22518 matches found
GHSA-7XV3-GF2G-498H Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
Failure mode sep was inserted verbatim into the HTML that joins a table cell's values. This made it possible to inject HTML through the separator value. The same unsanitised table HTML is produced both for the standard Special:Ask render and for its raw request output requesttype=raw, so the...
CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
CVE-2026-77608
Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected cross-site scripting (XSS) vulnerability in the Special:SearchByProperty page. Prior to version 7.2.0 , the value parameter was reflected into rendered output and error messaging paths without sufficient ou...
EUVD-2026-83173
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...
GHSA-59XW-QV23-J3RC Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...
CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...
EUVD-2026-83171
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...
CVE-2026-77606
Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected XSS vulnerability in Special:Ask when the headers=plain option is used. Table header text was emitted into elements via a raw HTML path , allowing user-controlled mainlabel content to become executable HTM...
CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...
CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...
GHSA-3JP5-3H47-28QF Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
Failure mode When headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Remediation - TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is...
WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.22 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.22...
WordPress Dictionary plugin <= 1.0 - Reflected XSS vulnerability
Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Dictionary versions = 1.0...
WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.5.1 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin ShopLentor versions = 3.5.1...
WordPress EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin <= 4.6.5 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin EmbedPress versions = 4.6.5...
WordPress Newsletter – Send awesome emails from WordPress plugin <= 9.3.8 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Newsletter versions = 9.3.8...
WordPress Booking Calendar plugin <= 11.8.2 - Reflected Cross-Site Scripting vulnerability
Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Booking Calendar versions = 11.8.2...