CVE-2026-96650

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-56795

CVE-2025-56795 Description Two stored Cross-Site Scripting XSS vulnerabilities were identified in the recipe creation functionality of Mealie , affecting all versions up to and including 3.0.1. Unsanitized user input provided during recipe creation is stored and later rendered in the frontend...

CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.8 . The root cause is insufficient input sanitization and output escaping related to a predictable {rstr_keep} placeho...

CVE-2025-12828

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.2 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the Type Out widget . This allows authen...

CVE-2026-96650 Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-96650

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.11 . The root cause is insufficient input sanitization and output escaping of the 'platform_user_photo' Custom Field. An unauthenticated attacker can inject arbi...

EUVD-2026-91904

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

CVE-2020-35262

CVE-2020-35262: Digisol DG-HR3400 라우터의 저장형 XSS 취약점 설명 취약한 엔드포인트에는 서버 측 입력 검증이 없으며 악성 스크립트 주입에 대한 클라이언트 측 필터링도 없는 것으로 확인되었습니다. 공격자는 이 취약점을 이용해 엔드포인트에 악성 스크립트를 주입할 수 있으며, 사용자가 해당 취약한 엔드포인트를 열 때마다 스크립트가 실행됩니다. 공격자는 이 취약점을 악용하여 악의적인 작업을 수행함으로써 장치를 장악하고, 최종적으로 네트워크 전체를 장악할 수 있습니다. 연구자: Sayli Ambure...

CVE-2026-92727

The EmbedPress plugin for WordPress (versions up to and including 4.6.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'slidesShow' Block Attribute . Specifically, the attribute is interpolated into an unquot...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.3.5 . The root cause is insufficient input sanitization and output escaping, specifically where a page-wide regex strips closing quo...

CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100180

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-55182-Exploit

React2Shell CVE-2025-55182 - 취약한 Docker 실습 환경 취약점이 의도적으로 포함된 Next.js 애플리케이션으로, 안전하지 않은 Child Process 처리를 통해 원격 코드 실행RCE을 보여줍니다. 이 실습 환경은 교육 목적 및 보안 테스트를 위해 설계되었습니다. ⚠️ 경고: 이 애플리케이션을 공개 서버에서 실행하지 마세요. 원격 코드 실행RCE 취약점이 포함되어 있습니다. 시나리오 이 애플리케이션은 간단한 "서버 상태 모니터"입니다. 백엔드는 사용자가 제공한 호스트네임을 받아 ping 명령어를...

bigdecimal-segfault-fix

h1. BigDecimal Segfault Fix ruby의 BigDecimal 라이브러리에 세그폴트segfault 버그가 있으며, 사용자가 알려진 잘못된 값을 입력하면 트리거될 수 있습니다. 애플리케이션이 안전한지 테스트하려면 +example.rb+를 실행하세요. 이 스크립트는 정상적으로 종료되어야 하며 세그폴트가 발생하지 않아야 합니다. 이 해결책에는 부작용이 있습니다. 특히 BigDecimal을 사용하여 큰 숫자255자리 이상를 처리하거나 과학적 표기법예: 5000000을 "5E6"으로 숫자를 제공하는 것을 방지합니다...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-91877

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-33267-PoC

CVE-2026-33267 — Apache Traffic Server의 신뢰할 수 없는 @ 헤더 → 내부 메타데이터 스푸핑 CVSS 10.0 치명적 · CWE-20 · GHSA-jrh6-9hgv-mqm7 요약 Apache Traffic Server는 @ 접두사가 붙은 헤더@Ats-Internal, @ICAP-Status, @TCPInfo, ...를 내부 메타데이터 로 예약한다. 이 헤더는 메모리 내 헤더 구조에 존재하지만 네트워크로 직렬화되지 않는다. 취약한 버전9.2.0–9.2.14, 10.1.0–10.1.3에서는 클라이언트...