EUVD-2026-76874

The Booking for Appointments and Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple Elementor widgets in versions up to and including 2.4.9. This is due to insufficient input sanitization and output escaping on the 'loadmanually' parameter in the render...

CVE-2025-28074

CVE-2025-28074 Suggested description phpList prior to 3.6.3 is vulnerable to Cross-Site Scripting XSS due to improper input sanitization in lt.php. The vulnerability is exploitable when the application dynamically references internal paths and processes untrusted input without escaping, allowing ...

CVE-2021-37787

CVE-2021-37787: Inyección SQL en ABOCMS a través del módulo TinyMCE Detalles de la vulnerabilidad ID de CVE : CVE-2021-37787 Producto : ABOCMS Versiones afectadas : 5.8.x, ≤5.9.3 Tipo de vulnerabilidad : Inyección SQL Puntuación CVSS : 9.8 Descripción Existe una vulnerabilidad crítica de inyecció...

CVE-2026-80491

The SAMO Forms WordPress plugin through 1.0.0 fails to properly sanitise and escape user input before using it in SQL queries across several unauthenticated actions, enabling SQL injection attacks. The CVSS 3.1 score is 8.6 (HIGH) with a changed scope and high confidentiality impact, but no integ...

CVE-2024-55270

学生管理系统 1.0 CVE-2024-55270 概述 学生管理系统（SMS）是一款基于 PHP 和 MySQL 开发的 Web 应用程序，用于管理学生信息。本仓库包含该系统的源代码和详细信息，同时附有安全漏洞报告。 审计员： Shoaib Alam - LinkedIn 个人资料 安全漏洞报告 描述 在学生管理系统中检测到了一个盲 SQL 注入 漏洞。该问题影响应用程序搜索功能中的 searchdata 参数。 易受攻击的端点： /studentms/admin/search.php 易受攻击的参数： searchdata 由于输入清理不充分，searchdata 参数容易受到盲 S...

CVE-2026-89243

WWBN AVideo (through commit c3edcc27) contains a stored cross-site scripting vulnerability in UserGroups::setGroup_name(), which fails to sanitize the group_name input. An administrator holding the canAdminUserGroups permission can inject malicious HTML or JavaScript that executes in the browser ...

CVE-2026-17037 Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘comment’ parameter in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-6640 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-76009

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlalinkattributes' parameter in all versions up to, and including, 3.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-6641 Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter

The Media Library Assistant plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mlagallery' shortcode in versions up to and including 3.35. This is due to insufficient input sanitization and output escaping on the mlalinkhref parameter when mlaoutput is set to...

https-nj.gov---CVE-2019-8331

https-nj.gov---CVE-2019-8331 Informe de vulnerabilidad del sitio oficial de Nueva Jersey Bootstrap 4.0.0 Encontrado en https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js Información de vulnerabilidad: Medium 28236 XSS en las propiedades data-template, data-content y data-title de...

CVE-2026-81825

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...

CVE-2026-78172

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2018-7600-Drupalgeddon2-RCE

CVE-2018-7600 Drupalgeddon2 — Proyecto Red Team Departamento de Ciberseguridad de ITSOLERA | Pasantía de Seguridad Ofensiva 2026 Resumen Este proyecto investiga, replica y documenta CVE-2018-7600 Drupalgeddon2 — una vulnerabilidad crítica CVSS 9.8 de Ejecución Remota de Código no autenticada en...

EUVD-2026-75940

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-18562

HUSKY – Products Filter Professional for WooCommerce (WordPress plugin) versions up to and including 1.4.3 are affected by a Reflected Cross-Site Scripting vulnerability. The root cause is insufficient output escaping in the wp_load_js() function of the url_request extension: filter values read f...

CVE-2026-84960 WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting

The WP-Members Membership Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL Query String in all versions up to, and including, 3.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitra...

CVE-2026-81754

The Vigilant WordPress security plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the User-Agent header in all versions up to and including 2.10.2 . The root cause is insufficient input sanitization and output escaping during failed login attempts. An unauthenticated v...

CVE-2026-81754 Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting

The Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner… plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-81825 Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting

The Simple Ajax Chat – Add a Fast, Secure Chat Box plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Chat Message in all versions up to, and including, = 20260811 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers t...