The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, ...

CVE-2026-15253

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting

历史摘要 · 未重新核验 · NVD

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a fi...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG

历史摘要 · 未重新核验 · NVD

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesh...

CVE-2026-14287

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated requ

历史摘要 · 未重新核验 · NVD

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

CVE-2026-66358

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script.

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...

CVE-2026-66603

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...

CVE-2026-27365

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Publi

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affect...

CVE-2026-66591

CVE-2026-66591 是一个影响 David Lingren 开发的 WordPress 插件 Media Library Assistant 的存储型跨站脚本（Stored XSS）漏洞。该漏洞源于插件在生成网页时未正确中和用户输

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects Pub...

CVE-2026-27365

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Publi

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue af...

CVE-2026-66603

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Artiss Draft

历史摘要 · 未重新核验 · NVD

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until version 2.6.0, the wyzie-open-redeem IPC handler in index.js c...

CVE-2026-52873

Streambert is a cross-platform Electron Desktop App to stream and download video content. From version 2.5.0 until versi

历史摘要 · 未重新核验 · NVD

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to version 12.1.3, the display_map parser function in the Leafle...

CVE-2026-52854

Maps is a MediaWiki extension that enables visualization of geographic data through dynamic embedded maps. Prior to vers

历史摘要 · 未重新核验 · NVD

LibreNMS: SSRF-driven stored XSS via Oxidized API response fields in device showconfig page

### Summary The Oxidized integration URL (`oxidized.url`) is admin-configurable. LibreNMS fetches device info and versio

历史摘要 · 未重新核验 · GitHub Advisory

LibreNMS: Stored XSS via graph_descr admin config settings echoed without escaping to all authenticated users

### Summary The `graph_descr.` family of settings is echoed verbatim without `htmlspecialchars()` in `includes/html/page

历史摘要 · 未重新核验 · GitHub Advisory

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZones.php can contain HTML special chara...

CVE-2026-54347

Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Ap

历史摘要 · 未重新核验 · NVD

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inj...

CVE-2026-41921

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase sugges

历史摘要 · 未重新核验 · NVD

Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover

CVE-2026-54347

### Summary A stored Cross-Site Scripting (XSS) vulnerability in Froxlor's DNS editor allows an authenticated user with

历史摘要 · 未重新核验 · GitHub Advisory

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via p...

CVE-2025-9211

Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 al

历史摘要 · 未重新核验 · NVD

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca9c, a malicious value submitted through feedback_message[...

CVE-2026-61696

Forem is open source software for building communities. In versions before commit 92eacd16a82cf9007ba8e16a2258b42e3b53ca

历史摘要 · 未重新核验 · NVD

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including ...

CVE-2026-52609

A reflected cross-site scripting (XSS) vulnerability in reportico-web <= 8.1.0 allows remote attackers to execute arbitr

历史摘要 · 未重新核验 · NVD