Export limit exceeded: 49141 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (49141 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-12865 | 2026-09-02 | 7.1 High | ||
| The Photo Gallery by 10Web WordPress plugin before 1.8.44 does not escape two request parameters before reflecting them into input-attribute values on its admin pages (one on the Shortcode page, one on the Galleries/Albums list page), so an unauthenticated attacker can craft a link that, when opened by a logged-in administrator (or, for the first sink, a contributor), executes arbitrary JavaScript in the victim's authenticated session via an auto-firing onfocus handler. The Galleries/Albums sink renders only when the site has more than 20 galleries/albums (the normal state of a populated install). | ||||
| CVE-2025-15664 | 2026-09-02 | 6.8 Medium | ||
| The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider. | ||||
| CVE-2025-15663 | 2026-09-02 | 6.8 Medium | ||
| The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser of anyone (including an administrator) who views the slider. | ||||
| CVE-2026-4378 | 1 Akilli Commerce Software Technologies Ltd. Co. | 1 E-commerce Pack | 2026-09-02 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001. | ||||
| CVE-2026-37012 | 1 Greydgl | 1 Pentestgpt | 2026-09-02 | 7.5 High |
| A vulnerability in pentestgpt/core/langfuse.py in PentestGPT 1.0.0 allows remote attackers to disclose sensitive user telemetry data via hardcoded API credentials. | ||||
| CVE-2026-39070 | 2026-09-02 | 4.8 Medium | ||
| WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account. | ||||
| CVE-2026-39071 | 2026-09-02 | 5.4 Medium | ||
| WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account. | ||||
| CVE-2025-63607 | 1 Nooncarlett | 1 Techstore | 2026-09-02 | 6.1 Medium |
| TechStore 1.0 is vulnerable to Cross Site Scripting (XSS). In contact_display, the application echoes the id parameter verbatim into the rendered page, permitting execution of attacker-supplied JavaScript in users browser. | ||||
| CVE-2026-38577 | 1 Tenda | 1 Hg21 | 2026-09-02 | 9.8 Critical |
| Insecure hardcoded credentials in the Admin account of Tenda HG21 V4.0.0-260302 allows attackers to gain root access. | ||||
| CVE-2026-50980 | 1 Womopanel | 1 Opanel | 2026-09-02 | 6.1 Medium |
| Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record | ||||
| CVE-2026-51153 | 1 Qd | 1 Qd | 2026-09-02 | 5.4 Medium |
| Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803. When a task is run via /task/<taskid>/run, the handler renders task log content (logtmp) into the HTML response using Python % string formatting without HTML encoding. logtmp is populated from the exception object or from new_env.variables.__log__, which is attacker-controlled via the template extract_variables mechanism. A low-privileged authenticated attacker can create a crafted HAR template that extracts arbitrary HTML/JavaScript into the __log__ variable via the api://util/unicode endpoint. When a victim triggers the task run, the embedded script executes in the victim browser within the QD application context. | ||||
| CVE-2026-79720 | 2 Lutzroeder, Netron | 2 Netron, Netron | 2026-09-01 | 5.0 Medium |
| Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution. | ||||
| CVE-2026-24370 | 2 Theme-one, Wordpress | 2 The Grid, Wordpress | 2026-09-01 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeOne The Grid allows Stored XSS. This issue affects The Grid: from n/a through 2.8.0. | ||||
| CVE-2026-19471 | 2 Rockwell Automation, Rockwellautomation | 2 Armorstart Lt, Armorstart Lt | 2026-09-01 | N/A |
| Multiple stored cross-site scripting security issues exist within ArmorStart® LT. Stored XSS occurs when user input is not properly sanitized and is stored on the server, allowing an attacker to inject malicious scripts that will be executed when other users access the affected page. | ||||
| CVE-2026-81768 | 2 Highwarden, Wordpress | 2 Super Store Finder, Wordpress | 2026-09-01 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions. | ||||
| CVE-2026-7877 | 2 Bootstrapped Ventures, Wordpress | 2 Wp Recipe Maker Premium, Wordpress | 2026-09-01 | 6.4 Medium |
| The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-15101 | 2 Wordpress, Wpbakery | 2 Wordpress, Wpbakery Page Builder | 2026-09-01 | 6.4 Medium |
| The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post sanitization applied during save does not neutralize the payload because the malicious script content is base64-encoded as plain alphanumeric text with no HTML tags to strip; the vc_raw_html shortcode template then decodes and echoes this content unescaped at render time. | ||||
| CVE-2026-12747 | 2 Shabti, Wordpress | 2 Frontend Admin By Dynamapps, Wordpress | 2026-09-01 | 6.4 Medium |
| The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tag' Shortcode Attribute in all versions up to, and including, 3.29.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-19573 | 2 Wordpress, Worschtebrot | 2 Wordpress, Affiliate Super Assistent | 2026-09-01 | 7.2 High |
| The Affiliate Super Assistent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘doCommentShortcode’ function in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-18488 | 2 Creativethemes, Wordpress | 2 Blocksy Companion, Wordpress | 2026-09-01 | 6.4 Medium |
| The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data) in all versions up to, and including, 2.1.51 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||