CVE-2026-30502-OpenKM-6.3.12-Reflected-XSS

🛡️ CVE-2026-30502 — Reflected XSS in OpenKM v6.3.12 Discovered & Reported by Dharmendra Kumar — Security Researcher Cybersecurity | Penetration Testing | Vulnerability Research | Responsible Disclosure 📌 Table of Contents Overview CVE Details Affected Product Vulnerability Description Root Cause...

CVE-2026-33917_SqlInjectionVulnerabilityOpenEMR8.0.0

CVE-2026-33917 - SQL Injection Vulnerability in OpenEMR Weakness CWE-89 Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize ...

CVE-2026-110534

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-110534

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 4.5.16 . The root cause is insufficient input sanitization and output escaping within the 'content' parameter . An authenticated attacker with Subscriber-level access or hig...

EUVD-2026-118910

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-110534 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

CVE-2026-110534 Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Color Scheme Name

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level acce...

EUVD-2026-117408

Cross-Site Request Forgery CSRF vulnerability in Apache Juneau. The REST server accepts a "content" query parameter that replaces the request body, and this is enabled by default on every HTTP method, including GET. A cross-site link can therefore deliver an attacker-chosen request body to an...

WordPress Document Embedder cross-site scripting vulnerability

WordPress Document Embedder versions 2.4.0 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and inadequate output escaping for the content parameter specifically, the postcontent block containing JSON with documentSource.doc. It may le...

WordPress Cozy Blocks cross-site scripting vulnerability

WordPress Cozy Blocks versions 2.2.27 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping for the content parameter icon.view/icon.layout/icon.gap, allowing authenticated attackers with contributor or higher privileges...

CVE-2026-116205

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying |URL wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal...

EUVD-2026-109463

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying |URL wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal...

PT-2026-123046

YesWiki before 4.7.0 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to fetch arbitrary URLs by supplying |URL wiki syntax to the render handler. Attackers can pass the syntax in the content parameter of the page render handler to reach internal...

CVE-2026-109985

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-103220

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-116358

Name of the Vulnerable Software and Affected Versions xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN versions prior to 1.4.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored...

CVE-2026-109985: Improper Neutralization of Input During Web Page Generation

The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109512

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and...

CVE-2026-109998

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-109998 Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...