1129873 matches found
WordPress Gutenverse Form plugin < 3.0.11 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by John Ryan Albon in WordPress Plugin Gutenverse Form versions 3.0.11...
EUVD-2026-100878
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...
CVE-2026-105261
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin versions 4.10.1 through 4.10.5 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to enforce a safe HTML-element allowlist on short...
WordPress Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories plugin 4.10.1-4.10.5 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Civitasmass in WordPress Plugin Post Expirator versions 4.10.1-4.10.5...
CVE-2026-105261 PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes
The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...
EUVD-2026-100876
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...
CVE-2026-104644
The Image Photo Gallery Final Tiles Grid WordPress plugin, in versions prior to 3.6.15 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize or escape gallery configuration values before they are echoed into an inline script on pages embedding t...
CVE-2026-104644 Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update
The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.15 does not sanitize or escape gallery configuration values before echoing them into an inline script on every page that embeds the gallery, allowing users with contributor-level access and above to store JavaScript that execute...
WordPress Image Photo Gallery Final Tiles Grid plugin < 3.6.15 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Abdullah Kareem in WordPress Plugin Image Photo Gallery Final Tiles Grid versions 3.6.15...
CVE-2026-103369
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-101924
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...
CVE-2025-8191
CVE-2025-8191 – Swagger UI XSS Injection Description : This repository contains a Proof‑of‑Concept PoC exploit for CVE‑2025‑8191, a vulnerability found in Swagger UI. The vulnerability allows Cross‑Site Scripting XSS injection in the “description” field, leading to remote script execution under...
CVE-2017-20192-formidable-forms
CVE-2017-20192 — Formidable Forms WordPress — Vulnerable Docker Lab Reproducible Docker lab for CVE-2017-20192 Formidable Forms 2.05.03 stored XSS. Quickstart docker compose up -d --build Target: http://127.0.0.1:18080 Validate lab helper This helper script: submits a crafted entry unauthenticate...
CVE-2025-57462
CVE-2025-57462 Des: Stored XSS via Malicious File Upload in machpanel 8.0.32. POC: Navigate to https://controlpaneldomain/Client/SubmitTicket.aspx and Upload PDF file that contain XSS scripts in metadata, after submitting the ticket you can execute malicius XSS script by accessing the uplaoded...
EUVD-2026-100811
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-103369 Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX
The Social Share Buttons & Analytics Plugin – GetSocial.io plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'response' parameter in all versions up to, and including, 4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-103369
The Social Share Buttons & Analytics Plugin (GetSocial.io) for WordPress, in versions up to and including 4.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the response parameter via the gs_update_with_values AJ...
CVE-2026-101924
The NewStatPress plugin for WordPress (versions up to and including 1.4.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'Last referrers' meta box on the Overview admin page because the newstatpress_generate_overview_lastreferrers() function fails to properly escape...
EUVD-2026-100810
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.4.5 via the 'Last referrers' meta box on the plugin's Overview admin page. This is due to insufficient output escaping of the visitor-supplied query string that the plugin record...