#cwe-79

共收录 5328 条相关情报。

← 返回所有主题
漏洞预警2026-11-01 发布LOW

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of the file system/typemill/Models/SvgSanitizer.php. Executing...

CVE-2026-120218

A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of th

来源摘录 · NVD

漏洞预警2026-11-01 发布MEDIUM

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administrators with store update permission to inject scripts by u...

CVE-2026-120248

Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administr

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-11-01 发布LOW

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functionality of the file ui/src/views/submissions/submission-fo...

CVE-2026-120190

A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functio

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows unauthenticated attackers to inject scripts via unescaped ...

CVE-2026-120205

Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows u

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布INFO

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting. The textfield, password_field and ...

CVE-2026-78190

WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions up to, and including, 3.6.0 due to insufficient input san...

CVE-2026-96554

The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in al...

CVE-2026-120114

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' paramet...

CVE-2026-116752

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'products[].post_content' paramet...

CVE-2026-107711

The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all ver...

CVE-2026-104926

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via...

CVE-2026-100151

The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.6.1 due to insufficient input sanitization and outp...

CVE-2026-120075

The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' ...

CVE-2026-119160

The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerab

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2026.0517 via syndicated RSS/Atom feed content. The plugin'...

CVE-2026-110530

The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 20

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI' pa...

CVE-2026-118057

The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerabl

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and includin...

CVE-2026-116535

The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'di

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name (ma...

CVE-2026-111592

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vu

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.2.4. This is d...

CVE-2026-111070

The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scr

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布HIGH

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject (via wp_mail/PHPMailer, e.g. CF7 your-subject)' parame...

CVE-2026-107759

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subje

来源摘录 · NVD / GitHub Advisory

漏洞预警2026-10-31 发布MEDIUM

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Reflect...

CVE-2026-103962

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post

来源摘录 · NVD / GitHub Advisory