CVE-2026-2422

WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 1.0.5 . The flaw resides in the pbwp_raw_shortcode shortcode handler, which decodes Base64-encoded content and outputs it directly without sanitization or e...

CVE-2026-2422 WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode

The WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'pbwprawshortcode' shortcode in all versions up to, and including, 1.0.5. This is due to the shortcode handler decoding Base64-encoded content and outputting it directly without an...

EUVD-2026-83542

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

CVE-2026-13770

AppMySite – WordPress & WooCommerce Mobile App Builder plugin (versions up to and including 3.15.3 ) is vulnerable to Stored Cross-Site Scripting via the save_ams_license_key AJAX handler. The handler performs no capability check and no nonce verification, and suffers from insufficient input sani...

CVE-2026-13770 AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler

The AppMySite – WordPress & WooCommerce Mobile App Builder No-Code Android & iOS App Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via saveamslicensekey AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping...

EUVD-2026-83574

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Multiple Choice 'Other' Value in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-15664

Quill Forms (Conversational Multi Step Forms, Surveys & Quizzes) for WordPress is affected by a stored cross-site scripting vulnerability in all versions up to and including 5.7.1 . The flaw stems from insufficient input sanitization and output escaping in the Multiple Choice "Other" field . An u...

PoC_CVE-2024-28157

PoC CVE-2024-28157 Overview Jenkins GitBucket Plugin veersion 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers able to configure jobs. Exploitation Steps Setup Jenkins using docker: 1. Use docker...

CVE-2026-88824

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

CVE-2026-85680

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-84750

The Ultra Addons for Contact Form 7 WordPress plugin before 3.5.51 does not validate the type or extension of files uploaded through one of its form fields, and stores them at a predictable public path with the attacker-chosen extension intact, allowing unauthenticated users to upload arbitrary...

CVE-2021-42558

CVE-2021-42558: Multiple Cross-Site Scripting in MITRE Caldera Caldera versions =2.8.1 contains multiple reflected, stored and self XSS vulnerabilities that may be exploited by authenticated and unauthenticated attackers. Vendor Disclosure: The vendor's disclosure for this vulnerability can be...

CVE-2025-56807

CVE-2025-56807 Description A Stored Cross Site Scripting XSS vulnerability was discovered in FairSketch RISE Ultimate Project Manager & CRM v3.9.4 in the File Manager functionality. The vulnerability lies in the title parameter that is submitted when creating new folders. Due to insufficient inpu...

CVE-2023-49971

CVE-2023-49971 Customer Support System 1.0 - Vulnerabilidad de Cross-Site Scripting XSS en el campo/parámetro "firstname" en la página "customerlist" Descripción : Customer Support System 1.0 es vulnerable a XSS almacenado. Existe una vulnerabilidad XSS en la versión 1 del Customer Support System...

CVE-2026-88824

The Master Blocks WordPress plugin (versions 1.4.1 through 1.4.1.4 ) has a missing authorization check on one of its REST routes, allowing unauthenticated users to modify its White Label settings. One of those settings is output unescaped in the admin area, enabling a Stored XSS attack that execu...

EUVD-2026-83507

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

CVE-2026-88824 Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

EUVD-2026-83504

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...

CVE-2026-85680

The Ultimate Member WordPress plugin before 2.13.1 is affected by a stored cross-site scripting (XSS) vulnerability. The plugin fails to escape user-supplied profile names before outputting them in the page title, and decodes HTML entities after its own sanitisation has already run. This allows u...

CVE-2026-85680 Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title

The Ultimate Member WordPress plugin before 2.13.1 does not escape a value derived from user supplied profile names before outputting it in the page title, and decodes HTML entities in it after its own sanitisation has already run, allowing unauthenticated attackers who register an account to sto...