Export limit exceeded: 48184 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48184 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2024-32387 | 1 Kerlink | 1 Wirnet Istation 868 Keros | 2026-08-02 | 5.7 Medium |
| An issue in Kerlink Kerlink Wirnet iStation 868 KerOS v.4.3.3_20200803132042 allows a remote attacker to obtain sensitive information via the community string component. | ||||
| CVE-2026-12978 | 2 Funnelkit, Wordpress | 2 Funnelkit, Wordpress | 2026-08-02 | 7.1 High |
| The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted page. The affected action is only registered when the Divi /builder is active. | ||||
| CVE-2026-15794 | 2 Berocket, Wordpress | 2 Grid/list View For Woocommerce, Wordpress | 2026-08-02 | 6.4 Medium |
| The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The shortcode's all_page="1" attribute can be used to force the widget to render on any page, expanding the attack surface beyond shop and category pages. | ||||
| CVE-2026-57373 | 2 Wisetr, Wordpress | 2 Funnel Kit Funnel Builder Pro, Wordpress | 2026-08-02 | 6.5 Medium |
| Customer Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.4 versions. | ||||
| CVE-2026-57374 | 2 Wisetr, Wordpress | 2 Funnel Kit Funnel Builder Pro, Wordpress | 2026-08-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Funnel Kit Funnel Builder PRO <= 3.15.0.7 versions. | ||||
| CVE-2026-65514 | 2 Codepeople, Wordpress | 2 Appointment Hour Booking, Wordpress | 2026-08-02 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions. | ||||
| CVE-2026-65518 | 2 Scott Paterson, Wordpress | 2 Accept Donations With Paypal & Stripe, Wordpress | 2026-08-02 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions. | ||||
| CVE-2026-15665 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Support – Helpdesk & Customer Support Ticket System | 2026-08-02 | 6.4 Medium |
| The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely. | ||||
| CVE-2026-15739 | 2 Widgetpack, Wordpress | 2 Rich Showcase For Google Reviews, Wordpress | 2026-08-02 | 6.4 Medium |
| The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-13605 | 2 Photoswipe, Wordpress | 2 Photoswipe, Wordpress | 2026-08-02 | 6.8 Medium |
| The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfiltered_html capability, an authenticated user with Author-level access can store a JavaScript payload that executes in the browser of any visitor, including an administrator, who clicks the link. | ||||
| CVE-2026-14234 | 2 Wolf, Wordpress | 2 Wolf, Wordpress | 2026-08-02 | 7.1 High |
| The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in stored Cross-Site Scripting. | ||||
| CVE-2026-66418 | 1 Tugcantopaloglu | 1 Openclaw-dashboard | 2026-08-02 | 9.3 Critical |
| OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers, enabling the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instruction file editing and configuration changes. | ||||
| CVE-2026-66421 | 1 Tugcantopaloglu | 1 Openclaw-dashboard | 2026-08-02 | 9.3 Critical |
| OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthorized calls to authenticated administrative endpoints including agent instruction file modification. | ||||
| CVE-2026-18452 | 1 Rich Source | 1 Dms+ (non-mobile) | 2026-08-02 | 10 Critical |
| DMS+ (Non-Mobile) developed by Rich Source has a Use of Hard-coded Credentials vulnerability. Unauthenticated remote attackers can exploit a fixed API key to gain control over all installed DMS+ devices. | ||||
| CVE-2026-65313 | 1 Andritz | 2 250 Scala, Hipase-250 | 2026-08-02 | 8.1 High |
| A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations. | ||||
| CVE-2026-34495 | 2 Johnson Controls, Johnsoncontrols | 3 Fm Systems Employee, Fm Systems Employee, Fms Employee | 2026-08-02 | 5.4 Medium |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1. | ||||
| CVE-2026-7232 | 2 Formcrafts, Wordpress | 2 Formcraft, Wordpress | 2026-08-02 | 7.2 High |
| The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[parameter name]' parameter in all versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit chain combines a server-side gap — where composite matrix sub-field keys such as field2_0 and field2_1 are never passed through the sanitization loop and are stored raw via $wpdb->insert() — with a client-side gap where DOMPurify is only invoked when typeof field.value === 'string', but matrix values arrive from the server as arrays, bypassing the check before being mapped to strings and injected into the DOM. Additionally, the same sink is reachable via a second attack vector: array-typed field values are passed through htmlentities() on submission but later reversed by html_entity_decode() at formcraft-main.php:2608 and :2122, restoring the malicious payload before storage and rendering. | ||||
| CVE-2026-57701 | 2 Webcodingplace, Wordpress | 2 Real Estate Manager, Wordpress | 2026-08-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Real Estate Manager Pro <= 12.8.5 versions. | ||||
| CVE-2026-57767 | 2 Codecabin, Wordpress | 2 Wp Google Maps, Wordpress | 2026-08-02 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in WP Google Maps Pro <= 10.1.02 versions. | ||||
| CVE-2026-59513 | 2 Masteriyo, Wordpress | 2 Masteriyo, Wordpress | 2026-08-02 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in Masteriyo - LMS <= 2.3.0 versions. | ||||