CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector path traversal CVE-2019-3396 RCE POC POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type:...

CVE-2026-111318

The HT Mega Addons for Elementor WordPress plugin (versions <= 3.2.7 ) is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping in the href attribute of tags within the .htmega-tab-nav parameter of the Tabs widget . U...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

CVE-2023-4800

CVE ID: CVE-2023-4800 Vulnerability Type: Sensitive Data Exposure Description: The DoLogin Security plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the dashboard widget in versions up to, and including, 3.7. This makes it possible for...

CVE-2025-7340

🚨 HT Contact Form Widget = 2.2.1 - Unauthenticated Arbitrary File Upload CVE-2025-7340 CVE: CVE-2025-7340 CVSS: 9.8 Critical 📝 Description The HT Contact Form Widget For Elementor Page Builder & Gutenberg Blocks & Form Builder. plugin for WordPress is vulnerable to arbitrary file uploads due to...

PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0. id: CVE-2023-40752 info: name: PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site...

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

Advanced Text Widget < 2.0.2 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. id: CVE-2011-4618 info: name: Advanced Text Widget 2.0.2 - Cross-Site Scripting author:...

Wordpress Polls Widget < 1.5.3 - SQL Injection

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks id: CVE-2021-24442 inf...

PHPJabbers Callback Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. id: CVE-2023-40755 info: name: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site Scripting...

CVE-2022-48429_poc

CVE-2022-48429 - YouTrack Stored XSS The reported description of the CVE on the NVD database lacks accuracy. This is a more accurated description: Youtrack version = 2022.3.65373 has a stored Cross-Site Scripting XSS in dashboards. A malicious low-privileged user can create and share a malformed...

CVE-2025-14893

CVE-2025-14893: Authenticated Stored Cross-Site Scripting XSS in IndieWeb WordPress Plugin Disclaimer: This repository is created for educational purposes and ethical disclosure only. The vulnerability has been responsibly reported to the vendor and patched. Do not use this information to exploit...

CVE-2026-117997

A flaw was found in Firefox. A use-after-free memory corruption issue in the Widget component occurs when the application attempts to reuse memory after it has already been released. An attacker could exploit this vulnerability, such as through a malicious web page, to escape the browser's...

CVE-2025-49029

🚨 WordPress Custom Login And Signup Widget Plugin 🔥 Base Score: 9.1 CRITICAL CWE ID: CWE-94 – Improper Control of Generation of Code 'Code Injection' 🧠 Description The plugin allows administrators to modify the contents of sn.php via the Sender’s Name field in the settings page. User-supplied inp...

CVE-2026-999999

X-Trading Portal: Regional Financial Infrastructure v1.4.2 Overview This repository contains the core distribution and deployment configurations for the X-Trading Portal XTP , a containerized solution designed for retail banking and stock trading services. This version v1.4.2 includes the updated...

CVE-2025-41089

CVE-2025-41089: Reflected XSS in Xibo CMS I have discovered a Reflected Cross-Site Scripting XSS vulnerability in Xibo CMS v4.1.2. This issue stems from the application's failure to properly sanitize user-supplied input in the 'Configuration Name' field of certain widgets within the template...

jquery-cve-2022-31160

jQuery UI CVE-2022-31160 Vulnerability Demonstration This project demonstrates the jQuery UI Checkboxradio Widget Refresh Vulnerability CVE-2022-31160 , which allows HTML entity decoding during widget refresh operations, potentially leading to Cross-Site Scripting XSS attacks. 🚨 Security Warning ...

CVE-2026-107098

The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views...

CVE-2026-110506

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against...

CVE-2026-110507

The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not restrict the query arguments users can add to its Post Loop widget or limit the loop to posts they are allowed to read, which could allow users with the contributor role and above to read the content of other users' draft,...