CVE-2019-14792

The WP Google Maps plugin before 7.11.35 for WordPress allows XSS via the wp-admin/ rectanglename or rectangleopacity parameter...

CVE-2018-20951

cPanel before 68.0.27 allows self XSS in WHM Spamd Startup Config SEC-387...

CVE-2018-20868

cPanel before 76.0.8 has Stored XSS in the WHM MultiPHP Manager interface SEC-464...

CVE-2018-17423

An issue was discovered in e107 v2.1.9. There is a XSS attack on e107admin/comment.php...

CVE-2016-1000237

sanitize-html before 1.4.3 has XSS...

CVE-2017-17972

packages/subjects/pub/subjects.php in Archon 3.21 rev-1 has XSS in the referer parameter in an index.php?subjecttypeid=xxx request, aka Open Bug Bounty ID OBB-466362...

CVE-2019-16148

Sakai through 12.6 allows XSS via a chat user name...

CVE-2015-9434

The kiwi-logo-carousel plugin before 1.7.2 for WordPress has CSRF with resultant XSS via the wp-admin/edit.php?posttype=kwlogos=kwlogossettings tab or tabflagsorder parameter...

CVE-2018-20558

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/system.php?rec=update has XSS via the sitename parameter...

CVE-2015-1390

Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator...

CVE-2015-9533

The Easy Digital Downloads EDD Lattice theme for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because addqueryarg is misused...

CVE-2008-4930

MyBB aka MyBulletinBoard 1.4.2 does not properly handle an uploaded file with a nonstandard file type that contains HTML sequences, which allows remote attackers to cause that file to be processed as HTML by Internet Explorer's content inspection, aka "Incomplete protection against MIME-sniffing....

CVE-2024-0852

The coreActivity: Activity Logging for WordPress plugin before 1.8.1 does not escape some request data when outputting it back in the admin dashboard, allowing unauthenticated users to perform Stored XSS attack against high privilege users such as admin...

CVE-2024-3901

The Genesis Blocks WordPress plugin through 3.1.3 does not properly escape attributes provided to some of its custom blocks, making it possible for users allowed to write posts like those with the contributor role to conduct Stored XSS attacks...

CVE-2024-11719

The tarteaucitron-wp WordPress plugin before 0.3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-10076

The Jetpack WordPress plugin before 13.8, Jetpack Boost WordPress plugin before 3.4.8 use regexes in the Site Accelerator features when switching image URLs to their CDN counterpart. Unfortunately, some of them may match patterns it shouldn’t, ultimately making it possible for contributor and abo...

CVE-2024-8032

CVE-2024-8032 affects the WordPress plugin Smooth Gallery Replacement (versions up to 1.0). The issue arises from missing CSRF protections and lack of sanitisation/escaping, enabling a logged-in admin to inject a Stored XSS payload via CSRF. The connected patches document notes remediation by upg...

CVE-2024-12282

CVE-2024-12282 concerns the WordPress连接微博 plugin (wp-connect) up to version 2.5.6. The issue is lack of CSRF protection in multiple locations, plus insufficient sanitisation/escaping, enabling a logged-in admin to store XSS payloads via CSRF. Impact per sources is stored Cross-Site Scripting affe...

SUSE SLES15: erlang-rabbitmq-client313 / rabbitmq-server313 / etc (SUSE-SU-2025:1548-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:1548-1 advisory. - CVE-2025-30219: incorrectly escaped virtual hostname present in error message could lead to XSS attack. bsc1240071...

PT-2025-21377 · WordPress · Add Svg Support For Media Uploader

Name of the Vulnerable Software and Affected Versions: The Add SVG Support for Media Uploader | inventivo WordPress plugin versions 1.0.0 through 1.0.5 Description: The issue concerns the failure to sanitize uploaded SVG files, potentially allowing users with a role as low as Author to upload...