Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS 保存型XSS v1.6.1 著者: Sergio 説明: WBCE CMS 1.6.1 は、Pages メニューの Intro Page パラメータに作成されたペイロードを介して、攻撃者が任意のコードを実行できるようにする保存型クロスサイトスクリプティング XSS の脆弱性の影響を受けます。ペイロードはユーザーのセッションに関係なくメインページで実行されるため、別のユーザーでホームページにアクセスした場合もペイロードが実行されます。 POC: パネルにログインしたら、Pages http://localhost/wbce/wbce/admin/pages/index.p...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple 格納型XSS v2.2.18 著者: Sergio 説明: CMSmadesimple v.2.2.18 のクロスサイトスクリプティング脆弱性により、ローカルの攻撃者が File Picker Menu の Top Directory に細工したスクリプトを介して任意のコードを実行できる可能性があります。 攻撃ベクトル: スクリプティング "File Picker Menu" の Top Directory における入力のサニタイズ処理の脆弱性により、ユーザーが Web ページにアクセスしたときに実行される JavaScript コードの注入が可能になります。...

CVE-2025-51397

エクスプロイトタイトル: LiveHelperChat =4.61 - オペレーターの名字を利用した保存型クロスサイトスクリプティング（XSS） 日付: 09/06/2025 エクスプロイト作成者: Manojkumar J TheWhiteEvil LinkedIn: https://www.linkedin.com/in/manojkumar-j-7ba35b202/ ベンダーホームページ: https://github.com/LiveHelperChat/livehelperchat/ ソフトウェアリンク:...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

CVE-2026-73703

CVE-2026-73703 is a stored cross-site scripting (XSS) vulnerability in the web-based management interface of HPE Networking Fabric Composer . An unauthenticated adjacent attacker can inject malicious script that executes in a victim's browser within the context of the interface, requiring user in...

WordPress Affiliate Super Assistent plugin <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability

Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function vulnerability discovered by theviper17y in WordPress Plugin Affiliate Super Assistent versions = 1.10.2...

Security Bulletin: IBM Guardium Data Protection is affected by multiple vulnerabilities (CVE-2026-4917, CVE-2026-4918, CVE-2026-4919)

Summary IBM Guardium Data Protection has addressed these vulnerabilities in an update. Vulnerability Details CVEID:CVE-2026-4917 DESCRIPTION: IBM Guardium Data Protection 12.1 could allow an administrative user to traverse directories on the system. An attacker could send a specially crafted URL...

CVE-2021-46069

CVE-2021-46069 Titolo Exploit: Vehicle Service Management System - 'Elenco Meccanici' Stored Cross Site Scripting XSS Autore Exploit: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 MEDIUM Riferimenti: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

CVE-2026-55247 plone.app.event: Denial of service via iCalendar import

plone.app.event provides the event content type for Plone. Prior to versions 5.2.4 and 6.0.1, the iCalendar import in src/plone/app/event/ical/importer.py accepts insufficiently restricted calendar and event URLs, does not adequately bound downloaded bytes or imported events, and commits work per...

CVE-2026-6176

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and including 5.106.0. This is due to insufficient input sanitization and output escaping on user-supplied review comment text. The...

CVE-2026-59354

In versions of Spring Security's OAuth2 Authorization Server module 7.0.0 through 7.0.4, when Dynamic Client Registration is explicitly enabled, the registration endpoint performs insufficient validation of certain client metadata fields supplied by the registering client. An attacker who possess...

WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...