EUVD-2026-21288

The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aFhfcheadcode, aFhfcbodycode, and aFhfcfootercode post meta values in all versions up to, and including, 2.3. This is due to the plugin outputting these meta values without any sanitization or...

CVE-2026-2305 AddFunc Head & Footer Code <= 2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Fields

The AddFunc Head & Footer Code plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aFhfcheadcode, aFhfcbodycode, and aFhfcfootercode post meta values in all versions up to, and including, 2.3. This is due to the plugin outputting these meta values without any sanitization or...

CVE-2025-48314

CVE-2025-48314 describes a Stored XSS in the WordPress plugin Add Code To Head . Affected versions are listed as from unspecified version through 1.17. The vulnerability arises from improper input neutralization during web page generation, enabling attacker-supplied data to execute scripts in a v...

CVE-2024-31613

BOSSCMS v3.10 is vulnerable to Cross Site Request Forgery CSRF in name="headcode" or name="footcode."...

CVE-2024-31613

CVE-2024-31613 affects BOSSCMS v3.10. The issue is a cross-site request forgery (CSRF) in the head_code or foot_code parameter, potentially enabling an attacker to cause unintended actions in the web application. The connected sources confirm the affected software and the CSRF nature but do not p...

BossCMS Security Breach

Wenzhou Huoyin Information Technology BossCMS is a content management system based on MySQL architecture of self-developed PHP framework by Wenzhou Huoyin Information Technology. A security vulnerability exists in BossCMS v3.10, which is caused by a cross-site request forgery CSRF vulnerability i...

CVE-2023-6990

The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta page-head-code. This makes it possible for authenticated attackers...

CVE-2023-6990

The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta page-head-code. This makes it possible for authenticated attackers...

CVE-2023-6990 Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Weaver Xtreme theme for WordPress is vulnerable to Stored Cross-Site Scripting via custom post meta in all versions up to, and including, 6.3.0 due to insufficient input sanitization and output escaping on user supplied meta page-head-code. This makes it possible for authenticated attackers...