1139106 matches found
OESA-2026-4316 gi-docgen security update
GI-DocGen is a document generator for GObject-based libraries. GObject is the base type system of the GNOME project. GI-Docgen reuses the introspection data generated by GObject-based libraries to generate the API reference of these libraries, as well as other ancillary documentation. Security...
welcart-poc
Welcart e-Commerce usc-e-shop ≤ 2.12.5 — Unauthenticated Ref...
CVE-2026-107648 WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...
CVE-2026-107648
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.1.5 . The root cause is insufficient input sanitization and output escaping within several parameters, including action, function, plugin, p...
CVE-2026-107648 WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...
EUVD-2026-102843
The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action also function, plugin, posttype, poststatus, ids, loggedout, and POST posttitle' parameter in all versions up to, and including, 1.1.5 due to insufficient input...
WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Booktics versions = 1.0.29...
WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin PowerPack Lite for Beaver Builder versions = 1.3.1...
WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Khanh Nguyen in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...
WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Theme eStore versions = 1.6.13...
CVE-2026-96768
The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
CVE-2026-14452
Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...
CVE-2026-107649
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventlocationname' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
CVE-2026-14452 Open redirect and XSS via reset_url parameter
Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...
EUVD-2026-102834
Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...
CVE-2026-14452
Checkmk versions <2.5.0p15 , <2.4.0p38 ,
CVE-2026-14452
Improper validation of the reseturl parameter of the Setup in-page search in Checkmk 2.5.0p15, 2.4.0p38, 2.3.0p51 and 2.2.0 EOL allows an attacker to execute arbitrary script in the session of an authenticated user with Setup access, or to redirect that user to an arbitrary external site, by...
CVE-2026-107649
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.2.22 . The root cause is insufficient input sanitization and output escaping of the 'event[location_name]' parameter. This allows unauthenticated attackers to inject ...
CVE-2026-107649 Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventlocationname' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
EUVD-2026-102832
The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'eventlocationname' parameter in all versions up to, and including, 3.2.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...