WordPress plugin Social Post Embed 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

PT-2026-35660

The Social Post Embed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Threads embed handler in all versions up to, and including, 2.0.1. This is due to insufficient input sanitization and output escaping on the user-supplied URL. This makes it possible for authenticated...

WordPress Social Post Embed plugin <= 2.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by hxuu in WordPress Plugin Social Post Embed versions = 2.0.1...

CVE-2026-40538

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-40537

creationtimestamp| type| source ---|---|--- 2026-04-24 13:35:12+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mkanes5drn2e...

CVE-2026-35333

creationtimestamp| type| source ---|---|--- 2026-04-23 14:15:24+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mk675r76zg27 2026-05-14 11:00:13+00:00| published-proof-of-concept| Telegram/KyHCshI6yZBJj8Foftsx5hfP7GLhbMmJ81CYC3g7d-oupU...

CVE-2026-41167

creationtimestamp| type| source ---|---|--- 2026-04-22 21:24:02+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4gnbxyzv2q 2026-04-22 22:30:31+00:00| seen| https://infosec.exchange/users/offseq/statuses/116450723807217963 2026-04-22 22:30:33+00:00| seen|...

CVE-2026-40937

creationtimestamp| type| source ---|---|--- 2026-04-22 05:22:56+00:00| published-proof-of-concept| https://github.com/rustfs/rustfs/security/advisories/GHSA-pfcq-4gjr-6gjm 2026-04-22 21:24:17+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mk4gnqqvqk2c 2026-04-22...

CVE-2026-40938

creationtimestamp| type| source ---|---|--- 2026-04-21 14:12:35+00:00| published-proof-of-concept| https://github.com/tektoncd/pipeline/security/advisories/GHSA-94jr-7pqp-xhcq 2026-04-21 14:12:35+00:00| published-proof-of-concept|...

CVE-2026-22741

creationtimestamp| type| source ---|---|--- 2026-04-20 12:25:17+00:00| seen| https://bsky.app/profile/o2cloud.bsky.social/post/3mjwhlzimrz2w...

CVE-2026-6622

creationtimestamp| type| source ---|---|--- 2026-04-20 12:10:14+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjwgr5lrg52c...

CVE-2026-40338

creationtimestamp| type| source ---|---|--- 2026-04-18 01:51:34+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqdb4gftn2k...

CVE-2026-40341

creationtimestamp| type| source ---|---|--- 2026-04-18 01:43:20+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjqcseoq7w2f...

CVE-2026-40285

creationtimestamp| type| source ---|---|--- 2026-04-17 21:18:28+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjptymtwiu2z 2026-04-17 22:06:25+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjpwoi7zso26 2026-04-17 23:20:07+00:00| published-proof-of-concept|...

CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...

CVE-2026-6372

creationtimestamp| type| source ---|---|--- 2026-04-15 17:18:46+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjkfobkscn2w 2026-04-15 19:07:09+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjklq4pkp62t 2026-04-15 19:22:05+00:00| published-proof-of-concept|...

CVE-2026-3461

creationtimestamp| type| source ---|---|--- 2026-04-15 16:53:33+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mjkeb6ribo2h 2026-04-22 21:20:26+00:00| seen| Telegram/xHZW3dnIVlZ81UM5ayk21xAksqcQlWsb2BCoesl5IB3eE 2026-04-27 21:33:47+00:00| seen|...

CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...

CVE-2026-34161 Chamilo LMS: Stored XSS via Malicious File Upload in Social Post Attachments Leads to Arbitrary JavaScript Execution

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...

CVE-2026-34161

Technical details are not publicly available in the provided connected documents. Monitor for updates from Chamilo LMS advisory and subsequent CVE details.