1045700 matches found
CVE-2026-28004 WordPress Business Directory plugin <= 6.4.25 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...
CVE-2026-28004
Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...
CVE-2026-28004
WordPress Business Directory plugin
CVE-2026-28003
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
EUVD-2026-57943
Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...
CVE-2026-28003
The CVE-2026-28003 entry describes an unauthenticated Cross Site Scripting (XSS) vulnerability in WordPress Maspik – Spam blacklist plugin, affecting versions up to 2.9.1. The issue is documented with CVSSv3.1 base score 7.1 (HIGH) with NETWORK attack vector, no privileges required, user interact...
EUVD-2026-57942
Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...
CVE-2026-27539 WordPress Welcart e-Commerce plugin <= 2.11.31 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...
CVE-2026-27539
CVE-2026-27539 describes an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Welcart e-Commerce plugin, versions
CVE-2026-27537 WordPress Popup by Supsystic plugin <= 1.11.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.11.2 versions...
EUVD-2026-57934
Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...
CVE-2026-19716
CVE-2026-19716 affects maalfer Pentestify prior to 1.1.1 in the user management component. A stored XSS (CWE-79) vulnerability arises when the frontend escapes the username with escapeHTML() before inserting it into the onclick handler of the account deletion button; because HTML decodes attribut...
CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username
Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...
EUVD-2026-57930
Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...
CVE-2026-19716 Stored Cross-site Scripting in Pentestify user account deletion via unescaped username
Stored Cross-site Scripting CWE-79 in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the frontend escapes the username with escapeHTML...
Vulnerabilities managed in GitLab Enterprise Edition and Community Edition
GitLab has identified several vulnerabilities in its GitLab Enterprise Edition and Community Edition versions, ranging from 12.0 to 19.2.2. These vulnerabilities concern various aspects of GitLab, including incorrect privilege allocation, where users with pending membership statuses inadvertently...
CVE-2026-65900
A flaw was found in DOMPurify. When configured to sanitize HTML templates for direct Document Object Model DOM output, the software fails to properly remove malicious template expressions. This allows an attacker to inject specially crafted input that bypasses the sanitization process...
CVE-2026-73628
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...
CVE-2026-73628
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...