CVE-2022-21661

CVE-2022-21661 CVE-2022-21661 exploit for Elementor custom skin...

Wordpress-cve-CVE-2022-21661

Wordpress 5.8.2 CVE-2022-21661 Vuln enviroment This enviroment is setup with the Elementor Custom Skin, plugin to test the CVE-2022-21661. to start the enviroment console wp-lab$ ./start.sh To get the admin password get the log from the running container, a new pwd is generated every time the...

CVE-2023-46948

CVE-2023-46948 - Reflected XSS in Temenos T24 R19.40 A reflected Cross-Site Scripting XSS vulnerability was found on Temenos T24 Browser R19.40 that enables a remote attacker to execute arbitrary JavaScript code in an authenticated victim browser-based web console. Affected Product: Temenos T24 -...

CVE-2026-86444

The LearnPress WordPress plugin (versions 4.2.6.4–4.4.6 ) contains a reflected XSS vulnerability in the 'skin' parameter . A user-supplied value is not escaped before being inserted into an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the ...

CVE-2026-86444 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-86444 LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter

The LearnPress WordPress plugin before 4.4.7 does not escape a user supplied value before using it in an HTML attribute on a public page, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who opens a crafted link, including a logged in administrator. Only...

CVE-2026-83546

The CoolClock WordPress plugin, in versions prior to 4.3.8 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the insufficient escaping of a skin setting before it is rendered within an HTML attribute . This flaw allows users with contributor-level access or higher to inject...

CVE-2026-83546 CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-83546 CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-83545

The CoolClock WordPress plugin (versions before 4.3.8 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper escaping of a custom skin setting before it is outputted within an inline script . This flaw allows users with contributor-level access and above to i...

CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

EUVD-2026-75956

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-83546: Improper Neutralization of Input During Web Page Generation

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

PT-2026-89782

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2022-51017

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

EUVD-2022-56046

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017 PocketMine-MP before 3.26.5 and 4.0.5 Denial of Service via Skin Data

PocketMine-MP versions before 3.26.5 and 4.0.5 fail to validate the length of skin data fields submitted by players, allowing uncapped values to exceed the 32767 byte TAGString limit. Attackers can submit oversized skin data fields like skinID or geometryName to trigger exceptions during NBT data...

CVE-2022-51017

PocketMine-MP versions prior to 3.26.5 and 4.0.5 fail to validate the length of skin data fields (e.g., skinID , geometryName ) submitted by players, allowing uncapped values to exceed the 32767-byte TAG_String limit. This triggers exceptions during NBT data serialization, causing a server crash ...