CVE-2023-31779

CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...

WordPress WP Recipe Maker Premium plugin <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Recipe Maker Premium versions = 10.5.0...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

CVE-2021-24545

CVE-2021-24545 WP HTML Author Bio alert/XSS/ Then view post made by the author to trigger the XSS Video POC: https://www.youtube.com/watch?v=fhzJZ5hSI-g...

CVE-2025-13401-XSS-Stored

Proof of Concept: Stored XSS in Autoptimize tags for images found in the content when image optimization or preloading is enabled. In version 3.1.13, the function uses a "blacklist" approach via pregreplace to remove specific attributes like title, alt, , , , and from the original tag before...

CVE-2025-63420

CVE-2025-63420 CrushFTP11 before 11.3.757 is vulnerable to stored HTML injection in the CrushFTP Admin Panel Reports / "Who Created Folder", enabling persistent HTML execution in admin sessions. CWE CWE-79 — Improper Neutralization of Input During Web Page Generation Cross-site Scripting CVSS v3....

CVE-2025-70600---Urve-Smart-Office---Stored-XSS-in-iOS-App

URVE Smart Office iOS — Stored XSS via Tile HTML Field PoC This repository documents a proof-of-concept PoC for a stored cross-site scripting XSS vulnerability affecting the iOS mobile application of URVE Smart Office. Due to insufficiently implemented input validation, attacker-controlled...

CVE-2026-75964

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping. This...

CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-18488

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health — all in one place. 📸 Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed|...

CVE-2025-45778

CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary JavaScript or HTML code via injecting a crafted payload into the "Description" text field when...

reproducing-CVE-2025-1489

Reproducing CVE-2025-1489 This repository simulates a reproduction of a web-related CVE CVE-2025-1489 in a safe environment to demonstrate and practice my forensic/vulnerability analysis skills. The vulnerability identified and reproduced is a stored cross-site scripting XSS vulnerability in the...

CVE-2024-41312.

CVE-2024-41312. InstantCMS - Stored Cross Site Scripting XSS Affected Version: InstantCMS 2.16.3 Steps to Reproduce: 1. Log in to https://demo.instantcms.io as an demo user. 2. Visit https://demo.instantcms.io/photos/upload. 3. Upload the image with the embedded payload test in the Camera Model...

CVE-2026-18488

The Blocksy Companion WordPress plugin (versions up to and including 2.1.51 ) is vulnerable to authenticated Stored XSS via the tagName block attribute in the blocksy/dynamic-data block, caused by insufficient input sanitization and output escaping. Attackers with Author-level access or higher ca...

EUVD-2026-68987

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-18488 Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute blocksy/dynamic-data in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-75980

CVE-2026-75980 is a Stored Cross-Site Scripting (XSS) vulnerability in the BetterDocs WordPress plugin (versions ≤ 4.8.1), discovered by Wordfence PRISM . The flaw resides in the Heading 'id' attribute within post content: entity-encoded quotes bypass wp_kses_post at save time, and the payload ma...

CVE-2026-75964

CVE-2026-75964 affects the User Profile Builder WordPress plugin in all versions up to and including 4.0.0 . The vulnerability is a Stored Cross-Site Scripting (XSS) in the 'email' parameter of the email-confirmation feature, caused by insufficient input sanitization and output escaping. An unaut...