WordPress plugin Omnichannel for WooCommerce has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows users to create personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed t...

WordPress plugin WP Test Email has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

WordPress plugin B Slider has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress plugin JNews – Cross-site scripting vulnerability in videos

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

WordPress plugin Hide My WP has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4120

Name of the Vulnerable Software and Affected Versions QantumThemes KenthaRadio versions through 2.2.0 Description A flaw exists in QantumThemes KenthaRadio that allows for Reflected Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page generation. The...

WordPress Plugin ListingPro Reviews: Cross-Site Script Vulnerabilities

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4081

Name of the Vulnerable Software and Affected Versions Craft versions prior to 2.3.7 Description A flaw exists in Craft that allows for DOM-Based Cross-site Scripting XSS. This issue occurs due to improper neutralization of input during web page generation. The vulnerability could potentially allo...

WordPress plugin KenthaRadio has a cross-site scripting vulnerability

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...

PT-2026-4020

Name of the Vulnerable Software and Affected Versions Crocoblock JetEngine versions through 3.7.7 Description A flaw exists in Crocoblock JetEngine that allows for Reflected Cross-site Scripting XSS. This issue is due to improper neutralization of input during web page generation. The vulnerabili...

PT-2026-4013

Name of the Vulnerable Software and Affected Versions TheNa versions through 1.5.5 Description The software contains a flaw due to improper handling of user-supplied data when creating web pages, leading to a Reflected Cross-site Scripting XSS condition. This allows an attacker to inject maliciou...

Exploit for Improper Input Validation in N8N

No d...

Improper Input Validation

Overview websocket-server is an A simple fully working websocket-server in Python with no external dependencies Affected versions of this package are vulnerable to Improper Input Validation via the WebSocketServer.messagereceived component. An attacker can access sensitive information or trigger...

Exploit for Improper Input Validation in Cacti

CVE-2...

CVE-2026-23886 Swift W3C TraceContext has malformed HTTP header that can cause a crash

Swift W3C TraceContext is a Swift implementation of the W3C Trace Context standard, and Swift OTel is an OpenTelemetry Protocol OTLP backend for Swift Log, Swift Metrics, and Swift Distributed Tracing. Prior to Swift W3C TraceContext version 1.0.0-beta.5 and Swift OTel version 1.0.4, a...

EEF-CVE-2026-21618 Cross-site scripting (XSS) in OAuth Device Authorization screen

Summary Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in hexpm hexpm/hexpm 'Elixir.HexpmWeb.SharedAuthorizationView' modules allows Cross-Site Scripting XSS. This vulnerability is associated with program files...

Hexpm security vulnerability

Hexpm is a web page and interface developed by Hex. Hexpm has a security vulnerability, which stems from improper input handling and may lead to cross-site scripting attacks...

Dell PowerProtect Data Domain OS Command Injection Vulnerability (CNVD-2026-18590)

Dell PowerProtect Data Domain Dell PowerProtect DD is a suite of hardware appliances for data protection, backup, storage, and deduplication from Dell, USA. The Dell PowerProtect Data Domain suffers from an operating system command injection vulnerability that originates from improper...

CVE-2026-22917

Improper input handling in a system endpoint may allow attackers to overload resources, causing a denial of service...

BIT-GITLAB-2025-11224 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.10 before 18.3.6, 18.4 before 18.4.4, and 18.5 before 18.5.2 that could have allowed an authenticated user to execute stored cross-site scripting through improper input validation in the Kubernetes proxy functionality...