XWiki < 14.10.14 - Cross-Site Scripting

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. When document names are validated according to a name strategy disabled by default, XWiki starting in version 12.0-rc-1 and prior to versions 12.10.12 and 15.5-rc-1 is vulnerable to a reflecte...

CVE-2026-110019 Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with...

CVE-2026-110019

The Bulk Page Generator – LPagery plugin for WordPress (versions up to and including 3.1.0 ) is vulnerable to an authorization bypass (CWE-862). The plugin fails to properly verify if a user is authorized to perform specific actions, allowing authenticated attackers with subscriber-level access o...

WordPress Bulk Page Generator – LPagery plugin <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Page Creation/Modification/Deletion vulnerability discovered by Wordfence PRISM in WordPress Plugin Bulk Landing Page Creator for WordPress LPagery versions = 3.1.0...

CVE-2022-47131

CVE-2022-47131 Academy LMS history.pushState'', '', '/'...

CVE-2025-46041

Anchor CMS v0.12.7 - Stored XSS CVE-2025-46041 Anchor CMS v0.12.7 is vulnerable to a Stored Cross-Site Scripting XSS vulnerability in the description field of the /admin/pages/add interface. CVE ID CVE-2025-46041 Summary Type: Stored XSS Location: Page creation interface /admin/pages/add Impact:...

Grav-CMS-RCE-Authenticated

Grav CMS Remote Code Execution Authenticated - CVE-2024-28116 Info This code is an adaptation fromGraver Github repository with some improvements based on this video. Exploit against Grav CMS for versions below 1.7.45 based on SSTI + RCE vulnerabilities, labeled as CVE-2024-28116. This script...

WordPress webtoffee-cookie-consent plugin < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability

Consent Log Disclosure/Deletion, Page Creation & License Deactivation vulnerability discovered by Eran Kapeluto in WordPress Plugin webtoffee-cookie-consent versions 3.5.3...

CVE-2026-14923

The Sync Post With Other Site WordPress plugin, in versions prior to 1.9.3 , contains an authorization flaw due to an operator-precedence error . This flaw allows authenticated users with limited privileges, such as a Contributor (who only holds post-editing capabilities), to bypass intended rest...

WordPress Sync Post With Other Site plugin < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification vulnerability

Contributor+ Arbitrary Page Creation/Modification vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Sync Post With Other Site versions 1.9.3...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

CVE-2026-14923 Sync Post With Other Site < 1.9.3 - Contributor+ Arbitrary Page Creation/Modification

The Sync Post With Other Site WordPress plugin before 1.9.3 does not correctly enforce the page-editing capability on a REST route that creates and updates posts, because of an operator-precedence flaw in its authorization check. An authenticated user holding only the post-editing capability such...

EUVD-2026-35545

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation 'cross-site scripting' in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network...

CVE-2026-31018

In Dolibarr ERP & CRM = 22.0.4, PHP code detection and editing permission enforcement in the Website module is not applied consistently to all input parameters, allowing an authenticated user restricted to HTML/JavaScript editing to inject PHP code through unprotected inputs during website page...

CVE-2026-4420

Bludit is vulnerable to Stored Cross-Site Scripting XSS in its page creating functionality. An authenticated attacker with page creation privileges such as Author, Editor, or Administrator can embed a malicious JavaScript payload in the tags field of a newly created article. This payload will be...

CVE-2026-6391

The Sentence To SEO keywords, description and tags plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the createadminpage function. This makes it possible for unauthenticated attackers...

CVE-2026-7508

A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...

CVE-2026-7508

A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...

EUVD-2026-26456

A vulnerability was found in Bootstrap CMS 0.9.0-alpha. Affected is an unknown function of the file resources/views/pages/show.blade.php of the component Page Creation Handler. Performing a manipulation of the argument body results in code injection. Remote exploitation of the attack is possible...