1371 matches found
PT-2026-89394
Renovate is an automated dependency update tool. In versions before 44.14.4 and Mend Renovate CE/EE images before 15.4.0 and the mend-renovate-enterprise-edition Helm chart before 10.4.0, log sanitisation for TLS private keys used for Mutual TLS was incomplete. While the value of...
CVE-2025-15690
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
EUVD-2025-210873
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
PT-2026-88854
The Content Mask WordPress plugin before 1.8.5.6 does not properly sanitise and escape content submitted with a post before outputting it in the pages it generates, allowing users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against any user viewing or previewi...
Debian dsa-6488 : jbig2dec - security update
The remote Debian 13 host has packages installed that are affected by a vulnerability as referenced in the dsa-6488 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6488-1 [email protected] https://www.debian.org/security/ Moritz...
EUVD-2026-71853
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...
CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS
The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...
PT-2026-86340
Name of the Vulnerable Software and Affected Versions The Music Store WordPress plugin versions prior to 1.4.5 Description Unauthenticated users can perform a SQL injection because the plugin fails to sanitize and escape user-supplied parameters before incorporating them into a SQL statement. Thi...
PT-2026-86341
šØ CVE-2026-82846 The Masteriyo LMS WordPress plugin before 3.4.0 does not sanitise and escape some course settings before outputting them in a page available to all visitors, allowing users with a course-author role to perform Stored Cross-Site Scripting attacks that run in the session of anyone...
EUVD-2026-70045
The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...
PT-2026-84625
The CatalogX WordPress plugin before 6.1.3 does not sanitise or escape content that an unauthenticated user can store before including it in the product enquiry notification email sent to the site administrator, allowing unauthenticated attackers to inject arbitrary content into that email, which...
PT-2026-84749
The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...
EUVD-2026-68157
The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...
CVE-2026-76585 Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter
The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks...
PT-2026-83526
The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...
CVE-2026-80488 WP Ultimate CSV Importer < 9.0 - Admin+ SQLi via AIOSEO Import Fields
The WP Ultimate CSV Importer WordPress plugin before 9.0 does not properly sanitise and escape imported field values before using them in a SQL statement, which could allow high privilege users such as admin to perform SQL injection attacks...
CVE-2026-13405
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not correctly sanitise custom widget markup before writing it to a file that is later executed, allowing users with the manageoptions capability and, on WordPress Multisite, non-super subsite administrators who do not otherwise...
CVE-2026-16950
The Product Shortlist WordPress plugin through 1.0.4 does not properly sanitise and escape a parameter before using it in a SQL statement, allowing unauthenticated attackers to perform SQL injection attacks...
EUVD-2026-57797
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...
CVE-2026-73628 Serendipity 2.3.5 Reflected XSS via search clean-URL route
Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...