angularjs-poc-cve-2022-25869

소개 이는 Internet Explorer에 영향을 미치는 AngularJS XSS 취약점에 대한 최소한의 개념 증명PoC입니다. CVE-2022-25869. 실제 동작은 https://neverendingsupport.github.io/angularjs-poc-cve-2022-25869에서 확인할 수 있습니다...

PT-2026-104119

The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ' e.g. kl code, kl post code' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-85235

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-85235

The Forminator Forms WordPress plugin (versions up to and including 1.57.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Rich-Text Textarea Field . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attackers to inject arbitrary web scr...

CVE-2026-85235 Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

EUVD-2026-90565

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2025-25460

FlatPress CMS 저장형 XSS 취약점 v1.3.1 CVE-2025-25460 작성자: Athul S 설명 FlatPress 1.3.1 의 "항목 추가Add Entry" 기능에서 저장형 교차 사이트 스크립팅XSS 취약점이 확인되었습니다. 이 취약점을 통해 인증된 공격자 가 블로그 게시물에 악성 JavaScript 페이로드를 삽입할 수 있으며, 다른 사용자가 해당 게시물을 볼 때 실행됩니다. 문제는 블로그 항목 제출 양식의 "텍스트 영역TextArea" 필드 에 대한 입력값 부적절한 정제 로 인해 발생합니다. 공격 경로...

CVE-2026-100643

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

EUVD-2026-87737

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

CVE-2026-100643

SiYuan versions before v3.8.4 are vulnerable to Stored XSS because they fail to properly escape four stored Attribute View values in textarea elements. An authenticated attacker can inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculat...

CVE-2026-100643 SiYuan before v3.8.4 Stored XSS via Attribute View textarea

SiYuan versions before v3.8.4 fail to properly escape four stored Attribute View values in textarea elements, allowing authenticated attackers to inject JavaScript by modifying field descriptions, template sources, select option descriptions, or footer calculation templates. Attackers can execute...

Exploit for CVE-2026-94504

cve-2026-94504 Ninja Forms unauth stored XSS POC Ninja Forms...

CVE-2026-94504

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-94504 Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

CVE-2026-94504: Improper Neutralization of Input During Web Page Generation

Ninja Forms 3.15.3 stores an anonymous non-RTE textarea value and renders it without safe HTML encoding in the legacy submission editor. An attacker can break out of the textarea with stored script. When an Administrator opens the attacker-known direct submission URL, the script runs in the...

PT-2026-96653

Name of the Vulnerable Software and Affected Versions Ninja Forms versions prior to 3.15.4 Description Stored Cross-Site Scripting occurs when the legacy submission editor renders an anonymous non-RTE textarea value without safe HTML encoding. This allows an attacker to inject a stored script tha...

WordPress Ultimate Member plugin < 2.12.0 - Subscriber+ Stored XSS via Custom Textarea Profile Fields vulnerability

Subscriber+ Stored XSS via Custom Textarea Profile Fields vulnerability discovered by Meher Sudhakar Abbireddi in WordPress Plugin Ultimate Member versions 2.12.0...

CVE-2026-89255

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a stored cross-site scripting vulnerability in the LoginControl plugin . The root cause is a failure to HTML-encode PGP public keys before echoing them into a element. An authenticated attacker can submit a crafted public ...