CVE-2026-77365

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

CVE-2026-76053

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser in all versions up to, and including, 3.3.3 due to insufficient input sanitization and output escaping. This mak...

CVE-2026-18983

The One User Avatar | User Profile Picture plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.5.4 via the wpuaactionprocessoptionupdate function. This is due to insufficient file type validation in wphandleupload called without a MIME...

CVE-2026-3129

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via crafted tag attributes in all versions up to, and including, 7.7. This is due to a flawed regular expression that is used to strip width and height attributes from images when the "Lazy Load Images" and "Add...

CVE-2026-16654

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-18324

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-15798

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18978

The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 7.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2025-0054

CVE-2025-0054 – SAP NetWeaver Gespeicherter XSS Scanner 🕷 Ein leichtgewichtiges Python-Tool zur Erkennung von gespeicherten Cross-Site-Scripting XSS-Schwachstellen in SAP NetWeaver Application Server Java , speziell ausgerichtet auf CVE-2025-0054. ⚠️ Nur für Bildungszwecke und autorisierte...

CVE-2024-6651

CVE-2024-6651 POC XSS - CVE-2024-6651 Funktionierender PoC für die Schwachstelle CVE-2024-6651, die das Plugin WP File Upload 4.24.8 betrifft und Reflected Cross-Site Scripting XSS in WordPress ermöglicht. 📌 Beschreibung Diese Schwachstelle ermöglicht die Injektion beliebigen JavaScript-Codes dur...

-CVE-2023-46450

-CVE-2023-46450 Beschreibung Sourcecodester Free and Open Source Bestandsverwaltungssystem 1.0 ist anfällig für Cross-Site-Scripting XSS über die Funktion 'Lieferant hinzufügen'. Zusätzliche Informationen In der Funktion 'Lieferant hinzufügen' des Free and Open Source Bestandsverwaltungssystems...

CSPOC

Cobalt Strike XSS persistente RCE CVE-2022-39197 Parametri di esecuzione: -u: indirizzo di ascolto HTTP di Cobaltstrike, es. http://127.0.0.1:8500 -p: Payload, es. non troppo lungo Dimostrazione: Comando di compilazione: go build -ldflags "-s -w" Gruppo QQ: Clicca per unirti: 528118163 Unisciti a...

-CVE-2025-0133-GlobalProtect-XSS

mitsecvpnxssexploit 🔓 Exploit per l'endpoint SSL VPN GlobalProtect /ssl-vpn/getconfig.esp che aggiunge un payload XSS appositamente creato all'URL. Utilizzo root@kitploit: python3 exploit.py -u https://target.com Parametri -u, --url: URL di base del target non includere i parametri della query...

findom-xss

FinDOM-XSS FinDOM-XSS è uno strumento che ti permette di trovare possibili e/o potenziali vulnerabilità DOM XSS in modo rapido. Installazione root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dipendenze: LinkFinder Utilizzo Per eseguire lo strumento su ...

findom-xss

FinDOM-XSS FinDOM-XSS is a tool that allows you to finding for possible and/ potential DOM based XSS vulnerability in a fast manner. Installation root@kitploit: $ git clone https://github.com/dwisiswant0/findom-xss.git --recurse-submodules Dependencies: LinkFinder Usage To run the tool on a targe...

XSpear

XSpear XSpear è uno scanner XSS su rubygems !IMPORTANT Repository XSpear archiviato Questo repository è stato archiviato ed è ora in sola lettura. XSpear non viene più mantenuto attivamente. Prova Dalfox invece 🌙🦊 Uno scanner XSS più veloce e potente con funzionalità avanzate. →...

InjuredAndroid

InjuredAndroid - CTF Eine anfällige Android-Anwendung mit CTF-Beispielen, die auf Bug-Bounty-Funden, Exploit-Konzepten und purer Kreativität basieren. Jetzt im Google Play Store erhältlich! https://play.google.com/store/apps/details?id=b3nac.injuredandroid Einrichtung für ein physisches Gerät 1...

BruteXSS

⚠️ Este projeto foi descontinuado. ⚠️ BruteXSS BruteXSS é uma ferramenta escrita em Python para encontrar vulnerabilidades XSS em aplicações web. Esta ferramenta foi originalmente desenvolvida por Shawar Khan em CLI. Eu apenas a redesenhei e a transformei em GUI para mais conveniência. Esta...

EUVD-2026-67409

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'size' Shortcode Attribute in all versions up to, and including, 3.15.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-16654

The Avada (Fusion) Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting via its 'size' shortcode attribute in all versions up to and including 3.15.6 . The root cause is insufficient input sanitization and output escaping: because the injected payload resides entirely within a sh...