61 matches found
Netbox-CVE-2023-37625
Netbox-CVE-2023-37625 Description A stored cross-site scripting XSS vulnerability in Netbox alert1' 3. Add a new model, in this example add a 'manufacturer' model. 4. Open the newly created model as any authenticated user, and observer that the alert box has executed...
CVE-2026-107757
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107757 Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107757
The Gallery Custom Links plugin for WordPress (versions up to and including 2.3.3 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw is caused by insufficient input sanitization and output escaping involving the display_name (from profile.php) and comment (from wp-comments-post.php) ...
CVE-2026-107757 Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-100914
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
PT-2026-113720
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display name profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
CVE-2026-107757: Improper Neutralization of Input During Web Page Generation
The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...
WordPress Gallery Custom Links plugin <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Gallery Custom Links versions = 2.3.3...
WordPress Gallery Custom Links: Cross-site Scripting Vulnerabilities
WordPress Gallery Custom Links versions 2.3.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the displayname profile.php and comment wp-comments-post.php parameters. Certified attackers with subscription and...
CVE-2026-104073 NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
CVE-2026-104073: Exposure of Resource to Wrong Sphere
NetBox versions 2.9.5 before 4.7.0 contain a server-side template injection vulnerability that allows a low-privileged user with the "Can add custom links" permission to steal session cookies and API tokens of other users by exposing the raw Django HttpRequest object to the Jinja2 template contex...
CVE-2026-65534
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65534 WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65534 WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
EUVD-2026-48135
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65534
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65534
CVE-2026-65534 concerns the WordPress plugin "Custom links in Elementor Image Carousel" (versions
WordPress Custom links in Elementor Image Carousel plugin <= 1.1.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Custom links in Elementor Image Carousel versions = 1.1.1...