WordPress FundEngine – Donation and Crowdfunding Platform plugin <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin FundEngine versions = 1.8.1...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

CVE-2021-46069

CVE-2021-46069 エクスプロイトタイトル: Vehicle Service Management System - 'Mechanic List' Stored Cross Site Scripting XSS エクスプロイト作者: SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 MEDIUM 参考文献: https://www.plsanu.com/vehicle-service-management-system-mechanic-list-stored-cross-site-scripting-xss...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

CMSmadesimple 存储型XSS漏洞 v2.2.18 作者：Sergio 描述： CMSmadesimple v.2.2.18 中存在跨站脚本漏洞，本地攻击者可通过文件选择器菜单中的顶部目录字段注入恶意脚本，从而执行任意代码。 攻击向量： 脚本注入漏洞。文件选择器菜单中“顶部目录”字段的输入过滤不严，允许注入JavaScript代码，当用户访问网页时该代码将被执行。 漏洞利用演示（POC）： 登录后台后，我们进入常规菜单下的“文件选择器扩展 - 顶部目录”部分。 编辑我们已创建的顶部目录菜单，可以看到可以在全局元数据字段中注入任意JavaScript代码。 XSS Payload...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS 存储型 XSS v1.6.1 作者：Sergio 描述： WBCE CMS 1.6.1 存在跨站存储型脚本（XSS）漏洞，攻击者可通过在 Pages 菜单的 Intro Page 参数中精心构造的有效载荷来执行任意代码。该有效载荷将在主页上执行，且与用户会话无关，因此使用另一个用户访问首页时同样会执行该有效载荷。 POC： 登录面板后，我们将转到 Pages 中的“Modify Intro Page”部分 http://localhost/wbce/wbce/admin/pages/index.php 我们编辑 body 配置并在其中添加 XSS 有效载荷： XSS...

CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-63105

ReadyEcommerce before 4.5.2 contains a stored cross-site scripting XSS vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue,...

CVE-2026-72751

CTI-Transmute’s conversion graph is affected by a stored XSS in the Pivotick-based UI. Attacker-controlled CTI data could inject HTML/JS into node labels, edge labels, node properties, edge properties, and node types, with HTML rendering paths and a vulnerable raw-JSON usage via document.write. T...

EUVD-2026-55628

ReadyEcommerce before 4.5.2 contains a stored cross-site scripting XSS vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue,...

EUVD-2026-55624

Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...

CVE-2026-72583

A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...