xss2shell

XSS2Shell CVE-2026-64638 pre-auth reflected XSS on...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-16535

The Link Library WordPress plugin version before 7.9.4 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise and escape a parameter before reflecting it back in an HTTP response. This allows unauthenticated attackers to target users who...

CVE-2026-16535 Link Library < 7.9.4 - Reflected XSS via Thumbs-Rating likelabel

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

CVE-2026-16535

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

PT-2026-69171

Name of the Vulnerable Software and Affected Versions Link Library versions prior to 7.9.4 Description An issue exists where the software fails to sanitize and escape a parameter before reflecting it in a response. This allows unauthenticated attackers to execute Reflected Cross-Site Scripting XS...

CVE-2026-16535: Improper Neutralization of Input During Web Page Generation

The Link Library WordPress plugin before 7.9.4 does not sanitise and escape a parameter before reflecting it back in a response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who can be tricked into performing an action...

Exploit for CVE-2026-64638

🛡️ CVE-2026-64638 - XSS2Shell WordPress Pre-Authentic...

EUVD-2026-54565

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

CVE-2026-64638

WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires...

Exploit for CVE-2026-64638

XSS2Shell — WordPress Pre-Auth XSS → RCE Chain PoC CVE-2026...

EUVD-2026-54447

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...

CVE-2026-54216 TeamDavid: Reflected Cross Site Scripting (XSS) via the 'EntryInfo' parameter

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...

CVE-2026-54216

Tobit Laboratories AG TeamDavid's Webbox application contains a reflected cross-site scripting XSS vulnerability. By sending a specially crafted link including an arbitrary path, an XSS payload or the parameter “EntryInfo”, and the parameter “!templateName=entryMail”, an attacker can cause the...

OESA-2026-3240 perl-YAML security update

The YAML.pm module implements a YAML Loader and Dumper based on the YAML 1.0 specification. http://www.yaml.org/spec/ YAML is a generic data serialization language that is optimized for human readability.It can be used to express the data structures of most modern programming languages. Including...

CVE-2026-14331

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-14331

The Subscribe2 WordPress plugin, in versions before 10.46 , is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the improper escaping of a user-supplied value before it is reflected into a public subscription form. An unauthenticated visitor can execute malicious scripts in ...

PT-2026-68857

Name of the Vulnerable Software and Affected Versions Subscribe2 versions prior to 10.46 Description Insufficient escaping of user-supplied values before they are reflected into a public subscription form allows Reflected Cross-Site Scripting XSS. This occurs when an unauthenticated visitor...

PT-2026-68912

Name of the Vulnerable Software and Affected Versions TeamDavid versions prior to Rollout 525 Description The Webbox application contains a reflected cross-site scripting XSS flaw. An attacker can execute a malicious payload in a victim's browser by sending a specially crafted link. This is...