CVE-2026-111592 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author term name

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name maps to displayname' parameter in all versions up to, and including, 4.17.0 due to insufficient input sanitization and outp...

EUVD-2026-114215

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

PT-2026-133697

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.9.2.7 via the process. This makes it possible for unauthenticated attackers to extract sensitive data including the WordPress password hash of any user...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2026-104122

The Ukr-To-Lat WordPress plugin, in versions through 1.3.5 , is vulnerable to SQL injection due to a failure to sanitize and escape a term name before utilizing it in a SQL query. This flaw allows users with Contributor-level access and above to execute unauthorized SQL commands. No specific reme...

CVE-2026-104122 Ukr-To-Lat <= 1.3.5 - Contributor+ SQLi via Term Name

The Ukr-To-Lat WordPress plugin through 1.3.5 does not sanitize and escape a term name before using it in a SQL query, allowing users with Contributor-level access and above to perform SQL injection attacks...

CVE-2023-51800

Cross Site Scripting XSS vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the mainsettings component in the phone, address, bank, accname, accnumber parameters, newclass and cname parameter, addnewparent function in t...

CVE-2019-13463

An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle" or "echo $term-name" statement...

CVE-2019-13463

An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle" or "echo $term-name" statement...

CVE-2015-3369

Cross-site scripting XSS vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block...

Cross site scripting

Cross-site scripting XSS vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block...

CVE-2015-3369: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Taxonews module before 6.x-1.2 and 7.x-1.x before 7.x-1.1 for Drupal allows remote authenticated users with the "administer taxonomy" permission to inject arbitrary web script or HTML via a term name in a block...

PT-2015-6190

Name of the Vulnerable Software and Affected Versions Drupal Taxonews module versions prior to 6.x-1.2 Drupal Taxonews module versions 7.x-1.x prior to 7.x-1.1 Description A cross-site scripting XSS issue exists, allowing remote authenticated users with the "administer taxonomy" permission to...

CVE-2010-1984

Cross-site scripting XSS vulnerability in the Taxonomy Breadcrumb module 5.x before 5.x-1.5 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with administer taxonomy permissions, to inject arbitrary web script or HTML via the taxonomy term name in a Breadcrumb display...

CVE-2010-1984: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Taxonomy Breadcrumb module 5.x before 5.x-1.5 and 6.x before 6.x-1.1 for Drupal allows remote authenticated users, with administer taxonomy permissions, to inject arbitrary web script or HTML via the taxonomy term name in a Breadcrumb display...