Export limit exceeded: 51138 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51138 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-113488 | 2026-10-28 | 6.8 Medium | ||
| The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who clicks the badge, including administrators. | ||||
| CVE-2026-113487 | 2026-10-28 | 6.8 Medium | ||
| The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link value before outputting it in an anchor element on a listing, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view the listing, including an administrator reviewing moderated content. | ||||
| CVE-2026-111967 | 2026-10-28 | 6.8 Medium | ||
| The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrator previewing a pending post, views the content. | ||||
| CVE-2026-111021 | 2026-10-28 | 7.1 High | ||
| The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is tricked into submitting a crafted cross-site request. | ||||
| CVE-2026-110524 | 2026-10-28 | 6.8 Medium | ||
| The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content. | ||||
| CVE-2026-110506 | 1 Wordpress-extensions | 1 Page Builder By Siteorigin | 2026-10-28 | 6.8 Medium |
| The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before storing it and outputting it in the page builder interface, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who open the affected post in the editor. | ||||
| CVE-2026-107098 | 2026-10-28 | 6.8 Medium | ||
| The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's size settings before concatenating it into an HTML attribute, allowing users with the Contributor role or above to inject JavaScript that runs in the browser of any user who views the page, including an administrator reviewing a pending submission. | ||||
| CVE-2026-105972 | 2026-10-28 | 7.5 High | ||
| The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before outputting it in its cart slide-out, allowing unauthenticated users to store a Cross-Site Scripting payload that can be delivered to and executed in the session of another user, including a logged-in administrator. | ||||
| CVE-2026-118254 | 2026-10-28 | N/A | ||
| Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0. | ||||
| CVE-2026-118253 | 2026-10-28 | N/A | ||
| Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3. | ||||
| CVE-2026-118252 | 2026-10-28 | N/A | ||
| Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3. | ||||
| CVE-2026-81964 | 1 Microsoft | 17 Windows 10 21h2, Windows 10 21h2, Windows 10 22h2 and 14 more | 2026-10-28 | 5.5 Medium |
| Use of hard-coded credentials in Windows Update Orchestrator Service allows an authorized attacker to bypass a security feature locally. | ||||
| CVE-2026-118245 | 2026-10-28 | N/A | ||
| Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2. | ||||
| CVE-2026-118242 | 2026-10-28 | N/A | ||
| Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0. | ||||
| CVE-2026-50571 | 2026-10-28 | 5.7 Medium | ||
| WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the intent-verification protocol requires a subscriber to echo the `hub.challenge` value, also exposed as `hub_challenge` by some frameworks, but does not require safe response media typing or disabled MIME sniffing. An attacker can initiate a subscription to obtain a callback URL and redirect a victim browser to a crafted verification request containing HTML or JavaScript. Subscribers that return the challenge as `text/html` can execute the reflected content in the subscriber origin, using a victim's existing session to read private data or perform actions, exposing `localStorage` or `sessionStorage` and browser permissions granted to that origin. An alternative uses the verification response as an attacker-controlled same-origin script resource to bypass `script-src 'self'`; this can remain possible with `application/octet-stream` when MIME sniffing is allowed. Safe media typing and `X-Content-Type-Options: nosniff` are both needed to address the described scenarios. WebSub Rocks demonstrated reflection, but the advisory does not establish practical impact on that demonstration site. | ||||
| CVE-2026-116675 | 1 Tinymce | 1 Tinymce | 2026-10-28 | N/A |
| TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-site scripting for users with the media plugin enabled. This issue is fixed in versions 8.9.3 and 7.9.4. | ||||
| CVE-2026-114119 | 1 Best Practice Software | 1 Bp Premier | 2026-10-28 | 9.8 Critical |
| Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that is shared across all installations and cannot be changed without breaking the application. Attackers with network access to the database instance can authenticate as sysadmin, bypass application authentication, and execute operating system commands as SYSTEM. | ||||
| CVE-2026-112353 | 2026-10-28 | 8.2 High | ||
| GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer. | ||||
| CVE-2026-109999 | 2026-10-28 | 7.2 High | ||
| The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires only that the chatbot module is active with at least one configured bot; the attacker stores the payload via three unauthenticated REST calls, and the JavaScript widget auto-poll then delivers it to any administrator who opens wp-admin/index.php. | ||||
| CVE-2026-109972 | 2026-10-28 | 6.4 Medium | ||
| The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'date_format' parameter in all versions up to, and including, <= 261011 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload bypasses wp_kses_post() on save because it contains no literal angle brackets — only backslash-escaped sequences that PHP's date() materializes into HTML tag characters at render time after WordPress's shortcode_parse_atts() applies stripcslashes() to the attribute value. | ||||