1122224 matches found
CVE-2026-15100
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
CVE-2025-9205
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...
SUSE CVE-2026-9029
A user with Editor permissions can place a malicious script in the attribution field of a Geomap panel's XYZ tile layer via a template variable. The script then executes in the browser of any user who views the affected dashboard stored cross-site scripting...
CVE-2025-9205
CVE-2025-9205 affects MapSVG Lite for WordPress up to version 8.14.0. The issue is a stored XSS vulnerability caused by insufficient input sanitization and output escaping on user-supplied map options attributes. It can be exploited by authenticated attackers with contributor-level access and abo...
EUVD-2025-210507
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...
CVE-2025-9205 MapSVG Lite <= 8.14.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...
EUVD-2026-48462
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...
EUVD-2026-48461
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
CVE-2026-15100 Post Grid Gutenberg Blocks <= 5.0.32 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'searchnoresult' Block Attribute
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
CVE-2026-6454
CVE-2026-6454 affects the WordPress Firelight Lightbox plugin (versions up to 2.3.20). The root cause is improper sanitization of the href value in the FancyBox V2 PDF beforeLoad callback (inc/fancybox-2.php), where this.href is directly concatenated into HTML without escaping, allowing a stored ...
CVE-2026-15100
CVE-2026-15100 details (concrete): The vulnerability affects the WordPress Post Grid Gutenberg Blocks feature within the PostX plugin, up to version 5.0.32. The root flaw is insufficient input sanitization and output escaping for the block attribute named 'searchnoresult'. This enables authentica...
CVE-2026-15100
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...
CVE-2026-6454 Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' Attribute
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, wher...
EUVD-2024-55700
Cal.com calcom/cal.diy versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view e.g., https://app.cal.com/booking/ renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can...
EUVD-2024-55698
Cal.com repository calcom/cal.diy in versions . Booking question form field labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript th...
PT-2026-64302
Name of the Vulnerable Software and Affected Versions Loytec LWEB-802 versions prior to 5.0.8 Description Reflected Cross-Site Scripting occurs when an unauthenticated remote attacker executes arbitrary JavaScript in a victim's browser. This allows the attacker to perform actions using the victim...
PT-2026-64410
Name of the Vulnerable Software and Affected Versions Milkdown versions prior to 7.21.3 Description A DOM cross-site scripting issue exists in the @milkdown/plugin-emoji package. Unauthenticated attackers can execute arbitrary JavaScript in the host application origin by tricking a victim into...
PT-2026-64287
DOMPurify before 3.4.12 fails to execute afterSanitizeElements hook for custom elements allowed via CUSTOM ELEMENT HANDLING.tagNameCheck, allowing attributes to bypass application security policies. Attackers can preserve sensitive attributes on custom elements that later re-inject them into...
PT-2026-64258
Name of the Vulnerable Software and Affected Versions SureDash versions prior to 1.11.0 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping within shortcode attributes. Authenticated attackers with contributor-level access or higher can inject...
PT-2026-64223
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, wit...