Export limit exceeded: 48024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 48024 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48024 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-14318 | 2 Givewp, Wordpress | 2 Givewp, Wordpress | 2026-07-30 | 6.8 Medium |
| The GiveWP WordPress plugin before 4.16.3 does not escape a donation-form template setting before outputting it in an HTML attribute, allowing users with the GiveWP Worker role and above to inject arbitrary web scripts that execute on the public donation form viewed by any visitor. | ||||
| CVE-2026-59328 | 1 Spring | 1 Spring Tools For Eclipse | 2026-07-30 | 4.2 Medium |
| Spring Tools for Eclipse renders Spring Boot starter wizard dependency tooltips in a native embedded browser (SWT Browser) with JavaScript enabled. Using untrusted and compromised Initializr endpoints for the Spring Boot starter wizard can result in arbitrary script execution inside the embedded browser when a developer hovers a dependency checkbox in the New Spring Starter Project wizard. Impact is limited to in-IDE UI spoofing and outbound network beaconing rather than full code execution. Affected Spring Products and Versions: Spring Tools for Eclipse: 5.2.0 and earlier | ||||
| CVE-2026-14592 | 2 Hitoy, Wordpress | 2 Wp Real Ip-based Access Control, Wordpress | 2026-07-30 | 6.1 Medium |
| The WP Real IP-based Access Control WordPress plugin through 1.3.1 does not perform any capability or nonce checks before storing one of its option values, and does not escape that value on output on its settings page, allowing unauthenticated users to store arbitrary JavaScript that executes in the context of any administrator who views the page. | ||||
| CVE-2026-60646 | 1 Oracle | 1 Webcenter Content | 2026-07-30 | 8 High |
| Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Web Content Management). Supported versions that are affected are 12.2.1.4.0 and 14.1.2.0.0. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle WebCenter Content. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of Oracle WebCenter Content. CVSS 3.1 Base Score 8.0 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). | ||||
| CVE-2026-13330 | 2 Wealcoder, Wordpress | 2 Animation Addons For Elementor, Wordpress | 2026-07-30 | 6.1 Medium |
| The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload_files capability (Author and above) to upload files containing malicious JavaScript, leading to Stored Cross-Site Scripting. | ||||
| CVE-2026-13344 | 2 Wordpress, Wpdevteam | 2 Wordpress, Essential Addons For Elementor | 2026-07-30 | 4.8 Medium |
| The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed (Stored Cross-Site Scripting) when the page is viewed, including in the session of an administrator previewing or visiting the post. | ||||
| CVE-2026-16969 | 1 Dfir-iris | 1 Iris | 2026-07-30 | 7.6 High |
| The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the assets function. | ||||
| CVE-2026-18360 | 1 Dfir-iris | 1 Iris | 2026-07-30 | 7.6 High |
| The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the custom attributes function. | ||||
| CVE-2026-18361 | 1 Dfir-iris | 1 Iris | 2026-07-30 | 7.6 High |
| The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting (XSS) in the datastore upload function. | ||||
| CVE-2026-14207 | 2 Lifterlms, Wordpress | 2 Lifterlms, Wordpress | 2026-07-30 | 6.1 Medium |
| The LifterLMS WordPress plugin before 10.0.10 does not strip event-handler attributes from a course pricing field before storing and rendering it, allowing users with a course-editing role to inject JavaScript that executes in the session of an administrator who views the course. | ||||
| CVE-2026-11881 | 2 Fluent Forms, Wordpress | 2 Fluent Forms, Wordpress | 2026-07-30 | 6.1 Medium |
| The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor (with delegated form-management permission, and therefore lacking the unfiltered_html capability, e.g. in a multisite setup) to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor who loads the form, including administrators previewing it. | ||||
| CVE-2026-15928 | 1 Xmlrpc-c | 1 Xmlrpc-c | 2026-07-30 | 7.4 High |
| XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. | ||||
| CVE-2026-3093 | 1 Gitlab | 1 Gitlab | 2026-07-29 | 4.7 Medium |
| GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper sanitization of user-controlled input. | ||||
| CVE-2026-66490 | 1 Balbooa.com | 1 Gridbox Extension For Joomla | 2026-07-29 | 6.1 Medium |
| Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2 | ||||
| CVE-2026-17162 | 2 Wordpress, Wpxpo | 2 Wordpress, Wowstore – Store Builder & Product Blocks For Woocommerce | 2026-07-29 | 6.4 Medium |
| The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-16597 | 2 Duracelltomi, Wordpress | 2 Gtm4wp – A Google Tag Manager (gtm) Plugin For Wordpress, Wordpress | 2026-07-29 | 7.2 High |
| The GTM4WP – A Google Tag Manager (GTM) plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the GTM4WP WooCommerce order data integration option (GTM4WP_OPTION_INTEGRATE_WCORDERDATA) to be enabled, and is exploited by placing a guest checkout order with a JavaScript payload in a WooCommerce billing field such as the billing first name. | ||||
| CVE-2026-8791 | 2 Ameliabooking, Wordpress | 2 Booking System Trafft, Wordpress | 2026-07-29 | 6.4 Medium |
| The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `bookingWebsiteUrl` setting in all versions up to, and including, 1.0.17 due to a missing capability check on the `set_options` AJAX action when the plugin is operating in agency mode. The `trafftSetOptions()` handler verifies a nonce that is exposed to any authenticated user (it is printed inline on every admin page, including profile.php) but performs no capability check before calling `update_option('trafft_option', ['bookingWebsiteUrl' => ...])`. This setting is then used by `trafftAdminAssets()` to enqueue `<bookingWebsiteUrl>/embed.js` as a script on every front-end page that renders the booking shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to point the embed-script URL at an attacker-controlled origin and execute arbitrary JavaScript in the browser of every site visitor (including admins). | ||||
| CVE-2026-14358 | 1 Wikimedia | 1 Mediawiki-charts Extension | 2026-07-29 | N/A |
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in The Wikimedia Foundation Mediawiki - Charts Extension allows Cross-Site Scripting (XSS). This issue affects Mediawiki - Charts Extension: from * before 1.43.9,1.44.6,1.45.4. | ||||
| CVE-2026-55661 | 2 Tina, Tinacms | 2 Tinacms, Tinacms/mdx | 2026-07-29 | N/A |
| Tina is a headless content management system. In versions prior to @tinacms/mdx 2.1.7 and tinacms 3.9.3, rich-text parsing and the default link/image renderers did not sanitize the url field on Slate link/image nodes. Content containing javascript: or data:text/html URLs — including case-variant, whitespace-padded, and control-character-obfuscated forms — is rendered into href/src and executes when the content is viewed. Any actor able to author rich-text content (for example a lower-privileged editor, or imported/external content) can achieve stored XSS against editors and site viewers. This issue is fixed in versions @tinacms/mdx 2.1.7 and tinacms 3.9.3. | ||||
| CVE-2026-55660 | 2 Tina, Tinacms | 2 Tinacms, Tinacms/app | 2026-07-29 | N/A |
| Tina is a headless content management system. In versions prior to @tinacms/app 2.5.6 and tinacms 3.9.3, cross-origin postMessage handlers and a rich-text URL-sanitization bypass enable stored XSS and session takeover. The library registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and the admin↔preview iframe GraphQL reducer — that act on event.data without verifying event.origin or event.source and post messages using non-specific target origins, while insufficient URL sanitization in rich-text content allows malicious URLs to persist and execute. A page the victim visits (or a window in an opener/iframe relationship with a Tina admin) can forge messages to drive the editor, inject preview content, or observe/forge the OAuth popup channel to take over an authenticated editing session. This issue has been fixed in versions @tinacms/app 2.5.6 and tinacms 3.9.3. | ||||