Lucene search
+L

40490 matches found

EUVD
EUVD
added 1 hour ago3 views

EUVD-2026-53186

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

6.4CVSS5.7AI score
SaveExploits0References7
EUVD
EUVD
added 1 hour ago3 views

EUVD-2025-210616

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

5.5AI score
SaveExploits0References2
CVE
CVE
added 4 hours ago4 views

CVE-2026-7441

Technical details are not publicly available in the provided documents. Monitor for updates.

6.4CVSS5.7AI score
SaveExploits0References6
CVE
CVE
added 4 hours ago5 views

CVE-2026-5116

The vulnerability CVE-2026-5116 affects the WordPress plugin Contact Form 7 – Dynamic Text Extension (versions

4.4CVSS5.7AI score
SaveExploits0References4
CVE
CVE
added 4 hours ago6 views

CVE-2026-5108

The CVE concerns the WordPress plugin Super Progressive Web Apps (versions

4.4CVSS5.7AI score
SaveExploits0References4
CVE
CVE
added 4 hours ago6 views

CVE-2026-16583

The CVE concerns Orbit Fox by ThemeIsle before version 3.0.8, where the plugin does not sanitize uploaded SVG files when SVG upload is enabled. This allows authenticated users with the upload capability (Author and above by default, without the unfiltered_html capability) to upload SVGs containin...

5.2AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 6 hours ago2 views

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

7.2CVSS5.7AI score
SaveExploits0References5
Cvelist
Cvelist
added yesterday23 views

CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core

The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...

8.6CVSS
SaveExploits0References1
Nuclei
Nuclei
added yesterday58 views

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

6.1CVSS6.1AI score0.01582EPSS
SaveExploits2References2
Nuclei
Nuclei
added yesterday91 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS5.3AI score0.00893EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday27 views

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

6.1CVSS7.1AI score0.01582EPSS
SaveExploits2References2
Nuclei
Nuclei
added yesterday17 views

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

7.2CVSS5.2AI score0.00657EPSS
SaveExploits0References2
Nuclei
Nuclei
added yesterday28 views

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

9.1CVSS5.5AI score0.01834EPSS
SaveExploits2References3
Nuclei
Nuclei
added yesterday144 views

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

4.8CVSS5.3AI score0.00848EPSS
SaveExploits2References1
Nuclei
Nuclei
added yesterday87 views

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

5.4CVSS6.1AI score0.0142EPSS
SaveExploits1References5
Nuclei
Nuclei
added yesterday69 views

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

5.7CVSS5.7AI score0.01877EPSS
SaveExploits1References5
CVE
CVE
added yesterday11 views

CVE-2026-14337

CVE-2026-14337 affects Pega Platform versions 23.1.0 through 25.1.3, where a stored Cross-site Scripting (XSS) vulnerability exists in a user interface component. The flaw requires a high-privilege developer user and is described with a CVSS 4.0 base score of 4.6 (Medium). The provided data does ...

4.6CVSS5.4AI score
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added yesterday4 views

CVE-2026-14192

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Bilin Software and Informatics Consultancy Inc. HUMANIST Digital Human Resources allows Stored XSS. This issue affects HUMANIST Digital Human Resources: from 26.0 before 26.1...

5.4CVSS5.4AI score0.00175EPSS
SaveExploits0References2Affected Software1
EUVD
EUVD
added yesterday9 views

EUVD-2026-52596

The PowerPress Podcasting plugin by Blubrry WordPress plugin before 11.16.11 does not sanitise and escape some of its Podcast Episode settings, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

6.8CVSS5.5AI score0.00152EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday29 views

CVE-2026-14824 Quiz And Survey Master < 11.2.2 - Contributor+ Stored XSS via Polar Question

The Quiz and Survey Master QSM WordPress plugin before 11.2.2 does not properly escape a question setting before outputting it into an unquoted HTML attribute, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the browser of any user viewing th...

0.00163EPSS
SaveExploits0References1
Rows per page
Query Builder