1139056 matches found
WordPress Themify Builder Cross-site Scripting Vulnerabilities
WordPress Themify Builder 7.8.2 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'visible' short-code attribute, which may lead to stored cross-site scripting. This allows authenticated attackers...
Thorsten Rinne phpMyFAQ input validation vulnerability
Thorsten Rinne’s phpMyFAQ versions from 4.2.0-alpha to 4.2.0-beta have a vulnerability related to input validation. This vulnerability stems from a storage-side cross-site scripting vulnerability in SvgSanitizer. Attackers can split script tags around removed markers, allowing for reassembly afte...
WordPress GetPaid Cross-site Scripting Vulnerability
WordPress GetPaid versions 2.8.61 and earlier have a cross-site scripting vulnerability. This vulnerability stems from a storage-based cross-site scripting attack conducted through the 'mmdwqzpoxadd' parameter. Due to insufficient input sanitization and output escaping, unauthenticated attackers...
WordPress Themify Popup Cross-site Script Vulnerability
WordPress Themify Popup 1.4.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the parameter popupwidthunit. It may allow authenticated attackers with author-level or higher permissions to inject...
ThimPress LearnPress Cross-Site Script Vulnerabilities
ThimPress and LearnPress versions 4.4.10 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning for parameters like quantity REST and ordercomments checkout, as well as improper output escaping. It may lead to stored cross-site scripting...
CVE-2025-52097
Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary code via reflecting un-sanitized input from query string parameters directly into the HTML response without proper output encoding...
WordPress xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN versions = 1.4.2...
WordPress Themify Popup plugin <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability
Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Popup versions = 1.4.7...
WordPress Themify Builder plugin <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Themify Builder versions = 7.8.2...
CVE-2026-97470
The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escapin...
CVE-2026-90821
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-18516
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516 Improper Encoding or Escaping of Output in Crafty Controller
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
EUVD-2026-102873
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-18516
The Audit Logs component of Crafty Controller is vulnerable to an output escaping flaw (CWE-116 ). A remote, unauthenticated attacker can perform stored cross-site scripting (XSS) by leveraging HTTP header injection . No specific remediation or exploit details are provided in the documents.
CVE-2026-18516
An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...
CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...
CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller
An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...