Etherpad 2.1.0 <= 3.0.0 - Cross-Site Scripting

Etherpad versions 2.1.0 through 3.0.0 reflect the x-proxy-path request header into admin HTML, JavaScript, and CSS responses without sanitization. An attacker can abuse this behavior to inject crafted content into generated resource URLs, enabling cross-site scripting and cache poisoning scenario...

CVE-2023-39144

CVE-2023-39144 Background I discovered this vulnerability in May of 2023. Element55 produces software for law offices to track time. This software pulls information from various locations, such as Exchange, SQL, and Shoretel. Timeline May 24, 2023 - Reported vulnerability to Element 55 May 25, 20...

CVE-2026-85587

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85587

phpMyFAQ versions before 4.1.8 enforce incorrect authorization checks on admin content pages, specifically the news edit and FAQ translate endpoints. This allows users with only add permissions (a lesser-privileged editor role) to read draft and inactive content that is otherwise invisible to the...

CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-85587 phpMyFAQ before 4.1.8 Incorrect Authorization via Admin Pages

phpMyFAQ before 4.1.8 enforces incorrect permission checks on admin content pages, allowing lesser-privileged editors to read draft and inactive content. Attackers with only add permissions can access news edit and FAQ translate endpoints to view unpublished content invisible to the public...

CVE-2026-12865 Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters

The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...

CVE-2026-64851

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

CVE-2026-64851 Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers

Grav Shortcode Core Plugin allows for the development shortcode plugins that utilize the common format utilized by WordPress and BBCode. Prior to 6.2.2, Grav Shortcode Core passes shortcode syntax through Security::detectXss because it contains no literal less-than character, then...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16948

The Solace Extra WordPress plugin before 1.6.1 does not perform capability checks in several of its AJAX actions and exposes the nonce that protects them on admin pages reachable by low-privileged users, allowing users with a role as low as Subscriber to modify site-wide presentation settings and...

CVE-2025-15677 GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

EUVD-2025-210616

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-16295 Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

PT-2026-67660

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical...

EUVD-2026-49701

The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2026-7534

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

CVE-2026-65008

Grav 2.0.4 fixed in 2.0.7 contains a remote code execution vulnerability in Blueprint::dynamicData system/src/Grav/Common/Data/Blueprint.php, which passes a Class::method callable string and its arguments directly to calluserfuncarray without any allowlist. Because the form plugin routes page...