Lucene search
+L

1135892 matches found

NVD
NVD
added 2026/06/24 4:17 a.m.14 views

CVE-2026-3652

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the value parameter of the arfsaveincompleteformdata AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

7.2CVSS0.0019EPSS
SaveExploits0References2
NVD
NVD
added 2026/06/24 4:17 a.m.15 views

CVE-2026-11614

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customattributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS0.00248EPSS
SaveExploits0References19
Friends Of PHP
Friends Of PHP
added 2026/06/24 2:45 a.m.13 views

CVE-2026-54720 - XSS attack through media embed

More info at https://www.silverstripe.org/download/security-releases/cve-2026-54720...

5.4CVSS5.8AI score0.00155EPSS
SaveExploits0Affected Software1
Friends Of PHP
Friends Of PHP
added 2026/06/24 2:39 a.m.8 views

CVE-2026-54717 - XSS in breadcrumbs in page list view

More info at https://www.silverstripe.org/download/security-releases/cve-2026-54717...

5.4CVSS5.8AI score0.0024EPSS
SaveExploits0Affected Software1
Cvelist
Cvelist
added 2026/06/24 2:29 a.m.46 views

CVE-2026-3652 ARForms <= 7.1.3 - Unauthenticated Stored Cross-Site Scripting via 'value' Parameter

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the value parameter of the arfsaveincompleteformdata AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

7.2CVSS0.0019EPSS
SaveExploits0References2
Cvelist
Cvelist
added 2026/06/24 2:29 a.m.41 views

CVE-2026-11614 Xpro Addons <= 1.7.2 - Authenticated (Author+) Stored Cross-Site Scripting via 'custom_attributes' Parameter of Multiple Widgets

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customattributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS0.00248EPSS
SaveExploits0References19
CVE
CVE
added 2026/06/24 2:29 a.m.40 views

CVE-2026-3652

CVE-2026-3652: The ARForms WordPress plugin is vulnerable to an Unauthenticated Stored Cross-Site Scripting (XSS) via the value parameter of the arf_save_incomplete_form_data AJAX action. Affected are all versions up to 7.1.3. The root cause is insufficient input sanitization and output escaping,...

7.2CVSS6AI score0.0019EPSS
SaveExploits0References2
ATTACKERKB
ATTACKERKB
added 2026/06/24 2:29 a.m.9 views

CVE-2026-11614

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customattributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS6AI score0.00248EPSS
SaveExploits0References20
EUVD
EUVD
added 2026/06/24 2:29 a.m.19 views

EUVD-2026-38643

The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customattributes' parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS6AI score0.00248EPSS
SaveExploits0References19
EUVD
EUVD
added 2026/06/24 2:29 a.m.15 views

EUVD-2026-38644

The ARForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the value parameter of the arfsaveincompleteformdata AJAX action in all versions up to, and including, 7.1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

7.2CVSS6AI score0.0019EPSS
SaveExploits0References2
CVE
CVE
added 2026/06/24 2:29 a.m.44 views

CVE-2026-11614

Technical details (affected versions, root cause, exploit specifics) are not publicly available in the provided documents. Monitor for updates.

6.4CVSS6AI score0.00248EPSS
SaveExploits0References19
EUVD
EUVD
added 2026/06/24 12:30 a.m.22 views

EUVD-2026-38631

Fortra File Integrity Monitoring FIM, formerly Tripwire Enterprise, versions prior to 9.4.0.1 contain a stored cross-site scripting XSS vulnerability in the Asset View UI component. An authenticated user with sufficient privileges to create or modify affected node or database configuration fields...

5.5CVSS5.7AI score0.00145EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.34 views

PT-2026-51835

Name of the Vulnerable Software and Affected Versions Frappe Framework version 17.0.0-dev Description A Stored Cross-Site Scripting XSS issue occurs due to improper neutralization of user-controlled input within the frappe.ui.Tree component. This allows malicious scripts to be stored and executed...

4.8CVSS6.1AI score0.00239EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.20 views

PT-2026-52072

Name of the Vulnerable Software and Affected Versions Ghost versions 6.19.4 through 6.21.0 Description Insufficient validation of the client-supplied Content-Type on the Admin API file upload endpoint allows uploaded files to be served with an attacker-chosen content type when using S3 or GCS...

5.4CVSS5.5AI score0.00133EPSS
SaveExploits0References5
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.13 views

PT-2026-52104

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.0 Description Stored cross-site scripting XSS exists in the Attribute View database asset cell renderer. This issue can escalate to remote code execution RCE within the Electron desktop client. XSS is a flaw that...

9.9CVSS6.6AI score0.0044EPSS
SaveExploits0
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.11 views

PT-2026-51664

Name of the Vulnerable Software and Affected Versions Email JavaScript Cloak versions prior to 1.04 Description The Email JavaScript Cloak plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs due to insufficient input sanitization and output escaping on user-supplied...

7.2CVSS6AI score0.00256EPSS
SaveExploits0References9
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.21 views

PT-2026-51700

Name of the Vulnerable Software and Affected Versions WP Meta SEO versions prior to 4.5.19 Description Unauthenticated Stored Cross-Site Scripting occurs when the wpmsTemplateRedirect hook detects a 404 error. The plugin concatenates $ SERVER'HTTP HOST' with the raw $ SERVER'REQUEST URI' and...

7.2CVSS6AI score0.00241EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.19 views

PT-2026-51833

Name of the Vulnerable Software and Affected Versions Frappe Framework version 17.0.0-dev Description A Stored Cross-Site Scripting XSS issue occurs in the Number Card component when user-controlled data is unsafely evaluated. This happens specifically within the filters config variable, where th...

4.6CVSS6.2AI score0.00256EPSS
SaveExploits0References6
Drupal
Drupal
added 2026/06/24 12:0 a.m.16 views

Advanced Content Feedback (aka admin_feedback) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-051

This module enables you to collect feedback from your site visitors on content pages, presenting Yes/No buttons and providing dashboards for administrators to review the responses. The module doesn't sufficiently sanitize several administrator-configured response messages the "Yes response", "No...

6.1CVSS5.8AI score0.00181EPSS
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/06/24 12:0 a.m.23 views

PT-2026-51826

Name of the Vulnerable Software and Affected Versions Frappe Framework version 17.0.0-dev Description A Stored Cross-Site Scripting XSS issue occurs due to improper neutralization of user-controlled input within the frappe.get avatar function during image rendering. Stored XSS is a type of...

4.6CVSS5.8AI score0.00256EPSS
SaveExploits0References6
Rows per page
Query Builder