129 matches found
WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS
includes/theme-functions.php in the OneTone theme through 3.0.6 for WordPress has multiple stored XSS issues. id: CVE-2019-17231 info: name: WordPress OneTone theme = 3.0.6 – Unauthenticated Stored XSS author: daffainfo severity: medium description: | includes/theme-functions.php in the OneTone...
WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Yu Liu in WordPress Plugin TranslatePress versions = 3.3.5...
WordPress Master Blocks plugin 1.4.1-1.4.1.4 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Enrico Marcolini - Claudio Marchesini - Dottor Marc in WordPress Plugin Master Blocks versions 1.4.1-1.4.1.4...
WordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability
Unauthenticated Stored Cross-Site Scripting via Comment Content vulnerability discovered by Pham Duc Anh in WordPress Plugin Asset CleanUp: Page Speed Booster versions = 1.4.0.5...
WordPress Optimole plugin 4.2.3-4.2.11 - Unauthenticated Stored XSS vulnerability
Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Optimole versions 4.2.3-4.2.11...
CVE-2026-15931
The Simple Membership WordPress plugin, in versions before 4.7.8 , is vulnerable to unauthenticated stored XSS . The flaw exists because the plugin fails to sanitise a subscriber name value received from an unauthenticated payment approval request and fails to escape it when rendered in the admin...
CVE-2026-13400 Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information
Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...
WordPress FormCraft plugin <= 3.9.14 - Unauthenticated Stored Cross-Site Scripting vulnerability
Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Luc Huynh from Noventiq RedTeam - Noventiq Vietnam in WordPress Plugin FormCraft 3 versions = 3.9.14...
CVE-2026-58077 Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics < 5.0.2
Joomla Extension - weeblr.com - Unauthenticated stored XSS in 4Analytics 5.0.2 - The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS. A specially crafted unauthenticated request may result in website takeover under some circumstances...
PT-2026-58891
The Joomla extension 4Analytics is vulnerable to an unauthenticated stored XSS in relation to the AI analysis feature...
CVE-2026-13114 Motors <= 1.4.112 - Unauthenticated Stored Cross-Site Scripting via Comment Content and User Biographical Info
The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content and User Biographical Info in all versions up to, and including, 1.4.112 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-8071
The Anti-Spam by CleanTalk. Spam protection WordPress plugin, in versions prior to 6.79 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper sanitization of content within a custom shortcode utilized in the plugin's email-encoding feature . This flaw allows unauth...
CVE-2026-7052
The CVE concerns the HT Contact Form – Drag & Drop Form Builder for WordPress plugin. A Stored Cross-Site Scripting (XSS) vulnerability exists in the file_upload parameter for all versions up to 2.8.2 due to insufficient input sanitization and output escaping. Exploitation requires the Store Subm...
CVE-2026-5324
The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when ...
CVE-2026-5110 Gravity Forms <= 2.10.0 - Unauthenticated Stored Cross-Site Scripting via Single Product Field Inside Repeater
The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping in the SingleProduct field when used inside a Repeater field. When SingleProduct fields are...
PT-2026-36594
The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when ...
CVE-2025-15386
The Responsive Lightbox & Gallery WordPress plugin before 2.6.1 is vulnerable to an Unauthenticated Stored-XSS attack due to flawed regex replacement rules that can be abused by posting a comment with a malicious link when lightbox for comments are enabled and then approved...
CVE-2020-12132
Fifthplay S.A.M.I before 2019.3HP2 allows unauthenticated stored XSS via a POST request...
PT-2025-51810
The HTML Forms – Simple WordPress Forms Plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.0 due to insufficient sanitization of fabricated file upload field metadata before displaying it in the WordPress admin dashboard. This...
