678 matches found
CVE-2026-113409
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
CVE-2026-113409
The Ortto plugin for WordPress (versions before 1.0.25 ) is vulnerable to stored cross-site scripting (XSS) . The root cause is a failure to properly escape stored settings on the plugin's admin settings page . An attacker capable of modifying the plugin's configuration can execute arbitrary Java...
CVE-2026-113409
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
EUVD-2026-112571
The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to stored cross-site scripting. A threat actor able to modify the plugin's configuration could execute arbitrary JavaScript in an administrator's session when they visited the impacted...
EUVD-2026-110499
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
CVE-2026-116554
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
CVE-2026-116554 Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
CVE-2026-116554 Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
CVE-2026-116554
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
CVE-2026-116554
A cross-site scripting (XSS) vulnerability exists in Argilla versions up to 2.8.0 . The flaw is located in the Dataset.from_disk function within the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the Settings Page component. An attacker can trigger the XSS by ma...
CVE-2026-116554 Argilla Settings SettingsInfo.vue Dataset.from_disk cross site scripting
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.fromdisk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
PT-2026-125499
A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from disk of the file argilla-frontend/components/features/annotation/settings/SettingsInfo.vue of the component Settings Page. Executing a manipulation of the argument Name can lead to cross site scripting...
CVE-2025-15703
The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...
CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...
PT-2026-110473
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...
CVE-2025-15703: Improper Neutralization of Input During Web Page Generation
The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...
CVE-2026-88905
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...
EUVD-2026-96777
The KeyWord Collector WordPress plugin through 1.4 does not have any authorisation or nonce check when saving its settings, and does not escape them before output, allowing unauthenticated attackers to store malicious JavaScript that executes when an administrator opens the KeyWord Collector...
CVE-2026-104678
The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler, allowing users with only Contributor-level access to create, modify, duplicate and delete the site-wide media player configurations and change a CP Media Player WordPress plugin...
CVE-2026-104678
The CP Media Player WordPress plugin (versions before 1.3.4 ) is vulnerable to an improper access control flaw in its settings-page handler . Due to a lack of capability checks, users with only Contributor-level access can perform actions reserved for administrators, such as creating, modifying, ...