1162967 matches found
CVE-2026-16570
The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...
CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter
The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...
CVE-2026-19055
The ProSolution WP Client WordPress plugin, in versions prior to 2.0.11 , is vulnerable to reflected Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape several parameters before they are reflected into HTML attributes on the plugin's public pages. This vuln...
EUVD-2026-62272
The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...
CVE-2026-66358
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...
Multiple vulnerabilities in acmailer
Overview acmailer provided by Extra Innovation Inc. contains multiple vulnerabilities listed below: Cross-site Scripting CWE-79 - CVE-2026-66358 Incorrect Authorization CWE-863 - CVE-2026-70408 CVE-2026-66358 Yuji Tounai of Mitsui Bussan Secure Directions, Inc. and Fumiya Funakoshi reported this...
CVE-2026-66358
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...
CVE-2026-66358
acmailer has a cross-site scripting (XSS) vulnerability allowing an unauthenticated remote attacker to inject arbitrary script. CVSS 3.0 scores it MEDIUM (6.1) with user interaction required. No in-the-wild exploitation or specific affected versions are reported; monitor vendor advisories for pat...
EUVD-2026-62237
A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...
CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...
EUVD-2026-62212
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...
EUVD-2026-62208
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...
PT-2026-78329
Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...
PT-2026-78268
Name of the Vulnerable Software and Affected Versions acmailer affected versions not specified Description A cross-site scripting XSS issue exists, which may allow an attacker to execute an arbitrary script. Cross-site scripting is a type of security flaw where malicious scripts are injected into...
PT-2026-78757
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can trick an authenticated user int...
PT-2026-78375
Name of the Vulnerable Software and Affected Versions Dell OpenManage Enterprise versions prior to 4.7.0 Description An Improper Neutralization of Input During Web Page Generation, known as Cross-site Scripting XSS, allows a low privileged attacker with remote access to potentially cause...
CVE-2026-54793: Improper Neutralization of Input During Web Page Generation
Dell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Information exposure...
PT-2026-78759
Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description An unauthenticated user can trick an authenticated user int...