Export limit exceeded: 48174 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (48174 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65912 | 1 Cure53 | 1 Dompurify | 2026-07-23 | 6.1 Medium |
| DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated. | ||||
| CVE-2026-65503 | 2 Bdthemes, Wordpress | 2 Utlimate Store Kit Elementor Addons, Wordpress | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. | ||||
| CVE-2026-65903 | 1 Cure53 | 1 Dompurify | 2026-07-23 | 6.1 Medium |
| DOMPurify before 3.4.0 contains a logic error in the ADD_TAGS function where short-circuit evaluation allows forbidden tags to bypass FORBID_TAGS restrictions. Attackers can craft input containing tags listed in FORBID_TAGS that are also added via ADD_TAGS function, causing them to be retained in sanitized output. | ||||
| CVE-2026-57704 | 2 Storeapps, Wordpress | 2 Smart Manager, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Smart Manager <= 8.90.0 versions. | ||||
| CVE-2026-57829 | 1 Ollyo | 1 Helix Ultimate | 2026-07-23 | 6.1 Medium |
| Joomla Extension - joomshaper.com - Unauthenticated stored XSS in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an unauthenticated stored XSS. | ||||
| CVE-2026-15646 | 2 Berocket, Wordpress | 2 Brands For Woocommerce, Wordpress | 2026-07-23 | 6.4 Medium |
| The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-57384 | 2 Membershipsoftware, Wordpress | 2 Wishlist Member X, Wordpress | 2026-07-23 | 6.5 Medium |
| Subscriber Cross Site Scripting (XSS) in WishList Member X <= 3.32.0 versions. | ||||
| CVE-2026-57735 | 2 Soflyy, Wordpress | 2 Breakdance, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Breakdance <= 2.7.1 versions. | ||||
| CVE-2026-57809 | 2 Affiliatewp, Wordpress | 2 Affiliatewp, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in AffiliateWP <= 2.34.0 versions. | ||||
| CVE-2026-65449 | 2 Romancode, Wordpress | 2 Mapsvg, Wordpress | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in MapSVG <= 8.14.0 versions. | ||||
| CVE-2026-65519 | 2 Gt3themes, Wordpress | 2 Photo Gallery, Wordpress | 2026-07-23 | 6.5 Medium |
| Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions. | ||||
| CVE-2026-15145 | 2 Wordpress, Wpdevteam | 2 Wordpress, Essential Addons For Elementor – Popular Elementor Templates & Widgets | 2026-07-23 | 6.4 Medium |
| The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Fancy Text Widget in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-65528 | 2 Bannersky, Wordpress | 2 Bsk Pdf Manager, Wordpress | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions. | ||||
| CVE-2026-57428 | 2 Boldgrid, Wordpress | 2 Sprout Clients, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Sprout Clients <= 3.2.3 versions. | ||||
| CVE-2026-9066 | 2 Wordpress, Wpcompress | 2 Wordpress, Wp Compress | 2026-07-23 | 6.1 Medium |
| The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site. | ||||
| CVE-2026-65470 | 2 Wordpress, Wpmanageninja | 2 Wordpress, Fluent Support | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions. | ||||
| CVE-2026-65914 | 1 Cure53 | 1 Dompurify | 2026-07-23 | 6.1 Medium |
| DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript. | ||||
| CVE-2026-12421 | 2026-07-23 | 7.2 High | ||
| The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-57769 | 2 Themegoods, Wordpress | 2 Grand Photography, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Grand Photography <= 5.7.8 versions. | ||||
| CVE-2026-14481 | 2 Equalizedigital, Wordpress | 2 Equalize Digital Accessibility Checker – Wcag, Ada, Eaa And Section 508 Compliance, Wordpress | 2026-07-23 | 6.4 Medium |
| The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'html' parameter in all versions up to, and including, 1.46.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the attacker to have the ability to edit a post, as the REST endpoint /accessibility-checker/v1/post-scan-results/{id} is guarded only by the edit_post capability on the target post. | ||||