209624 matches found
CVE-2025-7963
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
EUVD-2026-69889
The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
CVE-2025-7963
The Easy Waveform Player WordPress plugin (versions ≤ 1.2.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) in the shortcode_easywaveformplayer() function due to insufficient input sanitization and output escaping. Authenticated users with Contributor-level access or above can inject arbitra...
EUVD-2025-210826
The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...
net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
A flaw was found in the net/mail package of the Go programming language. An attacker could provide specially crafted inputs to the ParseAddress, ParseAddressList, or ParseDate functions. This could lead to excessive consumption of CPU and memory resources, resulting in a Denial of Service DoS for...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
SUSE-SU-2026:3921-1 Security update for libgcrypt
This update for libgcrypt fixes the following issue: - CVE-2026-41989: crafted ECDH ciphertext can lead denial of service bsc1262684...
CVE-2026-82883
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
CVE-2026-82883
CVE-2026-82883 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Login With Ajax by Marcus , affecting versions from n/a through 4.5.1 . The root cause is improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts th...
CVE-2026-82883 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...
CVE-2026-82883 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...
EUVD-2026-69887
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...
html/template: golang: Go html/template: Cross-Site Scripting via pathological input
A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...
FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow
A flaw was found in FreeRDP, an open-source implementation of the Remote Desktop Protocol RDP. This vulnerability, an integer overflow in the audio input redirection channel, allows a remote attacker to supply a malicious FramesPerPacket value. This can lead to a heap-based buffer overflow,...
CVE-2026-81737
The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...
CVE-2026-19704
The Comments WordPress plugin before 7.6.66 does not validate a value used to build a database query, allowing unauthenticated users to inject SQL and read comments they are not entitled to see, including comments awaiting moderation, comments marked as spam or trashed, and comments on private an...
CVE-2026-12865
The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages one on the Shortcode page, one on the Galleries/Albums list page, so an unauthenticated attacker can craft a link that, when opene...