Export limit exceeded: 21566 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 51450 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (51450 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116887 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 5.4 Medium |
| Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with page-edit rights to inject HTML through Keyword-typed property values rendered unescaped on Special:Browse. Attackers can annotate a Keyword property with an event-handler payload that executes JavaScript in viewers' sessions, including administrators, to read tokens and perform actions. | ||||
| CVE-2026-116883 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 4.8 Medium |
| Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticated schema editors to inject HTML through schema descriptions. Attackers with the smw-schemaedit permission can save HTML that is passed unescaped to Html::rawElement() in HtmlBuilder, altering pages and targeting users who view the schema. | ||||
| CVE-2026-116875 | 1 Semantic-mediawiki | 1 Semantic Mediawiki | 2026-11-04 | 6.1 Medium |
| SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which outputs separator parameters (sep, propsep, valuesep, delim, separator) without HTML escaping in list, category, DSV, and CSV result printers. Unauthenticated attackers can send victims crafted Special:Ask links using request_type=raw or request_type=special_page to execute JavaScript in the wiki's origin, stealing sessions or CSRF tokens. | ||||
| CVE-2026-97397 | 2026-11-04 | 7.2 High | ||
| The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the plugin's Remove mode to be active and the malicious comment to be published, either through auto-approval for known commenters or manual moderator approval. | ||||
| CVE-2026-62007 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.26. | ||||
| CVE-2026-57666 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1. | ||||
| CVE-2026-57639 | 2 Roland Murg, Wordpress-extensions | 2 Wp Booking System, Wp Booking System | 2026-11-04 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP Booking System wp-booking-system allows Reflected XSS.This issue affects WP Booking System: from n/a through 2.1.0.6. | ||||
| CVE-2026-54861 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1. | ||||
| CVE-2026-54851 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3. | ||||
| CVE-2026-119477 | 2 Jacob N. Breetvelt, Wordpress-extensions | 2 Wp Photo Album Plus, Wp Photo Album Plus | 2026-11-04 | 7.1 High |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Stored XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.05.003. | ||||
| CVE-2026-115507 | 1 Vikunja | 1 Vikunja | 2026-11-04 | 3.5 Low |
| Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members. | ||||
| CVE-2026-82161 | 1 Dell | 1 Wyse Management Suite | 2026-11-04 | 6.8 Medium |
| Dell Wyse Management Suite, versions prior to 2609.0.0.155, contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Script injection. | ||||
| CVE-2026-119468 | 2026-11-04 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2. | ||||
| CVE-2026-118983 | 2026-11-04 | 6.8 Medium | ||
| The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission. | ||||
| CVE-2026-118783 | 2026-11-04 | 6.8 Medium | ||
| The All-in-One Video Gallery WordPress plugin before 5.0.0 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. | ||||
| CVE-2026-115250 | 2026-11-04 | 6.8 Medium | ||
| The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page. | ||||
| CVE-2026-114431 | 1 Wordpress-extensions | 1 Enable Media Replace | 2026-11-04 | 6.4 Medium |
| The Enable Media Replace WordPress plugin before 4.2.3 does not pass a replaced media file through the WordPress upload pipeline, so the upload prefilter that SVG-sanitizer Enable Media Replace WordPress plugin before 4.2.3 rely on never runs, allowing an authenticated user with upload access to store an SVG file containing script that executes when the file is opened directly. It requires an SVG-enabling Enable Media Replace WordPress plugin before 4.2.3 to be active, as the replace path otherwise rejects SVG uploads. | ||||
| CVE-2026-112243 | 2026-11-04 | 5.8 Medium | ||
| The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link. | ||||
| CVE-2026-108041 | 1 Wordpress-extensions | 1 Seopress | 2026-11-04 | 7.1 High |
| The SEOPress WordPress plugin before 10.4 does not sanitise and escape some of its analytics tracking settings before outputting them in an inline script printed on every front-end page, allowing users granted a SEOPress WordPress plugin before 10.4 capability that an administrator can delegate to lower-privileged roles to perform Stored Cross-Site Scripting attacks that execute in the browser of any site visitor, including a logged-in administrator viewing the front end. | ||||
| CVE-2026-106649 | 2026-11-04 | 6.8 Medium | ||
| The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.29 does not prevent users with author-level access and above from storing arbitrary JavaScript in a form button configuration, which is later output into a JavaScript execution context and runs in the browser session of any user who clicks the button, including an administrator. | ||||