Lucene search
+L

40024 matches found

EUVD
EUVD
added 2026/09/10 3:40 a.m.3 views

EUVD-2026-75242

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sbmdescription' parameter in all versions up to, and including, 1.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

7.2CVSS
SaveExploits0References4
CVE
CVE
added 2026/09/10 3:40 a.m.6 views

CVE-2026-76562

The Sidebar Manager Light WordPress plugin (versions up to and including 1.18 ) is vulnerable to unauthenticated stored cross-site scripting (XSS) through the sbm_description parameter, caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary...

7.2CVSS
SaveExploits0References4
CVE
CVE
added 2026/09/10 3:40 a.m.5 views

CVE-2026-15820

Builderall for WordPress (versions up to and including 3.0.2 ) is vulnerable to an Authenticated Stored Cross-Site Scripting flaw in the Photo Module 'attributes' Setting , caused by insufficient input sanitization and output escaping . An attacker with Contributor-level access or above can injec...

6.4CVSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/10 3:40 a.m.2 views

EUVD-2026-75240

The Easy Google Fonts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the controlselectors meta field in all versions up to, and including, 2.0.4. This is due to the plugin registering the controlselectors meta field with showinrest enabled but without a sanitizecallback, an...

6.4CVSS
SaveExploits0References11
EUVD
EUVD
added 2026/09/10 3:40 a.m.3 views

EUVD-2026-75239

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS
SaveExploits0References6
CVE
CVE
added 2026/09/10 3:40 a.m.9 views

CVE-2026-4657

Easy Google Fonts WordPress plugin (≤ 2.0.4) is vulnerable to an authenticated stored cross-site script via the control_selectors meta field. The plugin registers this field with show_in_rest enabled but omits a sanitize_callback, then outputs the unsanitized value directly into tags on the fron...

6.4CVSS
SaveExploits0References11
CVE
CVE
added 2026/09/10 3:40 a.m.5 views

CVE-2026-15796

The Builderall for WordPress plugin is vulnerable to Stored Cross-Site Scripting in all versions up to and including 3.0.2 , caused by insufficient input sanitization and output escaping in the bg_video_service_url setting. An authenticated attacker with Contributor-level access or higher can inj...

6.4CVSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/10 3:40 a.m.2 views

EUVD-2026-75235

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bgvideoserviceurl' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

6.4CVSS
SaveExploits0References5
EUVD
EUVD
added 2026/09/10 2:28 a.m.4 views

EUVD-2026-75230

The Ninja Forms - Scheduled Exports plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Parameters interval, format, emailTo in all versions up to, and including, 3.0.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS
SaveExploits0References2
CVE
CVE
added 2026/09/10 2:28 a.m.6 views

CVE-2026-87870

The Ninja Forms – Scheduled Exports plugin for WordPress (all versions up to and including 3.0.3 ) is vulnerable to Stored Cross-Site Scripting via unsanitized REST API parameters (interval , format , emailTo ). The root cause is insufficient input sanitization and output escaping, compounded by ...

6.4CVSS6AI score
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/10 12:41 a.m.7 views

CVE-2021-38149

CVE-2021-38149 Chikitsa Patient Management System 2.0.0 Cross-Site Scripting Almacenado XSS Existe una instancia de Cross-Site Scripting XSS almacenado en varias páginas de la versión 2.0.0 de Chikitsa Patient Management System que permite la ejecución de JavaScript arbitrario en el navegador de ...

5.4CVSS6AI score0.00664EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/10 12:20 a.m.11 views

CVE-2026-12948

CVE-2026-12948 Vulnerability Summary A stored cross-site scripting XSS vulnerability was identified in the web management interface of the Digi PortServer TS 4 H MEI. A specially crafted, authenticated request allows a script payload to be permanently written to device configuration storage. The...

4.8CVSS5.8AI score0.00418EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/09 11:53 p.m.5 views

CVE-2022-1051

CVE-2022-1051 WPQA 5.2 - Subscriber+ Cross-Site Scripting Almacenado mediante campos de perfil Descripción El plugin, utilizado como complemento para los temas Discy y Himer, no sanitiza ni escapa los campos de ciudad, teléfono o credenciales del perfil al mostrarlos en la página de perfil,...

5.4CVSS6AI score0.01271EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/09 11:49 p.m.7 views

OpenNebula-CVE-2025-56535

OpenNebula-CVE-2025-56535 Título del Exploit : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in zone attribute Autor del Exploit : Mark Artamonov Sitio web del proveedor : https://opennebula.io/ Versión probada : OpenNebula 6.10.0.1 Versiones afectadas : OpenNebula Prueba de Concepto :...

6.1CVSS5.9AI score0.00185EPSS
SaveExploits2
Kitploit
Kitploit
added 2026/09/09 11:42 p.m.7 views

OpenNebula-CVE-2025-56537

OpenNebula-CVE-2025-56537 Exploit Title : OpenNebula 6.10.0.1 - Stored XSS Cross-site Scripting in virtual network template Exploit Author : Mark Artamonov Vendor Homepage : https://opennebula.io/ Tested Version : OpenNebula 6.10.0.1 Affected Versions : OpenNebula Proof of Concept :...

6.1CVSS6AI score0.00185EPSS
SaveExploits3
Kitploit
Kitploit
added 2026/09/09 11:38 p.m.7 views

CVE-2026-7222-XSS

Stored Cross-Site Scripting XSS in Coaching Management System Leads to Account Takeover Product Coaching Management System in PHP Code-Projects.org https://code-projects.org/coaching-management-system-in-php-with-source-code/ Affected Components /modules/student/complaint.php Complaint Submission...

5.1CVSS5.5AI score0.00232EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 11:38 p.m.7 views

CVE-2023-34838

CVE-2023-34838 — XSS Almacenada en eScan Management Console Resumen Microworld Technologies eScan Management Console versión 14.0.1400.2281 es vulnerable a un ataque de Cross-Site Scripting XSS Almacenado. Un atacante autenticado con acceso a la función de gestión de roles puede inyectar un scrip...

5.4CVSS6AI score0.00813EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 11:24 p.m.4 views

CVE-2025-70849-Podinfo

CVE-2025-70849: XSS Almacenado en Podinfo Resumen Se identificó una vulnerabilidad de seguridad CWE-79 en Podinfo , una aplicación web para demostrar microservicios en Kubernetes. La funcionalidad /store permite a usuarios no autenticados cargar contenido arbitrario en HTML/JS, lo que provoca XSS...

6.1CVSS8.2AI score0.00254EPSS
SaveExploits4
Kitploit
Kitploit
added 2026/09/09 11:11 p.m.9 views

CVE-2026-2002-poc

Sumary The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the formname parameter in all versions up to, and including, 1.50.2 due to insufficient input sanitization and output escaping. This makes it possib...

4.4CVSS5.8AI score0.00166EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/09 11:09 p.m.6 views

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload Overview...

8.5CVSS5.9AI score0.00237EPSS
SaveExploits1
Rows per page
Query Builder