Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
CVE-2026-66574
Contributor Cross Site Scripting (XSS) in Element Pack Elementor Addons <= 8.8.3 versions.
#cwe-79
共收录 5426 条相关情报。
← 返回所有主题Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
CVE-2026-66573
Contributor Cross Site Scripting (XSS) in JetTabs <= 2.3.3.1 versions.
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
CVE-2026-66572
Contributor Cross Site Scripting (XSS) in JetBlog <= 2.4.10 versions.
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its parameters before reflecting them back in the page, allo...
CVE-2026-91014
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.4.2 does not sanitise and escape some of its
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-lev...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding or updating dictionary entries, allowing unauthenticated u...
CVE-2026-88792
The Dictionary WordPress plugin through 1.0 does not have authorisation, sanitisation or escaping in place when adding o
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputting them inside an inline script, allowing unauthenticate...
CVE-2026-87786
The Dewa Kirim WordPress plugin through 1.0.0 does not escape delivery coordinates submitted at checkout before outputt
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a...
CVE-2026-86788
The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the s
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for the JavaScript context it is later output in on an adminis...
CVE-2026-85130
The WPLP Cookie Consent WordPress plugin before 4.4.4 does not escape a value submitted through a public endpoint for t
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of several directly accessible scripts, allowing unauthenticate...
CVE-2025-15697
The Dictionary WordPress plugin through 1.0 does not escape user input before reflecting it back in the responses of sev
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Shortcode Attributes in all versions up to, ...
CVE-2026-86311
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scrip
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability...
CVE-2026-92590
Craft CMS versions from 5.7.0 before 5.10.13 contain a stored cross-site scripting vulnerability in the Generated Fields
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting...
CVE-2026-92584
AVideo through 29.0 (current revision e01e41ecc) contains a stored cross-site scripting vulnerability. The unauthenticat
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, many djust built-in component template tag...
CVE-2026-61597
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
CVE-2026-58657
## Summary Grav 2.0.0-rc.9 and the current 2.0 branch still allow stored CSS injection through Markdown image media act
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
CVE-2026-63671
## Summary `@nuxtjs/mdc` renders untrusted markdown (including raw HTML) to a Vue component tree. Across two prior advi
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
CVE-2026-61453
## Summary The XSS blueprint validator (`Security::detectXss()`) runs on the **raw page content before Twig processing*
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
CVE-2026-61597
### Impact Many djust built-in component template tags (`djust.components.templatetags.*`) render a developer/user-suppl
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications,...
CVE-2026-92814
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary marku
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary markup injection. Attackers can place malicious markup in moni...
CVE-2026-92814
changedetection.io through 0.60.6 fails to escape the scraped page title in HTML notifications, allowing arbitrary marku