Lucene search
+L

40256 matches found

Cvelist
Cvelist
added 4 hours ago7 views

CVE-2026-66490 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

SaveExploits0References2
Vulnrichment
Vulnrichment
added 4 hours ago3 views

CVE-2026-66490 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

5.7AI score
SaveExploits0References2
CVE
CVE
added 4 hours ago8 views

CVE-2026-66490

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

6.1CVSS5.7AI score
SaveExploits0References2
EUVD
EUVD
added 4 hours ago4 views

EUVD-2026-50333

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

6.1CVSS5.7AI score
SaveExploits0References2
NVD
NVD
added 6 hours ago6 views

CVE-2026-7436

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

6.4CVSS
SaveExploits0References5
NVD
NVD
added 6 hours ago4 views

CVE-2026-16655

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

7.2CVSS
SaveExploits0References15
Cvelist
Cvelist
added 8 hours ago7 views

CVE-2026-8791 Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

6.4CVSS
SaveExploits0References11
EUVD
EUVD
added 8 hours ago4 views

EUVD-2026-50273

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

6.4CVSS6AI score
SaveExploits0References11
CVE
CVE
added 8 hours ago8 views

CVE-2026-7436

CVE-2026-7436 affects the WordPress plugin “WPC Badge Management for WooCommerce” (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) via the text attribute in the wpcbm_best_seller shortcode, exploitable in all versions up to and including 3.1.6 . The issue arises from i...

6.4CVSS6AI score
SaveExploits0References5
Cvelist
Cvelist
added 8 hours ago7 views

CVE-2026-16655 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

7.2CVSS
SaveExploits0References15
Cvelist
Cvelist
added 8 hours ago8 views

CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

6.4CVSS
SaveExploits0References5
EUVD
EUVD
added 8 hours ago4 views

EUVD-2026-50269

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

6.4CVSS6AI score
SaveExploits0References5
CVE
CVE
added 8 hours ago6 views

CVE-2026-16597

Summary: CVE-2026-16597 affects the GTM4WP WordPress plugin (versions ≤ 1.22.3) and allows unauthenticated stored XSS via WooCommerce Billing Fields when the GTM4WP_OPTION_INTEGRATE_WCORDERDATA option is enabled. The root cause is insufficient input sanitization and output escaping in the plugin’...

7.2CVSS6AI score
SaveExploits0References7
NVD
NVD
added 8 hours ago5 views

CVE-2026-13425

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

7.2CVSS
SaveExploits0References3
NVD
NVD
added 10 hours ago5 views

CVE-2026-13605

The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...

6.8CVSS
SaveExploits0References1
Nuclei
Nuclei
added 13 hours ago143 views

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

4.8CVSS5.8AI score0.00848EPSS
SaveExploits2References1
Nuclei
Nuclei
added 13 hours ago57 views

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

6.1CVSS6.4AI score0.01582EPSS
SaveExploits2References2
Nuclei
Nuclei
added 13 hours ago27 views

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

6.1CVSS7AI score0.01582EPSS
SaveExploits2References2
Nuclei
Nuclei
added 13 hours ago86 views

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

4.8CVSS5.9AI score0.0087EPSS
SaveExploits2References3
Nuclei
Nuclei
added 13 hours ago27 views

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

9.1CVSS6AI score0.01834EPSS
SaveExploits2References3
Rows per page
Query Builder