does not escape parameters before...

Nagios XI 5.7.5 - Cross-Site Scripting

Nagios XI 5.7.5 contains a cross-site scripting vulnerability in the file /usr/local/nagiosxi/html/admin/sshterm.php, due to improper sanitization of user-controlled input. A maliciously crafted URL, when clicked by an admin user, can be used to steal session cookies, or it can be chained with th...