281 matches found
CVE-2026-127285
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bgforum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published an...
CVE-2026-127285
A cross-site scripting (XSS) vulnerability exists in Cairo-dock Glx-Dock 3.4.0 . The flaw is located within the href Attribute Handler of the bg_forum.php file, where the manipulation of the argument f allows for remote execution of the attack. While the exploit has been published and may be used...
EUVD-2026-124825
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bgforum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published an...
PT-2026-146343
A flaw has been found in Cairo-dock Glx-Dock 3.4.0. The affected element is an unknown function of the file bg forum.php of the component href Attribute Handler. This manipulation of the argument f causes cross site scripting. The attack may be initiated remotely. The exploit has been published a...
CVE-2022-44666
Microsoft Windows Contacts VCF/Contact/LDAP syslink control href attribute escape vulnerability CVE-2022-44666 0day. This is the story about another forgotten 0day fully disclosed more than 4 years ago by John Page aka hyp3rlinxR.1. To understand the report, you have to consider i'm stupid :- And...
CVE-2024-25293
MJML Local Code Execution PoC A Proof-Of-Concept for CVE-2024-25293 vulnerability. mjml-app v3.0.4 & 3.1.0-beta was discovered to contain a remote code execution RCE In this repository there is an example vulnerable application and proof-of-concept POC exploit of it. As a PoC there is a python fi...
CVE-2025-15711
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
CVE-2025-15711 Live Composer < 2.1.24 - Admin+ Stored XSS via Social
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
CVE-2025-15711
The Live Composer WordPress plugin (versions prior to 2.1.24 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain module settings before they are outputted within an href attribute . This flaw allows high-privilege users, such ...
EUVD-2025-211306
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
CVE-2025-15711: Unknown Live Composer: The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before…
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capabili...
PT-2026-144982
The Live Composer WordPress plugin before 2.1.24 does not sanitise and escape some of its module settings before outputting them in an href attribute, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered html...
CVE-2026-118165
The Firelight Lightbox WordPress plugin (versions before 2.3.23 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to escape URLs of links opened in the Classic lightbox before they are inserted into the page as HTML. This flaw allows users with a role as low as ...
CVE-2026-118165 Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a...
CVE-2026-118165 Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute
The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a...
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
CVE-2026-111318
The HT Mega Addons for Elementor WordPress plugin (versions <= 3.2.7 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the href attribute of tags within the .htmega-tab-nav parameter of the Tabs widget . U...
EUVD-2026-112693
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
CVE-2026-111318 HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...
WordPress HT Mega Addons for Elementor cross-site scripting vulnerability
WordPress HT Mega Addons for Elementor versions 3.2.7 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. Attackers can exploit this by injecting arbitrary web scripts via the href attribute of elements within...