3 matches found
CVE-2026-8841: Improper Neutralization of Input During Web Page Generation
The Extra Settings for RocketChat plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rocketchat' shortcode's 'title' attribute in versions up to, and including, 0.1. This is due to insufficient input sanitization and output escaping in the rxstgshortcode function, which...
6.4CVSS6AI score0.00321EPSS
SaveExploits0References2
WordPress Extra Settings for RocketChat plugin <= 0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by MAJidox in WordPress Plugin Extra Settings for RocketChat versions = 0.1...
6.4CVSS5.4AI score0.00321EPSS
SaveExploits0References1Affected Software1
20