CVE-2026-100691

A flaw was found in Hugo. The syntax highlighter fails to properly sanitize the lineAnchors option, resulting in a stored Cross-Site Scripting XSS vulnerability. A remote attacker capable of submitting Markdown content can exploit this by supplying a crafted lineAnchors code block attribute. When...

Linux Distros Unpatched Vulnerability : CVE-2026-100691

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before...

DEBIAN-CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100691 Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100691

Hugo versions 0.75.0 through 0.165.x are vulnerable to a stored cross-site scripting (XSS) flaw in the syntax highlighter. The component fails to escape the lineAnchors option before passing it to Chroma , which writes the value verbatim into the id and href attributes of the generated line-numbe...

EUVD-2026-87664

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-100691 Hugo before 0.166.0 Stored XSS via lineAnchors code block option

Hugo versions 0.75.0 through 0.165.x contain a stored cross-site scripting vulnerability: the syntax highlighter does not escape the lineAnchors option before passing it to Chroma, which writes the value verbatim into the id and href attributes of the generated line-number markup. A crafted...

CVE-2026-7614

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPHoptions function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2026-8875

The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' and 'c' shortcode in versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes in the...

CVE-2026-7614

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPHoptions function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2026-7614

CVE-2026-7614 affects the WordPress plugin Old Posts Highlighter up to version 1.0.3. The root cause is missing or incorrect nonce validation on the OPH_options function, enabling Cross-Site Request Forgery. This allows unauthenticated attackers to update the plugin’s configuration by deceiving a...

CVE-2026-7614

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPHoptions function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2026-7614 Old Posts Highlighter <= 1.0.3 - Cross-Site Request Forgery to Settings Update

The Old Posts Highlighter plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0.3. This is due to missing or incorrect nonce validation on the OPHoptions function. This makes it possible for unauthenticated attackers to update the plugin's...

CVE-2026-8875

The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' and 'c' shortcode in versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes in the...

CVE-2026-8875

Affected software : WordPress plugin Easy Prism Syntax Highlighter (versions ≤ 1.0.2). Vulnerability : Stored Cross-Site Scripting via the plugin’s 'code' and 'c' shortcode attributes due to insufficient input sanitization and output escaping in shortcode(), which concatenates the first positiona...

CVE-2026-8875 Easy Prism Syntax Highlighter <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' and 'c' shortcode in versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes in the...

EUVD-2026-32083

The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' and 'c' shortcode in versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes in the...

CVE-2026-8875: Improper Neutralization of Input During Web Page Generation

The Easy Prism Syntax Highlighter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'code' and 'c' shortcode in versions up to, and including, 1.0.2. This is due to insufficient input sanitization and output escaping on user supplied shortcode attributes in the...

WordPress plugin Easy Prism Syntax Highlighter 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...