CVE-2026-90981

The Newsletter – Send awesome emails from WordPress plugin (versions up to and including 9.3.8 ) is vulnerable to Reflected Cross-Site Scripting via the nn parameter, caused by insufficient input sanitization and output escaping in the dienow() function. An unauthenticated attacker can inject arb...

CVE-2026-90981 Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-82751

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-92554 ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92554

ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin for WordPress is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.5.1 . The flaw resides in the WL: Product Horizontal Filter widget , which reflects attacker-supplied query...

EUVD-2026-82747

The ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query-String Parameter Name in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-89330

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

CVE-2026-89330 EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

EUVD-2026-82733

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

CVE-2026-89330

The EmbedPress WordPress plugin (PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos) is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the 'unique' parameter , impacting all versions up to and including 4.6.5 . The root cause is insufficient input sanitization and ...

CVE-2026-92561 Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-92561

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'options' parameter in all versions up to and including 11.8.2 . The root cause is insufficient input sanitization and output escaping in the timeline v2 component (wpbc-class-timeline_v2.php)....

EUVD-2026-82734

The Booking Calendar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'options' parameter in all versions up to, and including, 11.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

MAL-012

MAL-012: Reflected Cross-Site Scripting in Admin Console leading to Remote Code Execution in Payara Server A reflected Cross Site Scripting XSS attack was found in the Payara Admin Console. By convincing an admin user to access the malicious URL and click the “Choose File” button, an attacker can...

CVE-2023-33732

CVE-2023-33732 — Reflected Cross-Site Scripting in eScan Management Console -orange Overview CVE-2023-33732 is a Reflected Cross-Site Scripting XSS vulnerability discovered in the Microworld Technologies eScan Management Console , version 14.0.1400.2281. The flaw exists in the New Policy assignme...

VulnScan

VulnScan Scanner di vulnerabilita' web. Fa il crawling di un sito, trova form e parametri, e li prova contro SQL injection, XSS riflesso, path traversal e header di sicurezza mancanti. Produce un report a terminale, un PDF e ha una dashboard Flask. Progetto di apprendimento. L'ho scritto per capi...

CVE-2023-34835

CVE-2023-34835 — eScan Management Console: Reflected Cross-Site Scripting XSS Table of Contents Overview Vulnerability Details Affected Product Technical Analysis Proof of Concept Steps to Reproduce Impact Mitigation & Remediation References Disclaimer Overview A Reflected Cross-Site Scripting XS...

CVE-2023-33731

CVE-2023-33731 — eScan Management Console: Reflected Cross-Site Scripting XSS -orange Table of Contents Overview Vulnerability Details Severity & CVSS Score Affected Product Technical Analysis Proof of Concept Impact Mitigation & Remediation Disclosure Timeline...

CVE-2025-30374

CVE-2025-30374 Class Pollution Vulnerability in Taipy Leading to RCE, XSS, DoS, and Credential Leakage Summary A class pollution vulnerability has been identified in Taipy v4.0.3 the latest version at the time of discovery. This vulnerability allows unauthorized attackers to overwrite the Taipy...