CVE-2026-15798: Improper Neutralization of Input During Web Page Generation

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2024-10631: Improper Neutralization of Input During Web Page Generation

The Countdown Timer for WordPress Block Editor WordPress plugin through 1.0.5 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site...

WordPress Block Editor Bootstrap Blocks Plugin <= 6.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Block Editor Bootstrap Blocks Type Plugin Vulnerable versions = 6.6.1 Fixed in 6.6.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-11402 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0635cf898925 Credits Le Ngoc Anh Requir...