165 matches found
Site Reviews < 7.2.5 - Unauthenticated Stored XSS
Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...
CVE-2026-56011-Lab
CVE-2026-56011 - MapPress Maps for WordPress 무인증 XSS iframe 지도 렌더링 요약 이 저장소는 MapPress Maps for WordPress에 영향을 미치는 무인증 크로스사이트 스크립팅Cross-Site Scripting 취약점인 CVE-2026-56011을 재현하고 검증하기 위한 로컬 Docker 랩입니다. MapPress Maps for WordPress는 WordPress 페이지와 게시물 내부에 지도를 렌더링하는 데 사용되는 WordPress 플러그인입니다. 취약한 동작은...
CVE-2026-87917 MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
EUVD-2026-77084
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...
EUVD-2026-75534
Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...
EUVD-2026-75535
Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...
CVE-2026-79638
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script...
CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
PT-2026-86993
Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...
CVE-2026-84848
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84765
Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...
CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84763 WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...
EUVD-2026-70564
Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...
CVE-2026-81776 WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...
CVE-2026-81773
CVE-2026-81773 affects the WordPress Ninja Forms File Uploads Extension plugin in versions 3.3.26 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning no prior authentication is required to exploit it. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of ...
CVE-2026-81300 WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Calculation For Contact Form 7 = 1.0 versions...