Lucene search
+L

97213 matches found

NVD
NVD
added 2026/09/18 7:16 a.m.7 views

CVE-2026-75016

The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...

6.4CVSS0.00201EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/18 6:38 a.m.14 views

CVE-2026-84909

The Custom Twitter Feeds WordPress plugin (Tweets Widget / X Feed Widget) is vulnerable to Stored Cross-Site Scripting via the 'buttoncolor' shortcode attribute in all versions up to and including 2.8.0 , caused by insufficient input sanitization and output escaping . Authenticated attackers with...

6.4CVSS0.00235EPSS
SaveExploits0References9
Cvelist
Cvelist
added 2026/09/18 6:38 a.m.33 views

CVE-2026-84909 Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00235EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/09/18 6:38 a.m.8 views

EUVD-2026-82731

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

6.4CVSS0.00235EPSS
SaveExploits0References9
EUVD
EUVD
added 2026/09/18 6:38 a.m.7 views

EUVD-2026-82744

The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...

6.4CVSS0.00201EPSS
SaveExploits0References6
Cvelist
Cvelist
added 2026/09/18 6:38 a.m.32 views

CVE-2026-75016 Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute

The Magazine Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the News Ticker block's clientId attribute in versions up to, and including, 1.8.6. This is due to insufficient input sanitization and output escaping in the NewsTicker::render method, which concatenates the...

6.4CVSS0.00201EPSS
SaveExploits0References6
EUVD
EUVD
added 2026/09/18 6:38 a.m.7 views

EUVD-2026-82743

The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it...

4.3CVSS0.00213EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/18 6:38 a.m.12 views

CVE-2026-75016

The Magazine Blocks plugin for WordPress (versions up to and including 1.8.6 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability in the NewsTicker::render() method. The root cause is insufficient input sanitization and output escaping: the clientId block attribute is concatenated i...

6.4CVSS0.00201EPSS
SaveExploits0References6
CVE
CVE
added 2026/09/18 6:38 a.m.10 views

CVE-2026-18317

Foxtool All-in-One: Contact chat button, Custom login, Media optimize images WordPress plugin (versions ≤ 2.5.3 ) contains an authorization bypass in the toggle_watermark AJAX action. The plugin fails to properly verify that the requesting user is authorized to perform the action via the option_k...

4.3CVSS0.00213EPSS
SaveExploits0References5
Kitploit
Kitploit
added 2026/09/18 6:25 a.m.12 views

CVE-2026-11101-HTTP-Cache-Poisoning-via-Unkeyed-Query-Parameter

CVE-2026-11101 – Envenenamiento de caché HTTP mediante un parámetro de consulta no clave Descripción general Una caché web utiliza únicamente la ruta de la URL como clave de caché, ignorando los parámetros de consulta. Un atacante puede añadir una carga útil maliciosa a un parámetro no clave p...

6.5CVSS6.2AI score0.0025EPSS
SaveExploits1
NVD
NVD
added 2026/09/18 6:16 a.m.7 views

CVE-2026-88825

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

8.8CVSS0.00276EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/18 6:16 a.m.9 views

CVE-2026-85127

The VikBooking Hotel Booking Engine & PMS WordPress plugin before 1.8.15 does not restrict the type of files unauthenticated visitors may attach to its live chat, nor sanitize their contents, allowing them to store active content which is executed in the context of an administrator viewing the...

8.8CVSS0.00303EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/18 6:16 a.m.6 views

CVE-2026-84902

The King Addons for Elementor WordPress plugin before 51.1.81 does not perform an object-level authorization check when importing template content into a page, allowing users with contributor-level access and above to overwrite the Elementor content of arbitrary posts and pages, including those...

6.8CVSS0.0029EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/18 6:16 a.m.8 views

CVE-2026-85122

The Easy Form Builder by WhiteStudio WordPress plugin before 4.2.0 does not validate a submitted value against the stored configuration for some of its form types, allowing unauthenticated users to store arbitrary content which is then rendered unescaped in an admin page, leading to Stored XSS...

8.8CVSS0.0034EPSS
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/18 6:00 a.m.7 views

MAL-003

MAL-003: Bypass de seguridad en Groovy y XSS almacenado en Apache OfBiz Se han identificado una RCE en Groovy y XSS en Apache OfBiz = 18.12.05. ¿Por qué no hay CVE? Apache OfBiz no crea CVEs para "ataques posteriores a la autenticación realizados con credenciales de demostración, especialmente co...

5.8AI score
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/18 6:00 a.m.6 views

WordPress All Bootstrap Blocks plugin <= 1.3.31 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin All Bootstrap Blocks versions = 1.3.31...

6.8CVSS0.00235EPSS
SaveExploits0References1Affected Software1
EUVD
EUVD
added 2026/09/18 6:00 a.m.7 views

EUVD-2026-82679

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

6.8CVSS0.00235EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/18 6:00 a.m.36 views

CVE-2026-88993 All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute

The All Bootstrap Blocks WordPress plugin through 1.3.31 does not properly escape a block attribute before outputting it in HTML tag-name position, allowing users with Contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

0.00235EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/18 6:00 a.m.11 views

CVE-2026-88993

CVE-2026-88993 is a stored XSS vulnerability in the All Bootstrap Blocks WordPress plugin through version 1.3.31 . The root cause is improper escaping of a block attribute (identified as the areoi/button type attribute) before outputting it in an HTML tag-name position. Users with Contributor-lev...

6.8CVSS0.00235EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/18 6:00 a.m.7 views

EUVD-2026-82677

The iGMS Direct Booking WordPress plugin before 2.0 does not authorise or escape its widget appearance settings, allowing unauthenticated users to store arbitrary web scripts that execute in the context of an administrator viewing the iGMS Direct Booking WordPress plugin before 2.0 settings, and ...

8.8CVSS0.00276EPSS
SaveExploits0References1
Rows per page
Query Builder