1047702 matches found
CVE-2026-11588 EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...
CVE-2026-18325
CVE-2026-18325 affects Forminator Forms for WordPress, specifically versions
PT-2026-68591
Name of the Vulnerable Software and Affected Versions Thrive Architect versions prior to 10.9.3.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Thrive Architect...
CVE-2026-70441
Summary: CVE-2026-70441 affects Jenkins’ Summary Display Plugin v1.15 and earlier. The root cause is failure to escape the job name in a JavaScript context on build report pages, enabling a stored XSS vulnerability. Impact/conditions: exploit requires Item/Create or Item/Configure permissions; th...
CVE-2026-70440
Jenkins Qualys Container Scanning Connector Plugin 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
CVE-2026-70440
Vulnerability: Jenkins Qualys Container Scanning Connector Plugin, versions 1.8.0.5 and earlier, fails to escape user-controlled values in a JavaScript context, causing a stored XSS. Exploitation requires Item/Configure permission. As of the cited Jenkins advisory, there is no fix yet. Source: Je...
CVE-2026-53992 Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute...
EUVD-2026-53394
ProjectSend r2029 contains a reflected cross-site scripting vulnerability in thumbnails-regenerate.php that allows remote attackers to inject arbitrary HTML and JavaScript by supplying unsanitized values in the startdate and enddate GET parameters, which are echoed unescaped into HTML attribute...
CVE-2026-71275 OpenBK7231T - Reflected XSS via OTA host Parameter
OpenBK7231T's httpfnotaexec src/httpserver/httpfns.c reflects the host query parameter directly into an HTML response via hprintf255request, "OTA requested for %s!", tmpA with no HTML encoding, allowing a crafted URL such as /otaexec?host=alert1 to execute JavaScript in an authenticated admin's...
CVE-2026-71274 OpenBK7231T Stored XSS via Unsanitized MQTT-Set Channel Labels
OpenBK7231T's CHANNELSetLabel src/cmnds/cmdchannels.c stores channel labels received via the MQTT SetChannelLabel command using strdup with no HTML sanitization. CHANNELGetLabel returns these labels unsanitized, and they are rendered via hprintf255 at 15+ locations in src/httpserver/httpfns.c wit...
CVE-2026-71249 299Ko - Unauthenticated Reflected XSS in Public Contact Form
299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...
CVE-2026-71249
299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...
CVE-2026-71249
CVE-2026-71249 affects 299Ko’s public contact form. The vulnerability arises in the plugin/contact/controllers/ContactController.php (home()) where raw POST fields (name, firstname, email, message) are inserted into the page template without sanitization. The template engine’s _show_var() echoes ...
CVE-2026-71236
Grocy is affected by CVE-2026-71236 due to a flaw in its API request-body parser: after HTMLPurifier cleans values, the code re-decodes certain HTML entities (<, >, &) to , and &, effectively reconstructing live HTML/script tags. This double-decoding reintroduces stored XSS in API-writa...
CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
CVE-2026-71233 InvoiceNinja - Stored XSS via Invoice/Quote Terms Field
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! -terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization...
CVE-2026-71233
InvoiceNinja v5-stable renders an invoice or quote's "terms" field in the client portal using Laravel Blade's raw output directive !! $entity-terms !! resources/views/portal/ninja2020/invoices/includes/terms.blade.php with no HTML sanitization. StoreInvoiceRequest.php only strips newlines from th...
01-dev (1.0.0), 04-musicplayer (1.0.0) +1339 more potentially affected by CVE-2026-71215 via art-template (>=2.0.2, <=4.13.4)
art-template NPM version =2.0.2, =1.0.0, =0.0.1, =1.0.0, =0.0.1-alpha.1, =1.0.2-alpha.3, =1.0.0-alpha.1, =1.0.3-alpha.3, =1.1.4-alpha.1, =1.0.0-alpha.1, =0.1.0-alpha.1, =0.0.1-alpha.1, =0.0.2-alpha.13 and more Source cves: CVE-2026-71215 Source advisory: SNYK:JS-ARTTEMPLATE-18533449...
CVE-2025-15677
The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
EUVD-2026-53196
Pluck CMS's admin panel relies solely on a Referer-header comparison requestedByTheSameDomain in data/inc/functions.admin.php, gating every admin.php action for CSRF protection, with no per-request anti-CSRF token anywhere in the admin area. When a request carries no Referer/Host information, the...