Abandoned Cart Lite for WooCommerce < 5.2.0 - Cross-Site Scripting

The Abandoned Cart Lite for WooCommerce and Abandoned Cart Pro for WooCommerce plugins for WordPress are vulnerable to Stored Cross-Site Scripting via multiple parameters in versions up to, and including, 5.1.3 and 7.12.0 respectively, due to insufficient input sanitization and output escaping. i...

CVE-2021-38699-Reflected-XSS

CVE-2021-38699：TastyIgniter v3.0.7 餐厅 CMS 中的多处反射型 XSS TastyIgniter 管理后台 3.0.7 版本中存在已认证的反射型 XSS。 https://vulners.com/cve/CVE-2021-38699 POC： 管理后台 dashboard 的 start 参数： root@kitploit: POST http://cvefarm.local/admin/dashboard HTTP/1.1 User-Agent: Mozilla/5.0 X11; Linux x8664; rv:78.0 Gecko/20100101...

WordPress All-In-One Video Gallery <2.5.0 - Local File Inclusion

WordPress All-in-One Video Gallery plugin before 2.5.0 is susceptible to local file inclusion. The plugin does not sanitize and validate the tab parameter before using it in a require statement in the admin dashboard. An attacker can possibly obtain sensitive information, modify data, and/or...

EITS-Portal-Exploit-CVE-2026-31367-PoC

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC 此仓库包含针对 EITS Admin Dashboard v2.4.0 （CVE-2026-31367）中未认证的远程代码执行（RCE）漏洞的概念验证（PoC）。 该漏洞源于 /api/v1/debug 端点在输入清理方面的缺陷，攻击者可通过混淆的 payload 在服务器上注入并执行任意命令。 ⚠️ 法律声明（免责声明） 此脚本的创建严格用于教育和研究目的 。在未经事先双方同意的情况下，使用此工具攻击目标是非法的。作者不承担任何责任，也不对因使用本程序造成的任何滥用或损害负责。...

CVE-2022-38813

CVE-2022-38813 Veritical Privilege Escalation via user parameter in Blood Donor Management System Using Codeigniter v 1.0 Technical description: Blood Donor Management System 1.0 does not properly restrict access to admin/dashboard.php, which allows attackers to access all data of users, delete t...

CVE-2025-65271

CVE-2025-65271 PoC for CVE-2025-65271 How to run? node server.js Description Client-side template injection CSTI in Azuriom CMS admin dashboard allows a low-privilege user to execute arbitrary template code in the context of an administrator's session. This can occur via plugins or dashboard...

cve-2026-23550-poc

CVE-2026-23550 PoC Un pequeño probador en Bash para CVE-2026-23550. Solicita el endpoint de inicio de sesión del conector modular de WordPress afectado, verifica si se emite una cookie wordpressloggedin e intenta confirmar el acceso al panel de administración. Advertencia: Utilice esta herramient...

CVE-2026-25595

CVE-2026-25595 — InvoicePlane 1.7.0 中通过发票编号存储的 XSS 漏洞 漏洞类型： 通过发票编号字段存储的跨站脚本（XSS） 产品： InvoicePlane 受影响版本： 1.7.0（以及可能更早的版本） 严重性： 中危 CVSS 3.1 评分： 4.8（CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N） CWE： CWE-79：网页生成过程中输入的不当中和 发现者： Leonidas Agathos 报告日期： 2026-01-31 描述 发票表单中的 invoicenumber...

CVE-2026-7401-XSS

CET 自动化评分系统中的存储型 XSS — 学生注册（未认证 → 管理员仪表盘） 详细信息 字段| 值 ---|--- 供应商| SourceCodester 供应商 URL| https://www.sourcecodester.com 产品| 基于 PHP 和 MySQL 的 CET 自动化评分系统（含 AI 预测分析） 产品 URL| https://www.sourcecodester.com/php/18686/cet-automated-grading-system-ai-predictive-analytics-php-and-mysql.html 版本| 1.0 漏洞类...

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364

CVE-2026-78364 affects the MW WP Form WordPress plugin in versions prior to 5.1.6 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by failure to sanitize and escape form settings before outputting them in an admin dashboard page, specifically via the Inquiry Data List . An authen...

CVE-2026-15604

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

CVE-2026-15604

The CVE-2026-15604 entry concerns the Toocheke Companion WordPress plugin. It describes a Stored Cross-Site Scripting (Stored XSS) flaw in versions up to 2.10, caused by insufficient input sanitization in toocheke_series_bg_color_save() (stores raw $_POST in post meta) and inadequate output escap...

EUVD-2026-59893

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

PT-2026-73107

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'series bg color' post meta field. This is due to insufficient input sanitization in the toocheke series bg color save function which stores the raw $ POST value...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

EUVD-2026-57736

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...