EUVD-2026-91967

The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

boa-cve-2009-4496-analysis

CVE-2009-4496 — 방어적 취약점 분석 개요 이 저장소는 Boa 웹 서버와 관련된 역사적 취약점인 CVE-2009-4496 에 대한 방어적 분석을 문서화합니다. 이 프로젝트의 목표는 다음을 통해 방어적 보안 관점에서 취약점을 검토하는 것입니다: 공개적으로 이용 가능한 정보의 수동적 관찰 취약점 문서 검토 과거 소스 코드의 로컬 검토 취약한 코드와 수정된 코드의 비교 취약점의 기술적 원인 평가 수정 조치 분석 사용 가능한 증거의 한계 평가 제3자 시스템에 대한 능동적 테스트, 악용, 인증 시도, 스캐닝 또는 수정은 수행...

CVE-2026-96650

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2025-56795

CVE-2025-56795 설명 Mealie의 레시피 생성 기능에서 두 개의 저장형 교차 사이트 스크립팅XSS 취약점이 발견되었습니다. 이는 버전 3.0.1 까지의 모든 버전에 영향을 미칩니다. 레시피 생성 시 제공된 무결성 검사가 되지 않은 사용자 입력이 저장되고, 이후 프론트엔드에서 적절한 이스케이프 없이 렌더링되어 지속형 XSS가 발생합니다. 영향을 받는 필드 새 레시피를 생성할 때 다음 필드가 취약합니다: 1. 재료 메모 note 매개변수: 이 필드에 입력된 값은 저장된 후 레시피 상세 보기에서 렌더링되어, 주입된...

CVE-2026-96575

The Transliterator – Multilingual and Multi-script Text Conversion plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.5.8 . The root cause is insufficient input sanitization and output escaping related to a predictable {rstr_keep} placeho...

CVE-2025-12828

The Ultra Addons Lite for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.2 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes within the Type Out widget . This allows authen...

CVE-2026-96650 Strong Testimonials <= 3.3.11 - Unauthenticated Stored Cross-Site Scripting via 'platform_user_photo' Custom Field

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-101928

The Magic Tooltips For Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.34 . The root cause is insufficient input sanitization and output escaping in the 'author' parameter. Specifically, the plugin's esc_html filter ca...

EUVD-2026-91904

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'platformuserphoto' Custom Field in all versions up to, and including, 3.3.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-96650

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.3.11 . The root cause is insufficient input sanitization and output escaping of the 'platform_user_photo' Custom Field. An unauthenticated attacker can inject arbi...

CVE-2020-35262

CVE-2020-35262: Хранимый межсайтовый скриптинг XSS в роутере Digisol DG-HR3400 Описание уязвимости Было обнаружено, что уязвимая конечная точка не имеет проверки входных данных на стороне сервера и не фильтрует на стороне клиента внедрение вредоносных скриптов. Злоумышленник может использовать эт...

CVE-2026-92727

The EmbedPress plugin for WordPress (versions up to and including 4.6.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'slidesShow' Block Attribute . Specifically, the attribute is interpolated into an unquot...

CVE-2026-92727 EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slidesShow' Block Attribute

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slidesShow' Block Attribute in all versions up to, and including, 4.6.6 due to insufficient input sanitization and...

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 5.3.5 . The root cause is insufficient input sanitization and output escaping, specifically where a page-wide regex strips closing quo...

CVE-2026-92977 Real Cookie Banner: GDPR & ePrivacy Cookie Consent <= 5.3.5 - Unauthenticated Stored Cross-Site Scripting via Comment

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100180

The Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 3.2.19 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2025-55182-Exploit

React2Shell CVE-2025-55182 - Уязвимая лаборатория Docker Преднамеренно уязвимое Next.js-приложение, демонстрирующее удалённое выполнение кода RCE через небезопасную обработку дочерних процессов. Эта лаборатория предназначена для образовательных целей и тестирования безопасности. ⚠️ ПРЕДУПРЕЖДЕНИЕ:...

bigdecimal-segfault-fix

h1. Исправление segfault в BigDecimal В библиотеке BigDecimal Ruby существует ошибка segfault, которая может быть вызвана пользователем при передаче заведомо некорректных значений. Если вы хотите проверить, защищено ли ваше приложение, запустите +example.rb+. Этот скрипт должен завершиться...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...