1122277 matches found
PYSEC-2026-3497 plone.app.textfield: Stored XSS by spoofing mime type
Impact A stored XSS affecting RichText fields. RichTextValue.output returns the raw, unsanitized stored value whenever the stored mimeType equals the outputMimeType. Because the safe-HTML output type text/x-html-safe is the type that signifies "already sanitized", any value whose stored mimeType...
PYSEC-2026-3503 PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools Summary praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can inject JavaScript into...
EUVD-2026-48142
Shop Manager Cross Site Scripting XSS in Tabs = 2.5 versions...
CVE-2026-65550
Technical details for CVE-2026-65550 are not publicly provided in the supplied documents; monitor for updates on affected versions, impact, and remediation.
CVE-2026-65539
The advisory concerns CVE-2026-65539: Unauthenticated CSRF in WordPress Kwayy HTML Sitemap plugin version
CVE-2026-65538
CVE-2026-65538 : WordPress Machete plugin ≤ 5.2 contains a Cross Site Scripting (XSS) vulnerability in the author context. The CVSS v3.1 base score is 5.9 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. The provided documents do not specify the exact vulnerable component, explo...
EUVD-2026-48139
Author Cross Site Scripting XSS in Machete = 5.2 versions...
CVE-2026-65538 WordPress Machete plugin <= 5.2 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting XSS in Machete = 5.2 versions...
CVE-2026-65533
The CVE-2026-65533 entry concerns the WordPress Smart SEO Tool plugin, affected version family is
EUVD-2026-48134
Contributor Cross Site Scripting XSS in Smart SEO Tool = 4.1.2 versions...
EUVD-2026-48135
Author Cross Site Scripting XSS in Custom links in Elementor Image Carousel = 1.1.1 versions...
CVE-2026-65534
CVE-2026-65534 concerns the WordPress plugin "Custom links in Elementor Image Carousel" (versions
EUVD-2026-48129
Contributor Cross Site Scripting XSS in BSK PDF Manager = 3.8 versions...
CVE-2026-65528
The CVE-2026-65528 entry concerns the WordPress BSK PDF Manager plugin (versions up to 3.8) with a Cross Site Scripting (XSS) vulnerability. The root cause is XSS in this plugin version, affecting the product where user input is not properly sanitized. The documents do not provide details on the ...
CVE-2026-65527
The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions
EUVD-2026-48128
Contributor Cross Site Scripting XSS in LIQUID SPEECH BALLOON = 1.2.5 versions...
EUVD-2026-48124
Contributor Cross Site Scripting XSS in Manual - Documentation, Knowledge Base & Education WordPress Theme = 7.5.4 versions...
CVE-2026-65522
The CVE-2026-65522 entry documents a Cross Site Scripting (XSS) vulnerability in the WordPress Manual theme (Documentation, Knowledge Base & Education WordPress Theme) up to version 7.5.4. The description specifies XSS in versions