49434 matches found
CVE-2026-97347
The Post Views Stats Counter plugin for WordPress (versions up to and including 1.1.7 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the User-Agent header . Attackers can bypass the plugin's limited b...
EUVD-2026-89682
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-97347 Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-97347 Post Views Stats Counter <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
The Post Views Stats Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User-Agent Header in all versions up to, and including, 1.1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
WordPress Frontend Post Submission Manager Lite – Guest Post and Frontend Submission Forms plugin <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin Frontend Post Submission Manager Lite versions = 1.3.4...
WordPress Post Views Stats Counter plugin <= 1.1.7 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Nawaf Althurwi JailBr3ak in WordPress Plugin Post Views Stats Counter versions = 1.1.7...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin versions before 8.8.0 (specifically versions 8.6.0 - 8.7.7 ) is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field (specifically 'eio_page_settings' ). When the post is ...
EUVD-2026-89618
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
CVE-2026-91051 EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
Malicious code in exiouss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805 main.js in [email protected] imports childprocess and issues POST requests to hardcoded endpoints, including https://gemini.google.com and...
MAL-2026-17327 Malicious code in exiouss (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43ce408818d0222061c3b6ed499d77a245aae78e30e4f57c8e6e77ee52705805 main.js in [email protected] imports childprocess and issues POST requests to hardcoded endpoints, including https://gemini.google.com and...
CVE-2026-96649
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...
CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...
CVE-2026-96649 Frontend Post Submission Manager Lite <= 1.3.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via post_content Parameter (data-label DOM Sink)
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...
EUVD-2026-89577
The Frontend Post Submission Manager Lite – Frontend Posting WordPress Plugin plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via postcontent Parameter data-label DOM Sink in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output...
CVE-2026-96649
The Frontend Post Submission Manager Lite WordPress plugin is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 1.3.4 . The flaw stems from insufficient input sanitization and output escaping of the post_content parameter, specifically utilizing a data-labe...
CVE-2026-103057
AiSOC versions 5.1.0 before 12.0.0 contain an authentication bypass vulnerability in the realtime service internal endpoints POST /internal/agent-event and POST /internal/push. Attackers can post arbitrary events with spoofed tenant identifiers to broadcast malicious content over WebSocket and...