CVE-2026-93770 WordPress WP Statistics plugin <= 14.16.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Statistics = 14.16.13 versions...

CVE-2026-62079 WordPress Qi Addons For Elementor plugin <= 1.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Qi Addons For Elementor = 1.11 versions...

CVE-2026-62079

The Qi Addons For Elementor WordPress plugin, affecting versions

CVE-2026-62078 WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-62078

The Premium Addons for Elementor WordPress plugin, in versions

CVE-2026-27371 WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPFunnels = 3.13.1 versions...

EUVD-2026-89817

Contributor Cross Site Scripting XSS in Premium Addons for Elementor = 4.11.105 versions...

CVE-2026-27371

The WPFunnels plugin for WordPress versions

0l4bs

0l4bs Laboratorios de Cross-site scripting para entusiastas de la seguridad de aplicaciones web Lista de Desafíos : Desafío 1 | URL Desafío 2 | Form Desafío 3 | User-Agent Desafío 4 | Referrer Desafío 5 | Cookie Desafío 6 | LocalStorage Desafío 7 | Login Page Desafío 8 | File Upload Desafío 9 |...

CVE-2021-27403

UNAUTHENTICATED Cross-Site Scripting - Askey Internet Fiber Modem Vendor: Askey Software Version: BRSVg11.11RTFTEF001V6.54V014 Model: RTF8115VW Vulnerable Param: curWebPage Payload: ";alert'xss'// Not tested in other model/version. Via GET REQUEST At the login request we can issue a GET Request:...

XSS-Scanner

XSS Scanner Cross-Site Scripting XSS is one of the most well known web application vulnerabilities. It even has a dedicated chapter in the OWASP Top 10 project and it is a highly chased vulnerability in bug bounty programs. The scanner gets a link from the user and scan the website for XSS...

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin OAuth Server versions = 4.5.1...

CVE-2026-93908

The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.3 . The flaw exists in the 'before_price_text' parameter due to insufficient input sanitization and output escaping. Specif...

Web-Security-Learning

Web-Security-Learning Repository: https://github.com/CHYbeta/Web-Security-Learning Knowledge Planet Vulnerability Attack and Defense: https://t.zsxq.com/mm2zBeq Table of Contents: Web-Security-Learning Web Security SQL Injection MySQL MSSQL PostgreSQL MongoDB Techniques Tools XSS CSRF Other...

EUVD-2026-89663

Stored Cross-Site Scripting via custom content descriptions vulnerability exists in baserCMS . If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...

EUVD-2026-89661

Cross-Site Scripting via Script Validation Bypass exists in baserCMS. If this vulnerability is exploited, an arbitrary script may be executed in the user's web browser may be caused...

CVE-2026-102586

A flaw was found in Moodle. Insufficient sanitization of username input on the password reset page allows a remote attacker to conduct a cross-site scripting XSS attack. By convincing an unauthenticated user to access a specially crafted password reset link, an attacker could execute arbitrary...

CVE-2023-0214

SWG Exploit Generator ██████╗ ██████╗ ████████╗███████╗ ██╔═████╗██╔══██╗╚══██╔══╝██╔════╝ ██║██╔██║██████╔╝ ██║ ███████╗ ████╔╝██║██╔═══╝ ██║ ╚════██║ ╚██████╔╝██║ ██║ ███████║ ╚═════╝ ╚═╝ ╚═╝ ╚══════╝ by 0PTS Proof of Concept for the HTTP Response Splitting vulnerability in Skyhigh Secure Web...

CVE-2026-91832 WP Mobile Menu 2.7.4 - 2.8.8 - Stored XSS via CSRF

The WP Mobile Menu WordPress plugin before 2.9 does not correctly verify the nonce on its settings import, so an attacker can import arbitrary WP Mobile Menu WordPress plugin before 2.9 settings through a cross-site request in an administrator's session, and the imported values are then output...

CVE-2026-103047

A flaw was found in the MediaWiki CentralAuth extension. Improper neutralization of input in internationalization i18n messages allows a remote attacker to conduct stored Cross-Site Scripting XSS attacks. If exploited, malicious scripts execute within an unsuspecting user's browser session,...