CVE-2025-7963 Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2025-210826

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcodeeasywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-69858

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute i...

CVE-2026-3851

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-3851 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

EUVD-2026-69830

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

CVE-2026-3851 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter etbuildersanitizedynamiccontentfields only searche...

EUVD-2026-69792

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

PT-2026-84644

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode easywaveformplayer function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

The vulnerability of the setUploadUserData() function in TOTOLINK A7000R router microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the setUploadUserData function in the /cgi-bin/cstecgi.cgi file of the TOTOLINK A7000R router’s microprogramming system exists due to the lack of measures to neutralize special elements. Exploiting this vulnerability can allow a remote attacker to execute arbitrary code...

PT-2026-84666

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...

PT-2026-84887

This AI Chatbot module enables you to have a Chatbot using assistants to help you with your Drupal website. The module doesn't sufficiently sanitize for cross site scripting XSS when using the structured results using legacy agent setups. This vulnerability is mitigated by the fact that an attack...

PT-2026-84895

This module enables you to add dynamic caption support to PhotoSwipe image galleries. The module doesn't sufficiently sanitize user-supplied input such as image alt tags in its dynamic caption script, leading to a Cross-Site Scripting XSS vulnerability. This vulnerability is mitigated by the fact...

PT-2026-84717

The Yoast SEO Premium WordPress plugin before 27.6.1 does not sanitize control characters from redirect origins before writing them to the site's Apache configuration file when the file-based redirect mode is enabled, and the redirect-creation endpoint is reachable by users with only Author-level...

PT-2026-84596

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the Dynamic Content feature's legacy JSON format in all versions up to, and including, 4.27.6. This is due to two compounding flaws: 1 the save-time sanitization filter et builder sanitize dynamic content fields only...

PT-2026-84723

The Ajaxify Comments WordPress plugin before 3.2 is vulnerable to HTTP Header Injection due to insufficient input sanitization and output escaping on user-supplied data. This makes it possible for unauthenticated attackers to inject arbitrary HTTP headers...

CVE-2026-75528: Improper Neutralization of Input During Web Page Generation

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-84911

Name of the Vulnerable Software and Affected Versions GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor versions prior to 2.4.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with...

The vulnerability of the Vesta Control Panel server’s control panel allows a hacker to execute arbitrary commands.

The vulnerability of the Vesta Control Panel’s control panel lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands through the vsftplicense parameter when sending HTTP POST requests to the...

The vulnerability of the sub_424D20() function in D-link DIR-823X router microprogramming software allows a hacker to execute any command they desire.

The vulnerability of the sub424D20 function /goform/setipv6 of the D-link DIR-823X router’s microprogramming software exists due to the lack of measures taken to neutralize the special elements used in the operating system command. Exploiting this vulnerability allows a remote attacker to execute...