CVE-2025-63420

CVE-2025-63420 CrushFTP11 anterior a 11.3.757 es vulnerable a inyección de HTML almacenado en el Panel de Administración de CrushFTP Informes / "Quién creó la carpeta", lo que permite la ejecución persistente de HTML en sesiones de administración. CWE CWE-79 — Neutralización incorrecta de la...

CVE-2023-2859

CVE-2023-2859: Inyección de HTML almacenado en folderName que afecta al administrador en TeamPass 3.0.9 - M Nadeem Qazi Hola, He encontrado una vulnerabilidad importante en la aplicación nilsteampassnet/teampass que implica una inyección de HTML almacenado en el campo FolderName. Al insertar códi...

CVE-2023-2591

CVE-2023-2591: Inyección de HTML almacenada en la etiqueta del elemento en Teampass 3.0.6 - M Nadeem Qazi Recientemente identifiqué una vulnerabilidad de seguridad en nilsteampassnet/teampass, una popular herramienta de gestión de contraseñas. Esta vulnerabilidad, identificada como CVE-2023-2591,...

CVE-2025-60378

CVE-2025-60378: Inyección de HTML Almacenado en RISE Ultimate Project Manager & CRM ⚠️ Aviso de Seguridad Una vulnerabilidad crítica de inyección de HTML almacenado que afecta a facturas, mensajería y comunicaciones automatizadas -ff6600 📋 Resumen Se ha descubierto una vulnerabilidad crítica de...

CVE-2025-55903

CVE-2025-55903: Inyección de HTML Almacenado en PerfexCRM ⚠️ Aviso de Seguridad Una vulnerabilidad crítica de Inyección de HTML Almacenado que afecta a facturas, facturación y comunicaciones automatizadas -ff6600 📋 Resumen Se ha descubierto una vulnerabilidad de Inyección de HTML Almacenado en...

CVE-2026-91120 Discourse: Stored HTML injection in video notification emails

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, provider-controlled video titles in lazy video embeds could be reparsed as HTML when Discourse generated notification emails or chat summaries. A user with standard posting privileges could creat...

CVE-2026-33657

CVE-2026-33657 - EspoCRM 9.3.3 Stored HTML Injection in Email Notifications Authenticated proof-of-concept for stored HTML injection in EspoCRM 9.3.3 email notifications. Summary EspoCRM 9.3.3 renders stream-note notification emails by transforming the note body with Markdown and inserting the...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 anterior a 11.3.757 es vulnerable a una inyección de HTML almacenado en el Panel de Administración de CrushFTP Informes / "Who Created Folder", lo que permite la ejecución persistente de HTML en sesiones de administración. CWE CWE-79 — Neutralización incorrecta de la...

CVE-2026-91119: Improper Neutralization of Input During Web Page Generation

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, the topic small-action and nested-activity-log components interpolated the free-form actioncodewho value into mention-link href attributes without URL encoding. A quote-bearing display name could...

CVE-2026-81338

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81338 MasterStudy LMS < 3.7.50 - Subscriber+ Stored HTML Injection via Course Discussions

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

CVE-2026-81338

The MasterStudy LMS WordPress Plugin (versions before 3.7.50 ) is vulnerable to stored HTML injection due to insufficient sanitization and restriction of HTML in user-submitted content. This flaw allows users with subscriber-level accounts and above to inject malicious content, such as iframes , ...

CVE-2026-81338: Insufficient Verification of Data Authenticity

The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not properly sanitise and restrict HTML in user-submitted content before storing it and rendering it to other users, allowing users with subscriber-level accounts and above to perform stored HTML injection, such as embedding...

WordPress Royal Addons for Elementor plugin < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability

Unauthenticated Stored HTML Injection in Form Notification Emails vulnerability discovered by Brian Willows in WordPress Plugin Royal Elementor Addons versions 1.7.1067...

CVE-2026-13407 Royal Elementor Addons < 1.7.1067 - Unauthenticated Stored HTML Injection in Form Notification Emails

The Royal Elementor Addons WordPress plugin before 1.7.1067 does not properly sanitize and escape values submitted through its form widget before including them in the body of administrator notification emails, allowing unauthenticated attackers to inject arbitrary HTML into emails sent to the si...

CVE-2026-89307

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

EUVD-2026-78668

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-89307

CVE-2026-89307 affects the Design Scuole Italia WordPress theme (versions 1.0–2.17.3 ). The "Firma Circolare" feature allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling a stored HTML injection that forces visiting users to redirect to an attacker-controlled...

PT-2026-92114

The "Firma Circolare" feature in the "Design Scuole Italia" WordPress theme allows an authenticated attacker to inject arbitrary HTML via the sign parameter, enabling forced redirection of visiting users to an attacker-controlled URL Stored HTML Injection / Open Redirect...

CVE-2026-54505 TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner

TREK is a collaborative travel planner. Prior to 3.1.0, when the Journey add-on is enabled, TREK interpolates the unescaped activeSuggestion.title value into journey.frontpage.suggestionText through client/src/i18n/TranslationContext.tsx and renders the result with dangerouslySetInnerHTML in...