Lucene search
+L

1135184 matches found

Cvelist
Cvelist
added yesterday31 views

CVE-2025-15677 GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

0.00163EPSS
SaveExploits0References1
CVE
CVE
added yesterday12 views

CVE-2026-16942

CVE-2026-16942 affects the WP Custom HTML Page WordPress plugin up to version 0.6.2. The vulnerability arises because HTML stored via a custom page handler is not sanitized and is not restricted to users allowed to post unfiltered HTML, enabling authors to store JavaScript that is served unescape...

5.4CVSS5.5AI score0.00152EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday28 views

CVE-2026-16942 WP Custom HTML Pages <= 0.6.2 - Author+ Stored XSS

The WP Custom HTML Page WordPress plugin through 0.6.2 does not sanitise HTML stored through one of its custom page handlers, nor restrict it to users allowed to post unfiltered HTML, allowing users with the Author role to store JavaScript that is served unescaped at a public URL and executes for...

0.00152EPSS
SaveExploits0References1
CVE
CVE
added yesterday14 views

CVE-2026-16573

The CVE-2026-16573 vulnerability affects the Bit Form WordPress plugin prior to version 3.2.0. An unauthenticated attacker can upload a crafted SVG signature image that contains JavaScript, which is not sanitized before storage and executes when viewed, enabling Stored XSS. This is tied to the pl...

7.5CVSS5.4AI score0.00185EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday27 views

CVE-2026-16573 Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

0.00185EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday5 views

EUVD-2026-53102

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

6.1CVSS5.2AI score0.0017EPSS
SaveExploits0References1
CVE
CVE
added yesterday13 views

CVE-2026-16583

CVE-2026-16583 affects the Orbit Fox by ThemeIsle WordPress plugin prior to 3.0.8. The SVG upload feature does not sanitize uploaded SVG files, enabling stored XSS: authenticated users with upload capability (Author and above by default, without unfiltered_html) can upload SVGs containing JavaScr...

6.1CVSS5.2AI score0.0017EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday27 views

CVE-2026-16583 Orbit Fox by ThemeIsle < 3.0.8 - Author+ Stored XSS via SVG Upload

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.8 does not sanitize uploaded SVG files when its SVG upload feature is enabled, allowing authenticated users with the upload capability Author and above by default, without the...

0.0017EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday3 views

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

6.1CVSS5.9AI score0.0022EPSS
SaveExploits0References9
CVE
CVE
added yesterday11 views

CVE-2026-8790

CVE-2026-8790 affects the Football Pool WordPress plugin up to version 2.13.4. The issue is a Reflected Cross-Site Scripting in the Shoutbox widget, where the raw POST value of the shouttext parameter is echoed into a textarea via printf('%s', ...) without HTML escaping when a nonce check fails, ...

6.1CVSS5.9AI score0.0022EPSS
SaveExploits0References8
CVE
CVE
added yesterday15 views

CVE-2026-16143

Vulnerability: CVE-2026-16143 affects VikRentItems Flexible Rental Management System

7.2CVSS5.7AI score0.00236EPSS
SaveExploits0References4
EUVD
EUVD
added yesterday5 views

EUVD-2026-53036

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

7.2CVSS5.7AI score0.00236EPSS
SaveExploits0References4
Cvelist
Cvelist
added yesterday28 views

CVE-2026-16143 VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

7.2CVSS0.00236EPSS
SaveExploits0References4
EUVD
EUVD
added yesterday10 views

EUVD-2026-52966

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

5.6AI score0.00217EPSS
SaveExploits0References3
EUVD
EUVD
added yesterday11 views

EUVD-2026-52965

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

6AI score0.00194EPSS
SaveExploits0References2
Jenkins Security Advisories
Jenkins Security Advisories
added yesterday7 views

Stored XSS vulnerability in qualys-cs

qualys-cs 1.8.0.5 and earlier does not escape user-controlled field values in a JavaScript context. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission. As of publication of this advisory, there is no fix. Learn why we announce...

8CVSS5.2AI score
SaveExploits0Affected Software1
Jenkins Security Advisories
Jenkins Security Advisories
added yesterday6 views

Stored XSS vulnerability in summary_report

summaryreport 1.15 and earlier does not escape the job name in a JavaScript context in build report pages. This results in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Create or Item/Configure permission. As of publication of this advisory, there is no fix...

8CVSS5.2AI score
SaveExploits0Affected Software1
NVD
NVD
added 2 days ago6 views

CVE-2026-52370

A reflected cross-site scripting XSS vulnerability in the Forum posting function of O2OA v10 allows attackers to execute arbitrary Javascript in the context of the victim's browser via a crafted URL...

6.1CVSS0.00217EPSS
SaveExploits0References2
NVD
NVD
added 2 days ago6 views

CVE-2026-51144

Cross Site Scripting vulnerability in Soliton Systems MailZen Management Protal v.2.62, v.2.63 allows a remote attacker to execute arbitrary code via the Role Name, First Name, Last Name, and Username fields...

6.1CVSS0.00194EPSS
SaveExploits0References1
RedhatCVE
RedhatCVE
added 2 days ago3 views

CVE-2026-15920

A flaw was found in Django. The django.contrib.admin.utils.displayforfield function renders URLField values as clickable links in the administrative interface without proper validation. If an application persists URLField data containing an unsafe scheme without running model validation, a remote...

6.1CVSS5.6AI score0.00304EPSS
SaveExploits0References10
Rows per page
Query Builder