CVE-2026-97195

The Secure Custom Fields WordPress plugin (versions before 6.9.8 ) is vulnerable to a Stored XSS attack due to insufficient sanitization of a persisted field definition. An attacker with the ability to configure fields can store a payload that is emitted as an HTML attribute name , leading to Jav...

CVE-2026-75107: Improper Neutralization of Input During Web Page Generation

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...

CVE-2020-23481

CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...

Cross site scripting

CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...

CVE-2020-23481

CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...

PT-2021-10902

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.14 Description A cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field. This enables attackers to potentially steal user da...

CVE-2020-23481: Improper Neutralization of Input During Web Page Generation

CMS Made Simple 2.2.14 was discovered to contain a cross-site scripting XSS vulnerability which allows attackers to execute arbitrary web scripts or HTML via a crafted payload in the Field Definition text field...