CVE-2026-64944

Apache Answer versions through 2.0.2 are vulnerable to a stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. The root cause is that the importer saves question bodies as raw HTML, bypassing the standard Markdown-to-HTML sanitization path. Thi...

CVE-2026-64944 Apache Answer: Stored XSS via unsanitized HTML in imported question content

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Answer. This issue affects Apache Answer: through 2.0.2. The importer stores imported question bodies as raw HTML without passing them through the normal Markdown-to-HTML sanitization path, ...

CVE-2024-10000

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-10000

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-10000: Improper Neutralization of Input During Web Page Generation

The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the question's content parameter in all versions up to, and including, 1.13.3 due to insufficient input sanitization and output escaping. This makes it...

CVE-2018-19083

WeCenter 3.2.0 through 3.2.2 has XSS in the views/default/question/index.tpl.html htmlspecialcharsdecode function via the /?/publish/ajax/publishquestion/ questioncontent parameter...

PT-2018-14796

Name of the Vulnerable Software and Affected Versions WeCenter versions 3.2.0 through 3.2.2 Description The issue concerns a problem with the htmlspecialchars decode function in the views/default/question/index.tpl.html file. This is exploited via the "/?/publish/ajax/publish question/" API...