45 matches found
Netbox-CVE-2023-37625
Netbox-CVE-2023-37625 Description A stored cross-site scripting XSS vulnerability in Netbox alert1' 3. Add a new model, in this example add a 'manufacturer' model. 4. Open the newly created model as any authenticated user, and observer that the alert box has executed...
EUVD-2026-78839
Concrete CMS 9 before 9.5.3 was vulnerable to stored cross-site scripting XSS in the Feature, Feature Link, Hero Image, and Image blocks and before Concrete 8.5.21 in the feature and Image blocks because the external link URL was insufficiently validated by the link filter and was rendered withou...
CVE-2026-84021
The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user clicks the...
PT-2026-86344
šØ CVE-2026-84021 The Bold Page Builder WordPress plugin before 5.9.8 does not properly validate a link URL before outputting it in an HTML attribute, relying on a filter that can be evaded, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user...
CVE-2026-66390
Apache Wicket contains an XSS vulnerability (CVE-2026-66390) due to improper neutralization of input during web page generation. Affected versions are 9.0.0ā9.23.0 and 10.0.0ā10.9.0. The issue can be mitigated by upgrading to 10.10.0, which includes the fix. The CVSS 3.1 vector indicates Network ...
CVE-2026-12560
The Editorial Rating ā Product Review & Rating System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Link URL' Field in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...
CVE-2026-12560
The Editorial Rating ā Product Review & Rating System plugin for WordPress (versions up to 4.0.5) is vulnerable to Stored Cross-Site Scripting via the Link URL field due to insufficient input sanitization and output escaping. Authenticated attackers with administrator-level access can store a pay...
PT-2026-53811
Name of the Vulnerable Software and Affected Versions Editorial Rating ā Product Review & Rating System versions prior to 4.0.6 Description Insufficient input sanitization and output escaping allow authenticated attackers with administrator-level access and above to perform Stored Cross-Site...
CVE-2026-7850
The WP Magnific Popup WordPress plugin through 1.0 does not properly escape user-controlled link URLs before injecting them into the DOM when displaying image load error messages, allowing authenticated attackers with Author-level access or above to perform Stored Cross-Site Scripting attacks...
CVE-2026-9125
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkurl' parameter of the prestoplayeroverlay shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays function, which copies...
CVE-2026-9125 The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'linkurl' parameter of the prestoplayeroverlay shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays function, which copies...
PT-2026-48818
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link url' parameter of the presto player overlay shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays function, which...
CVE-2019-25643
creationtimestamp| type| source ---|---|--- 2026-03-24 13:54:30+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mhspysaiyz2p...
CVE-2026-26985
creationtimestamp| type| source ---|---|--- 2026-02-26 01:05:41+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfpyw4brcq2d 2026-02-26 05:15:58+00:00| seen| https://bsky.app/profile/postac001.bsky.social/post/3mfqgvmufgs2h 2026-02-26 07:17:19+00:00| seen|...
CVE-2026-1985 Press3D <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block
The Press3D plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 3D Model Gutenberg block in all versions up to, and including, 1.0.2. This is due to the plugin failing to sanitize and validate the URL scheme when storing link URLs for 3D model blocks, allowing javascript:...
CVE-2026-1985
CVE-2026-1985 pertains to the WordPress Press3D plugin up to version 1.0.2, where a vulnerability in the 3D Model Gutenberg block allows Stored Cross-Site Scripting via the link URL parameter. The root cause is inadequate sanitization/validation of the URL scheme when storing model block URLs, en...
WordPress Press3D plugin <= 1.0.2 - Authenticated (Author+) Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block vulnerability
Authenticated Author+ Stored Cross-Site Scripting via Link URL Parameter in 3D Model Block vulnerability discovered by WordFence in WordPress Plugin Press3D versions = 1.0.2...
CVE-2026-22867
LaSuite Doc is a collaborative note taking, wiki and documentation platform. From 3.8.0 to 4.3.0, a Stored Cross-Site Scripting XSS vulnerability exists in the Interlinking feature. When a user creates a link to another document within the editor, the URL of that link is not validated. An attacke...
CVE-2025-59384
creationtimestamp| type| source ---|---|--- 2026-01-02 17:43:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mbhgzjvezu2o 2026-01-02 18:54:57+00:00| seen| Telegram/fKGzgPxm4HdOPbxQ-IlBp8HZpa9ZU7wv577tZMCQId7qg 2026-01-02 21:56:58+00:00| seen|...