CVE-2026-75966

The Podlove Podcast Publisher WordPress plugin (all versions ≤ 4.5.5) is vulnerable to Stored Cross-Site Scripting via the episode_contributor[..][..][comment] parameter. The root cause is insufficient input sanitization and output escaping: the contributor comment is stored in a plugin-managed c...

EUVD-2026-74609

The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'episodecontributor....comment' Parameter in all versions up to, and including, 4.5.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77187

The My Calendar – Accessible Event Manager WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.8.3 . The root cause is insufficient input sanitization and output escaping of the before and after shortcode attributes , allowing authenticated at...

CVE-2026-77186 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-77187 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-77187 My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

EUVD-2026-74604

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticat...

CVE-2026-77186

The My Calendar – Accessible Event Manager WordPress plugin (versions ≤ 3.8.3 ) is vulnerable to Stored Cross-Site Scripting via the fallback shortcode attribute. Authenticated users with contributor-level access or higher can inject arbitrary scripts by submitting hex-encoded payloads (e.g. \x3c...

EUVD-2026-74603

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'fallback' Shortcode Attribute in all versions up to, and including, 3.8.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

EUVD-2026-74602

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84293 Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values in all versions up to, and including, 3.0.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-84293

The Repeater Fields for Gravity Forms WordPress plugin (versions up to and including 3.0.4 ) is vulnerable to Stored Cross-Site Scripting via repeated multi-input sub-field values due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web script...

CVE-2025-70368

CVE-2025-70368 项目更新功能中的存储型跨站脚本（XSS）漏洞 | Worklenz 面向高效团队的一体化项目管理工具 ---|--- 📜 描述 Worklenz 版本 2.1.5 在项目更新功能中存在一个存储型跨站脚本（XSS）漏洞。攻击者可以在更新文本字段中提交恶意载荷，该载荷随后在报告视图中未经适当过滤即被渲染。当受害者浏览包含该漏洞字段的页面时，恶意 JavaScript 可能会在受害者的浏览器中执行。 🔍 受影响版本 状态| 版本 ---|--- 🔴 受影响| 2.1.5 🛠️ 复现步骤 1️⃣ 导航至 项目 → "项目名称" → 更新 2️⃣ 输入以下载荷：...

CVE-2026-36358

CVE-2026-36358 PoC - Juzaweb CMS v.5.0.0 （XSS） Primero, configura la plataforma normalmente y registra una cuenta. Aquí, la cuenta de administrador que registré es [email protected] / 123456. Después de configurar la plataforma, puedes ver la página de inicio del sitio web. Accede a /admin e...

CVE-2026-13359

The Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cntctfrmcontactdropdown Parameter in all versions up to, and including, 1.7.5 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-13709

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'iqtreetreecharttemplate' Widget Setting in all versions up to, and including, 3.1.11 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-57298

通过不安全的 Markdown 渲染导致的存储型 XSS 漏洞（Kotaemon） 概述 Kotaemon 是一个基于 RAG（检索增强生成）的开源文档问答系统，提供 Web 界面用于查询上传的 PDF、Word 和 Excel 等文件。 Kotaemon 的文档渲染管道中存在一个存储型跨站脚本（XSS）漏洞。 用户控制的内容经过 LLM 处理后，在 Markdown 到 HTML 的转换过程中未进行适当的清理，从而允许攻击者提供的 HTML 元素被持久性地注入到页面中。 当上传一份文档时，系统会自动触发一个摘要请求（例如“summary this...

CVE-2024-50803-Redaxo

CVE-2024-50804 Redaxo 的 mediapool 功能中的存储型 XSS 在 Redaxo 版本 5.18.0 中发现了一个存储型跨站脚本（XSS）漏洞，允许具有足够权限的攻击者通过 mediapool 功能上传恶意 SVG 文件。 发布了一篇分析文章 ：https://medium.com/@praison66/5d15a3cd054d 由 Praison 于 2024 年 9 月发现。 参考 ： https://vulners.com/cve/CVE-2024-50804...

CVE-2025-65300

CVE-2025-65300 描述 CVE-2025-65300：Coohom SaaS 平台中的存储型跨站脚本（XSS）漏洞 披露日期：2025-10-28 最后更新：2025-10-28 报告者：Phisit Pupiw 厂商：Coohom CWE：CWE-79 – 跨站脚本 摘要 在 Coohom SaaS 平台的“账户设置 → 个人资料 → 地址”模块中发现了一个存储型跨站脚本（XSS）漏洞。存储在“城市”、“州/省”和“国家/地区”字段中的用户输入在未进行适当清理或上下文相关输出编码的情况下被渲染回客户端。 攻击者可以存储恶意 JavaScript...