Export limit exceeded: 424711 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51852 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-112863 | 2026-10-24 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS kallyas allows Reflected XSS.This issue affects KALLYAS: from n/a through 4.25.0. | ||||
| CVE-2026-112844 | 2 Arraytics, Wordpress-extensions | 2 Wp Event Solution, Wp Event Solution | 2026-10-24 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26. | ||||
| CVE-2026-112207 | 1 Wordpress-extensions | 1 Download Monitor | 2026-10-24 | 7.1 High |
| The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link. | ||||
| CVE-2026-72570 | 1 Cube-root | 1 Directory-serve | 2026-10-24 | 5.4 Medium |
| A stored cross-site scripting (XSS) vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters. | ||||
| CVE-2026-73344 | 2 Passionate Programmer Peter, Wordpress | 2 Wp Data Access, Wordpress | 2026-10-24 | 5.9 Medium |
| Author Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions. | ||||
| CVE-2026-8166 | 1 Logo Software Industry And Trade Inc. | 1 E-logo Purchasing Portal | 2026-10-24 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52. | ||||
| CVE-2026-61947 | 2 Wordpress, Wpvibes | 2 Wordpress, Form Vibes – Database Manager For Forms | 2026-10-24 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Form Vibes – Database Manager for Forms <= 1.5.2 versions. | ||||
| CVE-2026-17728 | 1 Google | 1 Chrome | 2026-10-24 | 5.4 Medium |
| Inappropriate implementation in Extensions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-17734 | 1 Google | 1 Chrome | 2026-10-24 | 5.4 Medium |
| Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (Chromium security severity: Medium) | ||||
| CVE-2026-18548 | 2 Trainingbusinesspros, Wordpress-extensions | 2 Groundhogg — Crm, Newsletters, And Marketing Automation, Groundhogg | 2026-10-24 | 7.2 High |
| The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-109702 | 2 Maxfoundry, Wordpress-extensions | 2 Social Share Buttons, Social Share Buttons | 2026-10-24 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31. | ||||
| CVE-2026-105874 | 2 Brainstormforce, Wordpress-extensions | 2 Surecart, Surecart | 2026-10-24 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3. | ||||
| CVE-2026-106706 | 1 Xuxueli | 1 Xxl-job | 2026-10-24 | 5.4 Medium |
| XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor. JobCodeController.save() stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped. | ||||
| CVE-2026-110627 | 2 Macwarrior, Oxygenz | 2 Clipbucket-v5, Clipbucket | 2026-10-24 | 4.7 Medium |
| ClipBucket v5 through 5.5.3-#206 contains a reflected cross-site scripting vulnerability in admin_area/index.php that allows attackers to inject HTML via the val parameter in mode=add_todo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection, executing script in the admin panel origin. | ||||
| CVE-2026-91159 | 1 Discourse | 1 Discourse | 2026-10-24 | 7.7 High |
| Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, oEmbed processing treated an entire attacker-controlled HTML fragment as trusted when the fragment contained an iframe whose source matched the configured allowlist. A user with posting permission who controlled a public webpage and its oEmbed response could combine an allowlisted iframe with unrelated sibling HTML or CSS, causing stored visual overlays or other styled content to appear in post content and enabling misleading or fraudulent user interfaces. Exploitation requires a posting account, control of the fetched webpage and oEmbed response, and an allowlisted iframe source. The issue affects content integrity but does not expose restricted data, disrupt availability, or require interaction with Discourse Content Security Policy. This issue is fixed in versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9. | ||||
| CVE-2026-47790 | 1 Qnap Systems | 1 Quftp Service | 2026-10-24 | N/A |
| A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vulnerability to inject malicious code. We have already fixed the vulnerability in the following version: QuFTP Service 1.4.6 and later QuFTP Service 1.5.5 and later QuFTP Service 1.6.5 and later | ||||
| CVE-2026-105079 | 2 Stylemixthemes, Wordpress-extensions | 2 Masterstudy Lms, Masterstudy Lms | 2026-10-24 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52. | ||||
| CVE-2026-100515 | 2 Villatheme, Wordpress-extensions | 2 Photo Reviews For Woocommerce, Photo Reviews For Woocommerce | 2026-10-24 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30. | ||||
| CVE-2026-97298 | 2 Kingaddons, Wordpress-extensions | 2 King Addons For Elementor, King Addons For Elementor | 2026-10-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions. | ||||
| CVE-2026-115754 | 1 Yahoo | 2 Serialize-javascript, Serialize Javascript | 2026-10-23 | 4.7 Medium |
| serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to break out of HTML script elements by ending serialized function source text with an unescaped </script. Attackers controlling a function's source via a spoofed toString() can combine surrounding output delimiters and later values to inject live markup such as img onerror handlers. | ||||