CVE-2026-111979

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that...

CVE-2026-111979 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that...

CVE-2026-111979 GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color

The GiveWP WordPress plugin before 4.19.0.1 does not properly sanitise and escape one of its donation form template settings before outputting it inside an HTML attribute, allowing users with a custom form-editing GiveWP WordPress plugin before 4.19.0.1 role to inject arbitrary web scripts that...

CVE-2026-111979

The GiveWP WordPress plugin (versions before 4.19.0.1 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly sanitise and escape one of its donation form template settings before outputting it within an HTML attribute . An attacker with ...

CVE-2026-75107

Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...

CVE-2026-14318: Improper Neutralization of Input During Web Page Generation

The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor...

Discourse security vulnerabilities

Discourse is an open-source community discussion platform developed by Discourse. This platform includes features such as communities, email communication, and chat rooms. Versions of Discourse prior to 2026.1.4, 2026.3.1, 2026.4.1, and 2026.5.0-latest.1 contain security vulnerabilities. These...

CVE-2025-13469

CVE-2025-13469 affects Public Knowledge Project platforms PKP OJS/OMP/Ops (versions 3.3.0/3.4.0/3.5.0) where an attacker can trigger a cross-site scripting (XSS) by manipulating the argument manualInstructions in the file plugins/paymethod/manual/templates/paymentForm.tpl under the Payment Instru...

CVE-2025-13469 Public Knowledge Project omp/ojs Payment Instructions Setting paymentForm.tpl cross site scripting

A security vulnerability has been detected in Public Knowledge Project omp and ojs 3.3.0/3.4.0/3.5.0. Impacted is an unknown function of the file plugins/paymethod/manual/templates/paymentForm.tpl of the component Payment Instructions Setting Handler. The manipulation of the argument...

Public Knowledge Project Platform OJS/OMP/OPS Code Injection Vulnerability

Public Knowledge Project Platform OJS/OMP/OPS PKP Platform OJS/OMP/OPS is an open source publishing platform from Public Knowledge Project, Inc. A code injection vulnerability exists in Public Knowledge Project Platform OJS/OMP/OPS, which stems from an incorrect manipulation of parameter...

CVE-2025-7408

A vulnerability has been found in SourceCodester Zoo Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/templates/animalformtemplate.php. The manipulation of the argument msg leads to cross site scripting. The attack can be initiated...

SourceCodester Zoo Management System Code Injection Vulnerability

SourceCodester Zoo Management System is a SourceCodester open source zoo management system. A code injection vulnerability exists in SourceCodester Zoo Management System version 1.0, which originates from a cross-site script that can be caused by manipulation of the parameter msg in file...

WordPress Ninja Forms 3.6.25 Plugin - Reflected XSS Exploit

Exploit Title: WordPress Plugin Ninja Forms 3.6.25 - Reflected XSS Authenticated Google Dork: inurl:/wp-content/plugins/ninja-forms/readme.txt Exploit Author: Mehran Seifalinia Vendor Homepage: https://ninjaforms.com/ Software Link: https://downloads.wordpress.org/plugin/ninja-forms.3.6.25.zip...

KLA11566 RCE vulnerability in Foxit Reader

Out-of-bounds reading vulnerabilities was found in Foxit Reader. Malicious users can exploit this vulnerability via specially designed document to execute arbitrary code or cause denial of service. Technical details Potentially vulnerable components are AcroForm, TIF File ConvertToPDF, JPG File...

CVE-2018-1000826

Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...

CVE-2018-1000826: Improper Neutralization of Input During Web Page Generation

Microweber version = 1.0.7 contains a Cross Site Scripting XSS vulnerability in Admin login form template that can result in Execution of JavaScript code...

PT-2018-9550

Name of the Vulnerable Software and Affected Versions Microweber versions prior to 1.1 Description The issue concerns a Cross Site Scripting XSS vulnerability in the Admin login form template, which can lead to the execution of JavaScript code. Recommendations For Microweber versions prior to 1.1...

PT-2017-16878

Name of the Vulnerable Software and Affected Versions CMS Made Simple version 1.x Form Builder before version 0.8.1.6 Description The issue allows remote attackers to execute PHP code. This is achieved via the cntnt01fbrp forma form template parameter in the admin store form endpoint...