CVE-2025-51397

عنوان الاستغلال: LiveHelperChat 4. احفظ التغييرات. 5. يتم تخزين هذه الحمولة وتنفيذها لاحقًا عندما يقوم مسؤول أو مستخدم ذو صلاحيات أعلى بعرض قائمة المستلمين حيث يكون المهاجم مُدرجًا كالمالك. !imagehttps://assets.kitploit.com/...

Duplicate Page WordPress - Stored Cross-Site Scripting

Duplicate Page WordPress plugin = 4.4.2 contains a stored cross-site scripting caused by unsanitized Duplicate Post Suffix settings in output, letting high privilege users execute malicious scripts, exploit requires high privilege user role. id: CVE-2021-24681 info: name: Duplicate Page WordPress...

Limit Login Attempts WordPress - Stored Cross-site Scripting

Limit Login Attempts WordPress plugin 4.0.50 contains a stored cross-site scripting caused by not escaping IP addresses controlled via headers like X-Forwarded-For before outputting them in reports, letting unauthenticated attackers execute scripts in admin context. id: CVE-2021-24657 info: name:...

Microweber <1.2.12 - Stored Cross-Site Scripting

Microweber prior to 1.2.12 contains a stored cross-site scripting vulnerability. It allows unrestricted upload of XML files,. id: CVE-2022-0963 info: name: Microweber 1.2.12 - Stored Cross-Site Scripting author: amit-jd severity: medium description: | Microweber prior to 1.2.12 contains a stored...

Limit Login Attempts - Stored Cross-Site Scripting

Limit Login Attempts WordPress plugin 4.0.72 contains a stored cross-site scripting caused by unsanitized and unescaped settings, letting malicious administrators inject Javascript code, exploit requires administrator privileges. id: CVE-2022-1029 info: name: Limit Login Attempts - Stored...

WPBot <= 8.4.9 - Cross-Site Scripting

WPBot = 8.4.9 is vulnerable to stored cross-site scripting via the conversation parameter in the qcldwbchatbotconversationsave AJAX action. The AJAX nonce qcsecretbotnonceval123qc is publicly emitted on every frontend page via wplocalizescript under the ajaxnonce key, making it freely obtainable ...

ChurchCRM 4.5.3 - Cross-Site Scripting

A stored Cross-site scripting XSS vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the NoteEditor.php. id: CVE-2023-26843 info: name: ChurchCRM 4.5.3 - Cross-Site Scripting author: Harsh severity: medium description: | A stored Cross-site scripti...

The Events Calendar < 6.4.0.1 - Cross-site Scripting

The Events Calendar WordPress plugin 6.4.0.1 contains a stored XSS caused by improper sanitization of user-submitted content when rendering views via AJAX, letting attackers execute scripts in the context of the affected site. Exploitation requires user interaction. id: CVE-2024-4180 info: name:...

tagDiv Composer < 4.2 - Stored Cross-Site Scripting

tagDiv Composer plugin versions before 4.2 for WordPress are vulnerable to unauthenticated stored XSS via the /wp-json/tdw/savecss endpoint. An attacker can inject malicious JavaScript code through the compiledcss parameter, which gets stored and executed when the CSS is loaded. id: CVE-2023-3169...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS XSS مخزّن v1.6.1 المؤلف: Sergio الوصف: يتأثر WBCE CMS 1.6.1 بثغرة برمجة نصية مخزّنة عبر المواقع XSS تسمح للمهاجمين بتنفيذ تعليمات برمجية عشوائية عبر حمولة payload مصمّمة في معلمة "صفحة المقدمة" Intro Page في قائمة الصفحات. سيتم تنفيذ الحمولة على الصفحة الرئيسية بشكل مستقل عن جلسة المستخد...

LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7. id: CVE-2023-40000 info: name: LiteSpeed Cache = 5.7 - Unauthenticated Stored XSS...

CVE-2021-46069

CVE-2021-46069 Titre de l'exploit : Vehicle Service Management System - 'Mechanic List' Stored Cross Site Scripting XSS Auteur de l'exploit : SANU P.L CVE: CVE-2021-46069 CVSS: 4.8 MEDIUM Références :...

CVE-2023-43360-CMSmadesimple-Stored-XSS---File-Picker-extension

ثغرة XSS مخزنة في CMSmadesimple الإصدار 2.2.18 المؤلف: Sergio الوصف: تسمح ثغرة البرمجة النصية عبر المواقع XSS في CMSmadesimple الإصدار 2.2.18 لمهاجم محلي بتنفيذ كود عشوائي عبر نص برمجي مخصص إلى الدليل العلوي في قائمة منتقي الملفات. نواقل الهجوم: ثغرة في تعقيم الإدخال في الدليل العلوي من قائمة...

AlmaLinux 9.2 [TuxCare] Security Update: mod_proxy_cluster Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1778858907)

The AlmaLinux 9.2 host has a package installed that is affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1778858907 advisory. - A flaw was found in the modproxycluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias'...

CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-84095

The wp-review-slider-pro WordPress plugin (versions before 12.7.12 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a lack of capability checks on an AJAX handler combined with a nonce that is generated for every visitor. This allows any authenticated user, such as a subsc...

CVE-2026-94573

The Repeater Fields for Elementor Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.2.7 . The root cause is insufficient input sanitization and output escaping within the Repeater Field Value. This flaw allows unauthenticated attac...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping within the Shortcode Order 'elements[].title' parameter. An unauthenticated attacker c...

CVE-2026-95866 User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Avatar Field in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-96568 Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phonenumber' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...