CVE-2021-46069

CVE-2021-46069 익스플로잇 제목: Vehicle Service Management System - 'Mechanic List' 저장형 크로스 사이트 스크립팅 XSS 익스플로잇 작성자: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 중간 참조: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple 저장형 XSS v2.2.18 작성자: Sergio 설명: CMSmadesimple v.2.2.18의 XSS크로스 사이트 스크립팅 취약점으로 인해 로컬 공격자가 파일 선택기 메뉴File Picker Menu의 최상위 디렉터리Top Directory에 제작된 스크립트를 통해 임의 코드를 실행할 수 있습니다. 공격 벡터: 스크립팅: '파일 선택기 메뉴File Picker Menu'의 최상위 디렉터리 항목에 대한 정화sanitization 과정에서 발생하는 취약점으로 인해 사용자가 웹 페이지에 접근할 때 실행...

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

CVE-2025-51397

익스플로잇 제목: LiveHelperChat 4. 변경 사항을 저장합니다. 5. 이 페이로드는 저장된 후, 관리자 또는 더 높은 권한의 사용자가 공격자가 소유자로 등록된 수신자 목록을 볼 때 실행됩니다...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 작성자: Sergio 설명: WBCE CMS 1.6.1은 Intro Page 매개변수에 제작된 페이로드를 통해 공격자가 임의의 코드를 실행할 수 있게 하는 크로스사이트 저장형 스크립팅XSS 취약점의 영향을 받습니다. 페이로드는 사용자의 세션과 무관하게 메인 페이지에서 실행되므로, 다른 사용자로 홈페이지에 접근하더라도 페이로드가 실행됩니다. POC: 패널에 로그인하면 Pages의 "Modify Intro Page" 섹션으로 이동합니다...

AlmaLinux 9.2 [TuxCare] Security Update: mod_proxy_cluster Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778858907)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778858907 advisory. - A flaw was found in the modproxycluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias'...

CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability checks on an AJAX handler combined with a nonce that is generated for every visitor. This allows any authenticated user, such as a subsc...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.2.7 . The root cause is insufficient input sanitization and output escaping within the Repeater Field Value. This flaw allows unauthenticated attac...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping within the Shortcode Order 'elements[].title' parameter. An unauthenticated attacker c...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-95866 User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...