angularjs-poc-cve-2022-25869

概要 これは、Internet Explorer に影響する AngularJS の XSS 脆弱性 CVE-2022-25869 に対する最小限の Proof-Of-Concept です。 実際の動作は https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869 で確認できます。...

CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-94504: Improper Neutralization of Input During Web Page Generation

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

WordPress Ultimate Member plugin < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields vulnerability

Subscriber+ Stored XSS via Custom Textarea Profile Fields vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ultimate Member versions 2.12.0...

CVE-2025-25460

FlatPress CMS の格納型XSS v1.3.1 CVE-2025-25460 著者: Athul S 説明 FlatPress 1.3.1 の「エントリ追加」機能において、格納型クロスサイトスクリプティング XSS の脆弱性が確認されました。この脆弱性により、認証された攻撃者 がブログ記事に悪意のあるJavaScriptペイロードを注入でき、他のユーザーが記事を閲覧した際にペイロードが実行されます。問題は、ブログエントリ送信フォームの 「テキストエリア」フィールド に対する不適切な入力サニタイズ に起因します。 攻撃ベクトル 認証された攻撃者 がブログ記事のエントリに悪意のある...

CVE-2026-89255 AVideo LoginControl Stored XSS via PGP Public Key

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-89255

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The root cause is a failure to HTML-encode PGP public keys before echoing them into a element. An authenticated attacker can submit a crafted public ...

EUVD-2026-76067

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

CVE-2026-89255: Improper Neutralization of Input During Web Page Generation

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

PT-2026-89858

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafte...

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close

Summary A mutation-XSS / allowedTags bypass: when textarea or xmp is included in allowedTags, an input containing a literal a solidus right after the RCDATA end-tag name lets non-allowed markup such as pass through sanitizeHtml live and unescaped, even though img/onerror are not in the allowlist....

EUVD-2026-60440

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal solidus close...

WordPress Forminator Forms plugin <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability

Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.1...

CVE-2026-18324

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324

Forminator Forms (a WordPress plugin for building contact, payment, and custom forms) is vulnerable to Stored Cross-Site Scripting (XSS) via its Rich-Text Textarea field in all versions up to and including 1.57.0.1 . The root cause is insufficient input sanitization and output escaping , allowing...

EUVD-2026-67405

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-82861

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324: Improper Neutralization of Input During Web Page Generation

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...