Export limit exceeded: 376568 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48092 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-66694 | 2 Thrive Themes Coupon, Wordpress | 2 Thrive Architect, Wordpress | 2026-08-08 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions. | ||||
| CVE-2026-66705 | 2 Facebook, Wordpress | 2 Facebook For Wordpress, Wordpress | 2026-08-08 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions. | ||||
| CVE-2026-66707 | 2 Facebook, Wordpress | 2 Facebook For Woocommerce, Wordpress | 2026-08-08 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions. | ||||
| CVE-2026-12801 | 2 Themefic, Wordpress | 2 Ultimate Addons For Contact Form 7, Wordpress | 2026-08-08 | 6.4 Medium |
| The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-14331 | 2 Subscribe2 Project, Wordpress | 2 Subscribe2, Wordpress | 2026-08-08 | 6.1 Medium |
| The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link. | ||||
| CVE-2026-49007 | 1 Zte | 1 F689 | 2026-08-08 | 7.5 High |
| By accessing unencrypted information in the device firmware, an attacker can obtain the initial login credentials for the device's web interface. | ||||
| CVE-2026-66494 | 1 Joomshaper.net | 1 Sp Page Builder Extension For Joomla | 2026-08-08 | N/A |
| Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Shapes API endpoint SP Page Builder < 6.7.0 - An unauthenticated attacker can store malicious JavaScript in a Joomla site's database via a single HTTP request. When an administrator opens the SP Page Builder editor, the JavaScript executes in their browser automatically.. | ||||
| CVE-2026-62293 | 1 Hapifhir | 1 Hl7 Fhir Core | 2026-08-08 | 5 Medium |
| HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, the hidden scan command concatenates attacker-controlled Implementation Guide titles, profile titles, and source references into scan.html without escaping in Scanner.java. As a result, a user who scans an attacker-supplied IG/profile and then opens or publishes the generated local/CI HTML report can trigger stored cross-site scripting, executing attacker-controlled JavaScript in the report's browser context. This issue is fixed in version 6.9.11. | ||||
| CVE-2026-48094 | 2 Dartiss, Wordpress | 2 Shareopenly, Wordpress | 2026-08-08 | N/A |
| The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's `esc_url()` escaping function on the `$url` variable before it is rendered into HTML content. This variable is constructed from `home_url( add_query_arg( array(), $wp->request ) )` and is concatenated directly into an HTML `href` attribute on every singular post or page where the plugin's sharing link is displayed. WordPress's security handbook mandates that every URL placed in HTML output must be passed through `esc_url()`, which both HTML-encodes special characters (converting `"`, `<`, `>` into their safe HTML entity equivalents) and strips dangerous URI schemes such as `javascript:` and `data:`. The omission of this function means that if the `$url` value ever contains HTML-special characters or a dangerous URI scheme — through a `home_url` WordPress filter applied by another plugin or theme, through certain web server or hosting configurations, or through future code changes — the unescaped content will be injected verbatim into the rendered HTML of every post or page on the site. Version 1.2.1 contains a patch for the issue. | ||||
| CVE-2026-48026 | 1 Treeverse | 2 Lakefs, Lakefs-enterprise | 2026-08-08 | 8.7 High |
| lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write access to any repository branch can commit a `.md` object containing arbitrary HTML/JavaScript. Any other user who opens that object, or who navigates to a repository or directory containing a malicious `README.md`, executes the attacker-supplied script in their own authenticated session. lakeFS fixes the issue in v1.81.1 and lakeFS Enterprise fixes the issue in in v1.84.0. Enterprise customers using older versions can temporarily disable Markdown rendering by adding YAML to their config. No workaround exists for OSS release. Users are advised to upgrade to the latest version for both lakeFS and lakeFS-Enterprise. | ||||
| CVE-2026-19207 | 1 Phpgurukul | 1 Company Visitor Management System | 2026-08-08 | 2.4 Low |
| A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. | ||||
| CVE-2025-6946 | 1 Watchguard | 29 Firebox M270, Firebox M290, Firebox M370 and 26 more | 2026-08-08 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the IPS configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management ninterface of another management user. | ||||
| CVE-2026-71435 | 1 Statamic | 1 Cms | 2026-08-08 | 6.1 Medium |
| Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.3 and 6.24.2, the default ("automagic") form notification email rendered user-submitted values without escaping, allowing an unauthenticated form submitter to inject HTML into the notification emails sent to the configured recipients. This issue is fixed in versions 5.74.3 and 6.24.2. | ||||
| CVE-2025-4805 | 1 Watchguard | 1 Fireware Os | 2026-08-08 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Access Portal configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2025-4804 | 1 Watchguard | 1 Fireware Os | 2026-08-08 | N/A |
| Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WatchGuard Fireware OS allows Stored XSS via the spamBlocker module. This vulnerability requires an authenticated administrator session to a locally managed Firebox. | ||||
| CVE-2025-1239 | 1 Watchguard | 1 Fireware Os | 2026-08-08 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the Blocked Sites list. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2025-1071 | 1 Watchguard | 29 Firebox M270, Firebox M290, Firebox M370 and 26 more | 2026-08-07 | 4.8 Medium |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the spamBlocker module. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2025-6947 | 1 Watchguard | 3 Firebox, Fireware, Fireware Os | 2026-08-07 | N/A |
| A stored cross-site scripting (XSS) vulnerability exists in the management interface of WatchGuard Firebox appliances via the SIP Proxy configuration. An authenticated remote attacker with administrator privileges could exploit this vulnerability to execute arbitrary JavaScript code in the Firebox management interface of another management user. | ||||
| CVE-2026-11425 | 1 Domoticz | 1 Domoticz | 2026-08-07 | 4.4 Medium |
| Domoticz versions prior to 2026.3 contains a stored cross-site scripting vulnerability in the mobile dashboard that allows authenticated attackers to inject arbitrary HTML and JavaScript by updating Text or Alert subtype device values through the API. The mobile dashboard renders device data via ng-bind-html with only an nl2br() transform that performs no HTML escaping, allowing attackers to store malicious payloads that execute in any administrator's browser upon viewing the mobile dashboard, enabling session cookie theft and account takeover. | ||||
| CVE-2026-64638 | 1 Wordpress | 1 Wordpress | 2026-08-07 | N/A |
| WordPress is vulnerable to a pre-auth reflected XSS vulnerability on the login screen. Via a specially crafted malicious third-party website hosted by an attacker, it is possible for this to be escalated to an RCE vulnerability with conditions outside of the attackers control. This requires successful social engineering of and explicit interaction by the target victim. This issue affects all versions of WordPress. Version 7.0.3 has been released, containing a fix for the vulnerability, and as a courtesy to users on older branches the fix has been backported to all branches back to 4.7. Discovered and responsibly disclosed by [the team at pwn.ai](https://pwn.ai/). | ||||