54 matches found
CVE-2026-119089
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...
CVE-2026-119089 ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...
EUVD-2026-114598
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...
CVE-2026-119089
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.12.1 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter ....
CVE-2026-119089 ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...
PT-2026-134455
The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.12.1 due to insufficient input sanitization and output escaping. This make...
DRUPAL-CONTRIB-2026-190
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...
PT-2026-97676
Name of the Vulnerable Software and Affected Versions Drupal Smart Content versions 0.0.0 through 3.2.1 Description Missing authorization in the Smart Content Block submodule allows forceful browsing. The issue occurs when the module renders blocks of a "Display Blocks" reaction via the AJAX...
Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
This module enables you to personalize content for anonymous and authenticated users by showing different blocks to visitors based on client-side conditions. The Smart Content Block submodule doesn't sufficiently check block access when it renders the blocks of a "Display Blocks" reaction through...
CVE-2026-92779
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...
EUVD-2026-81042
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto, prototype, or constructor paths to...
PT-2026-94056
Builder.io Gen2 SDKs through versions 5.2.11 and 0.25.13 contain a prototype pollution vulnerability in the deep-set helper function that processes content block bindings without validation. Attackers can craft content blocks with binding keys containing proto , prototype, or constructor paths to...
WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block
Description Gutenberg does not restrict a block attribute used as an HTML tag name, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the Gutenberg plugin and,...
CVE-2026-45572
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...
CVE-2026-45572 Decidim: HTML content blocks allow stored script execution
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...
CVE-2026-45572 Decidim: HTML content blocks allow stored script execution
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...
CVE-2026-45572: Improper Control of Generation of Code
Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, an administrator with landing-page editing privileges can store arbitrary HTML and JavaScript in an HTML content block, which Decidim::ContentBlocks::HtmlCellhtmlconten...
PT-2026-60073
Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An administrator with landing-page editing privileges can store arbitrary HTML and JavaScript within an HTML content block. The...
CVE-2026-0894
The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contentblock shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created...
CVE-2026-0894
The Content Blocks Custom Post Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's contentblock shortcode in all versions up to, and including, 3.3.9 due to insufficient input sanitization and output escaping on user supplied values consumed from user-created...