CVE-2023-4294

CVE ID : CVE-2023-4294 Vulnerability Type : Cross-Site Scripting Description : The URL Shortify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the referrer header in versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes ...

YZMCMSxss

YZMCMSxss CVE-2018-8078 YZMCMS v3.7最新版xss漏洞 YZMCMS V3.7 Stored XSS 这个xss存在于v3.7新增的广告管理模块，如图所示: This xss exists in v3.7 new advertising management module, as shown in the figure: 我们可以在YzmCMS-V3.7\application\advertisement\controller\adver.class.php第55-70行中找到广告管理编辑功能的具体代码，如图所示： We can find the...

CVE-2026-9811

CVE-2026-9811 CVE-2026-9811 es una vulnerabilidad de Cross-Site Scripting Almacenado Stored XSS que afecta a Mautic 7 versiones 7.0.0 a 7.1.1. La vulnerabilidad existe en el componente Project Selector, donde los nombres de proyecto devueltos a través de una solicitud AJAX se insertan en la págin...

CVE-2026-88793

The YouTube Embed WordPress plugin (versions 10.0–10.3 ) contains an unauthenticated stored XSS vulnerability in its youram_server AJAX action. The action performs no proper authorization check, relying solely on a nonce that is printed on every front-end page, and does not escape stored data bef...

CVE-2026-88793 YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

EUVD-2026-77087

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

CVE-2026-85129

CVE-2026-85129 affects the Hoo Companion WordPress plugin version 1.0.2 . The vulnerability resides in the plugin's theme settings import feature , which lacks any authorisation or validation checks and fails to sanitise submitted data before storing it as the active theme's settings. This allows...

EUVD-2026-77086

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-85129 Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which wi...

CVE-2026-74933

The GenieWords WordPress plugin, versions 1.5.27 through 1.5.34 , is affected by missing authorization checks on several of its REST API and AJAX actions. Because the plugin decodes stored values before outputting them, an unauthenticated attacker can overwrite the plugin's configuration and inje...

CVE-2026-74933 GenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

CVE-2025-44108-SXSS

CVE-2025-44108 - Stored cross site scriptingXSS vulnerabilities in the FlatPress CMS 1.3.1 Description A stored Cross-Site Scripting XSS vulnerability exists in the administration panel of Flatpress CMS 1.3.1. An attacker with admin privileges can inject a malicious JavaScript payload into the...

CVE-2025-46041

Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID CVE-2025-46041 Summary Type: Stored XSS Location: Page creation interface /admin/pages/add Impact:...

CVE-2021-27190-PEEL-Shopping-cart-9.3.0-Stored-XSS

CVE-2021-27190 - PEEL Shopping, carrito de compras de comercio electrónico - Vulnerabilidad de Cross-Site Scripting Almacenado en 'Dirección' Fecha 2021-02-11 Autor del Exploit Anmol K Sachan Página del proveedor https://www.peel.fr/ Enlace del software...

CVE-2023-43877-RiteCMS-Stored-XSS---Home

Rite CMS v3.0 Multiple Stored XSS Author: Sergio Description: Rite CMS 3.0 is affected by a Multiple Cross-Site scripting XSS stored vulnerability that allows attackers to execute arbitrary code via a payload crafted in the Home Page fields in the Administration menu. The payload will be executed...

CSRF-via-stored-XSS-for-PrivEsc

Chamilo LMS addLabelgetlang'Thread', $threadEntity-getTitle; 2. /public/main/forum/viewforum.php - Line 369 root@kitploit: .$thread-getTitle.''; 3. There are more! Root Cause: Forum thread titles are stored without proper sanitization Thread titles are displayed without HTML escaping in multiple...

CVE-2023-45992

CVE-2023-45992 A vulnerability in Ruckus CloudPath 5.12 build 5538 or before could allows a remote unauthenticated attacker to obtain full administrator privileges by leveraging Stored Cross-Site Scripting and Cross-Site Request Forgery Vulnerability using a crafted script. On 16 Oct 2023, the...

CVE-2023-49540

CVE-2023-49540 Book Store Management System v1.0 - Cross-site scripting XSS vulnerability in /index.php/history - vulnerable field: "Customer's Name". Description : Book Store Management System v1.0 was discovered to contain a cross-site scripting XSS vulnerability in /bsmsci/index.php/history. T...

CVE-2023-43344-Quick-CMS-Stored-XSS---SEO-Meta-description

Quick CMS Stored XSS v6.7 Author: Sergio Description: A Cross-Site Scripting XSS vulnerabiliti in Quick CMS v6.7 allows a local attacker to execute arbitrary code via a crafted script to the to the SEO - Meta description in the Pages Menu. Attack Vectors: Scripting A vulnerability in the...

CVE-2024-37383-exploit

Exploit Title: Roundcube mail server exploit for CVE-2024-37383 Stored XSS Google Dork: Exploit Author: AmirZargham Vendor Homepage: Roundcube - Free and Open Source Webmail Software Software Link: Releases · roundcube/roundcubemail Version: Roundcube client version earlier than 1.5.6 or from 1.6...