1135612 matches found
CVE-2026-9729
The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'webpushrnotificationtitle' and 'webpushrnotificationbody' parameters in versions up to, and including, 4.39.0. This is due to insufficient input sanitization in the savesendnotificationflag...
CVE-2026-9635
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...
CVE-2026-12421
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
Security Bulletin: IBM App Connect Enterprise is vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html (CVE-2026-53606 & CVE-2026-42338)
Summary IBM App Connect Enterprise runtime, IBM App Connect Enterprise Discovery Connectors and IBM App Connect Enterprise Connector Discovery and OpenAPI Editor are vulnerable to Cross-site Scripting due to Node.js modules ip-address and sanitize-html. Vulnerability Details CVEID:CVE-2026-53606...
openjdk: Enhance Dataview Implementation (Oracle CPU 2026-07)
A flaw was found in OpenJDK. 1 DataView getter/setter methods use absolute ByteBuffer indexing and ignore the offset, allowing read and write to memory outside its intended window. 2 Missing bounds check in the DataView constructor fails to validate the capacity...
openjdk: Improve Nashorn index handling (Oracle CPU 2026-07)
A flaw was found in OpenJDK. There is an integer overflow in TypedArray.prototype.set which can cause a DoS...
WordPress Accept Donations with PayPal & Stripe plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Accept Donations with PayPal & Stripe versions = 1.5.5...
WordPress Photo Gallery plugin <= 2.7.7.29 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Photo Gallery versions = 2.7.7.29...
WordPress Appointment Hour Booking plugin <= 1.5.86 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Appointment Hour Booking versions = 1.5.86...
CVE-2026-9635
The CVE concerns the WP Shortcode by MyThemeShop plugin for WordPress. A stored XSS exists in the [tab] shortcode via the 'title' attribute in versions up to 1.4.17. The root cause is insufficient input sanitization and output escaping in the mts_tabs() function, which directly echoes the title a...
EUVD-2026-47935
The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the tab shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mtstabs function, which outputs the...
CVE-2026-9729
The CVE-2026-9729 entry concerns the Webpushr Push Notifications plugin for WordPress (versions up to 4.39.0). It describes a Stored Cross-Site Scripting flaw in which unsanitized input from the webpushr_notification_title and webpushr_notification_body parameters is combined into HTML attribute ...
EUVD-2026-47937
The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...
CVE-2026-12421
The ARforms WordPress plugin (affected: all versions up to and including 7.2.1) is vulnerable to Stored Cross-Site Scripting via password field values due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that ...
CVE-2026-7232
The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'parameter name' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-7534
The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via the REST API endpoint /wp-json/wc-srp/v1/earning in versions up to, and including, 32.7.0. This is due to the userhascap filter in the SRPRESTEarningController class unconditionally granti...
EUVD-2026-47887
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
CVE-2026-9066
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...
CVE-2026-9577 Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
EUVD-2026-47886
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...