CVE-2026-94376

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 3.0.4 . The root cause is insufficient input sanitization and output escaping in the User Display Nam...

CVE-2026-45014: Improper Neutralization of Input During Web Page Generation

ApostropheCMS is an open-source Node.js content management system. Versions up to and including 4.29.0 are vulnerable to stored cross-site scripting via unsanitized user display name in draft version tooltip. As of time of publication, no known patched versions are available...

CVE-2026-6486: Improper Neutralization of Input During Web Page Generation

A vulnerability was detected in classroombookings up to 2.17.0. This impacts the function read of the file crbs-core/application/views/layout.php of the component User Display Name Handler. The manipulation of the argument displayname results in cross site scripting. The attack can be executed...

Classroombookings 安全漏洞

Classroombookings is a school room reservation system developed by Craig A Rodway, based on PHP and MySQL. Versions of Classroombookings 2.17.0 and earlier contain security vulnerabilities. These vulnerabilities stem from the function read in the User Display Name Handler component’s...

CVE-2025-13746

The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User's Display Name in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2021-24028

Malware in sbrugna...

EUVD-2014-0017

Malware in sbrugna...

EUVD-2006-2308

Malware in sbrugna...

EUVD-2024-27449

Malicious code in bioql PyPI...

EUVD-2022-2338

Malicious code in bioql PyPI...

EUVD-2024-27301

Malicious code in bioql PyPI...

CVE-2024-1759

The WP ULike – Most Advanced WordPress Marketing Toolkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user's display name in all versions up to, and including, 4.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2021-21619

Jenkins Claim Plugin 2.18.1 and earlier does not escape the user display name, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers who are able to control the display names of Jenkins users, either via the security realm, or directly inside Jenkins...

CVE-2021-37463

In NCH Quorum v2.03 and earlier, XSS exists via User Display Name stored...

CVE-2024-1766

The CVE-2024-1766 is a Stored Cross-Site Scripting vulnerability in the WordPress Download Manager plugin (versions

CVE-2024-1759

CVE-2024-1759: WP ULike plugin for WordPress is vulnerable to Stored Cross-Site Scripting via a user’s display name in all versions up to 4.6.9 due to insufficient input sanitization and output escaping. Exploitation requires authenticated access (subscriber level or higher) and can allow injecti...

CVE-2024-2500 ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name

The ColorMag theme for WordPress is vulnerable to Stored Cross-Site Scripting via a user's Display Name in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authentciated attackers, with contributor-level access and...

WordPress Plugin Site Reviews Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-19618 · WordPress · Site Reviews

Name of the Vulnerable Software and Affected Versions: Site Reviews plugin for WordPress versions up to, and including, 6.11.4 Description: The issue is related to Stored Cross-Site Scripting via the user display name due to insufficient input sanitization and output escaping. This allows...

Site Reviews < 6.11.7 - Authenticated(Subscriber+) Stored Cross-Site Scripting via display name

Description The Site Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user display name in all versions up to, and including, 6.11.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber...