The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming-soon page, allowing users with the Editor role (when the...

CVE-2026-13416

The CMP WordPress plugin before 4.1.18 does not sanitise and escape a settings value before outputting it on the coming

历史摘要 · 未重新核验 · NVD

OpenSTAManager has HTML Injection in modules/utenti/edit.php

CVE-2026-44701

### Summary An HTML Injection vulnerability exists in the user group creation functionality that allows an attacker to i

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates

## Summary Multiple legacy PHP template files in LibreNMS directly output SNMP-sourced and syslog-sourced data into HTM

历史摘要 · 未重新核验 · GitHub Advisory

SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed

CVE-2026-54606

Summary A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the SunEditor Embed plugin. Crafted iframe embed

历史摘要 · 未重新核验 · GitHub Advisory

The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the multiple blocks in all versions up to...

CVE-2026-3002

CVE-2026-3002 是一个影响 WordPress 插件 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem 的存储型跨站脚本（XSS）漏洞。该插件用于增强 W

历史摘要 · 未重新核验 · NVD

The Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frm_user_...

CVE-2026-18331

Formidable Forms 是一款在 WordPress 中广泛使用的表单构建插件，支持联系表单、计算器、测验等多种功能。在其 6.33.1 及之前的所有版本中，发现了一个存储型跨站脚本（XSS）漏洞，编号为 CVE-2026-183

历史摘要 · 未重新核验 · NVD

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP Host Header in all versions up to, and including, 1.5.0 ...

CVE-2026-19760

The WP Fastest Cache – WordPress Cache Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via HTTP

历史摘要 · 未重新核验 · NVD

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users ...

CVE-2026-19226

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputtin

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...

CVE-2026-55805

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...

CVE-2026-15917

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...

CVE-2026-16640

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")...

CVE-2026-16638

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folde

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Stored XSS. This issue affects Drupal core versio...

CVE-2026-55805

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API Autocomplete allows Reflected XSS. This issue affects Sea...

CVE-2026-16640

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Search API

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folders allows Stored XSS. This issue affects Media Folders ve...

CVE-2026-16638

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Media Folde

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core allows Cross-Site Scripting (XSS). This issue affects Dr...

CVE-2026-15917

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core

历史摘要 · 未重新核验 · NVD

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this...

CVE-2026-79793

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown

历史摘要 · 未重新核验 · GitHub Advisory

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/sumit_form.php. Such ma...

CVE-2026-79793

A vulnerability has been found in code-projects Online Shopping System 1.0. Affected by this vulnerability is an unknown

历史摘要 · 未重新核验 · NVD

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without output encoding. The value is emitted in three places on that...

CVE-2026-26211

Ekushey Project Manager CRM stores the administrator-configured system name and writes it to the login page without outp

历史摘要 · 未重新核验 · NVD

Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript

CVE-2026-55596

## Summary The media embed renderer trusts serialized `provider` or `sourceUrl` metadata and skips the URL protocol val

历史摘要 · 未重新核验 · GitHub Advisory