1121860 matches found
WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting
WSO2 Data Analytics Server 3.1.0 is susceptible to cross-site scripting in carbon/resources/addcollectionajaxprocessor.jsp via the collectionName or parentPath parameter. id: CVE-2017-14651 info: name: WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting author: mass0ma severity: medium...
SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting
The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. id: CVE-2017-18518 info: name: SMTP by BestWebSoft 1.1.0 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues. impact: |...
WordPress Emag Marketplace Connector 1.0 - Cross-Site Scripting
WordPress Emag Marketplace Connector plugin 1.0 contains a reflected cross-site scripting vulnerability because the parameter "post" to /wp-content/plugins/emag-marketplace-connector/templates/order/awb-meta-box.php is not filtered correctly. id: CVE-2017-17043 info: name: WordPress Emag...
WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting
WordPress 2kb Amazon Affiliates Store plugin before 2.1.1 contains multiple cross-site scripting vulnerabilities. The plugin allows an attacker to inject arbitrary web script or HTML via the 1 page parameter or 2 kbAction parameter in the kbAmz page to wp-admin/admin.php, thus making possible the...
CVE-2026-14239
CVE-2026-14239 concerns the TourMaster WordPress plugin prior to 5.4.8. The flaw stems from two issues: (1) no nonce check when storing a custom-filter label from a request parameter, and (2) failure to escape that label when echoed on the filter admin page. This enables an unauthenticated attack...
CVE-2026-13344
The CVE-2026-13344 entry concerns The Essential Addons for Elementor WordPress plugin (before version 6.6.10). The vulnerability arises because the plugin does not validate the HTML tag name of the Pricing Table widget title before output, enabling Stored XSS when pages are viewed. Exploitation r...
EUVD-2026-51014
The tourmaster WordPress plugin before 5.4.8 does not perform a nonce check when storing a custom-filter label taken from a request parameter, and does not escape that label when echoing it on the filter admin page, allowing an unauthenticated attacker to trick a logged-in administrator into...
EUVD-2026-51011
The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...
CVE-2026-13330
The CVE-2026-13330 entry concerns the Animation Addons for Elementor WordPress plugin (before 2.7.0). The root cause is insufficient sanitisation of uploaded SVG/SVGZ files, which are incorrectly allowed among upload types. This enables users with the upload_files capability (Author and above) to...
EUVD-2026-51010
The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the uploadfiles capability Author and above to upload files containing malicious JavaScript, leading to Stored...
EUVD-2026-51005
The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...
CVE-2026-14592
The CVE-2026-14592 entry concerns the WP Real IP-based Access Control WordPress plugin up to version 1.3.1. The underlying issue is that the plugin does not perform any capability or nonce checks before storing an option value, and does not escape that value on output on its settings page. This e...
CVE-2026-59328
Summary: CVE-2026-59328 affects Spring Tools for Eclipse (5.2.0 and earlier). The issue arises when the Spring Boot starter wizard’s dependency tooltips are rendered in a native embedded SWT Browser with JavaScript enabled, and untrusted/compromised Initializr endpoints are used. This can allow a...
CVE-2026-17878
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
CVE-2026-17797
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...
EUVD-2026-50888
Inappropriate implementation in Blink in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Low...
CVE-2026-17962
CVE-2026-17962 concerns Google Chrome’s Blink engine. The vulnerability arises from an inappropriate implementation in Blink that, before version 151.0.7922.72, could allow a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. Affected product: Google Chrome (Blink...
CVE-2026-17878
Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...