Lucene search
+L

108316 matches found

ATTACKERKB
ATTACKERKB
added 2026/07/23 8:34 a.m.7 views

CVE-2026-15404

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpageryaddfiltertexttemplatepost function, which is hooked to adminfooter and echoes the...

6.4CVSS5.5AI score0.00243EPSS
SaveExploits0References6
CVE
CVE
added 2026/07/23 8:34 a.m.17 views

CVE-2026-15404

CVE-2026-15404 concerns the Lpagery WordPress plugin (<= 2.5.7). It enables a Stored Cross-Site Scripting (XSS) via post titles due to insufficient sanitization and output escaping in lpagery_add_filter_text_template_post(), which runs on admin_footer and echoes the raw post_title of the post ...

6.4CVSS5.6AI score0.00243EPSS
SaveExploits0References5
NVD
NVD
added 2026/07/23 8:16 a.m.9 views

CVE-2026-9635

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...

6.4CVSS0.00187EPSS
SaveExploits0References3
NVD
NVD
added 2026/07/23 7:16 a.m.16 views

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

4.8CVSS0.00142EPSS
SaveExploits0References1
NVD
NVD
added 2026/07/23 7:16 a.m.16 views

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

6.1CVSS0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:52 a.m.18 views

CVE-2026-9713

CVE-2026-9713 : The Lumise Product Designer for WooCommerce WordPress plugin (up to version 2.1.1) is vulnerable to SQL injection via the uploaded cart JSON file processed by the checkout AJAX action. The root cause is insufficient escaping of user-provided parameters in the find_resource() funct...

7.5CVSS5.8AI score0.00273EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/23 6:52 a.m.8 views

CVE-2026-9713

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

7.5CVSS5.8AI score0.00273EPSS
SaveExploits0References3
EUVD
EUVD
added 2026/07/23 6:52 a.m.8 views

EUVD-2026-47934

The Lumise Product Designer for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' and 'table' parameters in the uploaded cart JSON file processed by the checkout AJAX action in versions up to, and including, 2.1.1. This is due to insufficient escaping on the user-suppli...

7.5CVSS5.8AI score0.00273EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/07/23 6:0 a.m.7 views

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

5.7AI score0.00149EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 6:0 a.m.9 views

EUVD-2026-47887

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

4.8CVSS5.3AI score0.00142EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 6:0 a.m.40 views

CVE-2026-9577 Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter

The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...

0.00142EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/23 6:0 a.m.47 views

CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:0 a.m.19 views

CVE-2026-9066

The CVE describes a Reflected XSS in WP Compress for WordPress plugin before 7.10.04 due to lack of validation of a query parameter that controls the asset CDN host. This allows an attacker, via a crafted link, to cause the loader to inject script elements pointing to an attacker-controlled origi...

6.1CVSS5.8AI score0.00149EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/23 6:0 a.m.24 views

CVE-2026-9577

The Post Status Notifier Lite WordPress plugin (before 1.13.0) is affected. The vulnerability arises because the plugin does not properly escape the mod URL parameter before reflecting it into the admin settings page (admin.php?page=post-status-notifier-lite), enabling a Reflected Cross-Site Scri...

4.8CVSS5.3AI score0.00142EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/07/23 5:35 a.m.8 views

EUVD-2026-47878

The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

7.2CVSS5.5AI score0.00206EPSS
SaveExploits0References2
CVE
CVE
added 2026/07/23 5:35 a.m.16 views

CVE-2026-7534

The CVE-2026-7534 entry details a vulnerability in the SUMO Reward Points for WooCommerce plugin (WordPress) up to version 32.7.0. Affected component: SRP_REST_Earning_Controller handling REST endpoint /wp-json/wc-srp/v1/earning. Root cause: the user_has_cap filter unconditionally grants the rs_e...

7.2CVSS5.6AI score0.0019EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/07/23 5:35 a.m.40 views

CVE-2026-7534 SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter

The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...

7.2CVSS0.0019EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/07/23 12:0 a.m.21 views

PT-2026-63590

The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it...

6.4CVSS5.6AI score0.00307EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/07/23 12:0 a.m.22 views

PT-2026-64188

Name of the Vulnerable Software and Affected Versions Microweber CMS versions prior to 2.0.21 Description A path traversal issue exists in the static file controller. Unauthenticated remote attackers can read arbitrary files, including system files and environment configuration files containing...

8.7CVSS6AI score0.02456EPSS
SaveExploits1References4
OSV
OSV
added 2026/07/22 10:57 p.m.7 views

GHSA-W7X5-G22V-XQHR Eclipse Jetty: Path parameter traversal

Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...

5.3CVSS5.5AI score0.00228EPSS
SaveExploits1References10
Rows per page
Query Builder