WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting

WordPress Catch Breadcrumb plugin before 1.5.4 contains a reflected cross-site scripting vulnerability via the s parameter a search query. Also affected are 16 themes if the plugin is enabled: Alchemist and Alchemist PRO, Izabel and Izabel PRO, Chique and Chique PRO, Clean Enterprise and Clean...

PT-2026-107763

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" term hierarchy must be...

Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212

This module enables you to show a breadcrumb trail for taxonomy term hierarchies. The module doesn't sufficiently check for view access of parent terms before rendering the crumb segment. This vulnerability is mitigated by the fact that the setting "Add parent hierarchy" termhierarchy must be...

CVE-2025-68722

CVE-2025-68722: Axigen WebAdmin CSRF Vulnerability Summary Critical state-changing actions in the Axigen WebAdmin interface are accessible via GET requests. While the h token protects against direct CSRF, the application processes queued requests via the s breadcrumb parameter immediately after a...

CVE-2026-100152

The All in One SEO WordPress plugin (versions up to and including 5.0.2 ) is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the software's failure to properly validate a value before passing it to the do_shortcode function. An attacker can exploit this by triggeri...

PT-2026-104498

Name of the Vulnerable Software and Affected Versions All in One SEO versions prior to 5.0.3 Description The plugin allows unauthenticated attackers to execute arbitrary shortcodes because it fails to properly validate a value before running the do shortcode function. This issue occurs when the...

CVE-2026-100152: Improper Control of Generation of Code

The The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.0.2 This is due to the software allowing users to execute an action that doe...

CVE-2026-84765

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84765 WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84765

Breadcrumb NavXT , a popular WordPress plugin, is affected by an unauthenticated Cross-Site Scripting (XSS) vulnerability in versions 7.5.1 and earlier . The flaw is classified with a CVSS 3.1 score of 7.1 (HIGH) , reflecting a network attack vector, low complexity, no privileges required, but re...

EUVD-2026-70580

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84765 WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

PT-2026-85105

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84765: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jiemook in WordPress Plugin Breadcrumb NavXT versions = 7.5.1...

CVE-2026-82654 SiYuan before v3.8.1 Stored XSS via block name

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654 SiYuan before v3.8.1 Stored XSS via block name

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

CVE-2026-82654

SiYuan before v3.8.1 is affected by a Stored XSS caused by improper escaping of block name , alias , and memo fields in hint, backlink, and breadcrumb rendering functions. An attacker can set a block's name to contain HTML or script tags that execute when another user views a document referencing...

CVE-2026-82654: Improper Neutralization of Input During Web Page Generation

SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb rendering functions. Attackers can set a block's name to contain HTML/script tags that execute when another user views documents referencing or displaying that block...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the rendering of breadcrumbs in the page list view. An attacker can execute arbitrary scripts in the context of the user's browser by injecting malicious input into the breadcrumb display. Details Cross-site...