CVE-2026-89274-wp-recipe-maker-poc

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution Validation Lab Security-research material for reproducing and validating CVE-2026-89274 : WP Recipe Maker Use only on systems you own or are explicitly authorized to test. The PoC posts one rating comment containing a lab-registered...

CVE-2025-59057-PoC

A XSS vulnerability exists in in React Router's meta/ APIs in Framework Mode when generating script:ld+json tags which could allow arbitrary JavaScript execution during SSR if untrusted content is used to generate the tag...

CVE-2026-129141

Versions 1.0.0 through 1.0.3 of paicoding are vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the SeoInjectService component embeds user profile text into an inline JSON-LD script element without proper escaping. This allows an authenticated attacker to inject a clo...

CVE-2026-129141 paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for...

CVE-2026-119035 Schema & Structured Data for WP & AMP < 1.70 - Contributor+ Stored XSS via JSON-LD Pretty Print

The Schema & Structured Data for WP & AMP WordPress plugin before 1.70 does not safely encode its structured data output when the Pretty Print option is enabled, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks when the site maps a schema property to...

CVE-2026-119035

The Schema & Structured Data for WP & AMP WordPress plugin versions prior to 1.70 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the plugin's failure to safely encode structured data output when the Pretty Print option is enabled. Specifically, this occurs when a site maps...

CVE-2026-109367

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers...

CVE-2026-109367

The All in One SEO WordPress plugin (versions up to and including 5.0.3 ) is vulnerable to Sensitive Information Exposure via the 's' search query parameter . This flaw allows unauthenticated attackers to extract non-public post meta values, such as API keys and internal notes , which are emitted...

CVE-2026-109367 All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers...

CVE-2026-109367 All in One SEO <= 5.0.3 - Unauthenticated Sensitive Information Disclosure in 's' Search Query Parameter

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.0.3 via the 's' parameter. This makes it possible for unauthenticated attackers...

WordPress All in One SEO information disclosure vulnerability

WordPress All in One SEO versions 5.0.3 and earlier contain an information disclosure vulnerability. This vulnerability arises from the exposure of sensitive information via the ‘s’ parameter. Unauthenticated attackers can extract arbitrary non-public article metadata values, including API keys a...

PT-2026-134483

Name of the Vulnerable Software and Affected Versions All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights versions prior to 5.0.4 Description An issue exists that allows unauthenticated attackers to extract arbitrary non-public post meta values...

CVE-2026-116763 LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

WordPress LiteSpeed Cache cross-site scripting vulnerability

WordPress LiteSpeed Cache versions 7.9.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for the comment parameter, allowing unauthenticated attackers to inject arbitrary web scripts that are executed when...

PT-2026-130686

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-109153

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghost head helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

Cross-site Scripting (XSS)

Overview ghost is a publishing platform Affected versions of this package are vulnerable to Cross-site Scripting XSS via the JSON-LD schema output in ghosthead.js, where user-controlled field values such as site title, author website, and social URLs are serialised with JSON.stringify and injecte...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

EUVD-2026-90685

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...

CVE-2026-103292

Ghost versions from 0.5.3 through versions prior to 6.50.0 fail to sanitize the data placed in the JSON-LD HTML tag emitted by the ghosthead helper. An authenticated user with limited privileges can inject unescaped content that is rendered as script in the published page, potentially leading to...