Export limit exceeded: 47651 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47651 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-65492 | 2 Dokan Wordpress Plugin, Wordpress | 2 Dokan Pro, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions. | ||||
| CVE-2026-65511 | 2 Pixelacehq, Wordpress | 2 Manual - Documentation, Knowledge Base & Education Wordpress Theme, Wordpress | 2026-07-23 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65522 | 2 Pixelacehq, Wordpress | 2 Manual - Documentation, Knowledge Base & Education Wordpress Theme, Wordpress | 2026-07-23 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. | ||||
| CVE-2026-65534 | 2 Charlie Etienne, Wordpress | 2 Custom Links In Elementor Image Carousel, Wordpress | 2026-07-23 | 5.9 Medium |
| Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions. | ||||
| CVE-2026-65538 | 2 Nilo Velez, Wordpress | 2 Machete, Wordpress | 2026-07-23 | 5.9 Medium |
| Author Cross Site Scripting (XSS) in Machete <= 5.2 versions. | ||||
| CVE-2026-65550 | 2 Wordpress, Wpshopmart | 2 Wordpress, Tabs | 2026-07-23 | 5.9 Medium |
| Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions. | ||||
| CVE-2026-48530 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page. | ||||
| CVE-2026-48531 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Retention and Spam Policies page. | ||||
| CVE-2026-48532 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page. | ||||
| CVE-2026-48534 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page. | ||||
| CVE-2026-48535 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page. | ||||
| CVE-2026-48536 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page. | ||||
| CVE-2026-48537 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page. | ||||
| CVE-2026-48538 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings. | ||||
| CVE-2026-48539 | 1 Gfi Software | 1 Gfi Archiver | 2026-07-23 | 5.4 Medium |
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page. | ||||
| CVE-2026-27403 | 2 Nerdpress, Wordpress | 2 Hubbub Lites, Wordpress | 2026-07-23 | 6.5 Medium |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NerdPress Hubbub Lite allows Stored XSS. This issue affects Hubbub Lite: from n/a through 1.36.3. | ||||
| CVE-2026-64628 | 1 Getgrav | 1 Grav | 2026-07-23 | 5.4 Medium |
| Grav contains a stored cross-site scripting vulnerability in shortcode-core attribute handlers where the XSS detection scan only matches payloads containing literal angle brackets, allowing shortcode parameters to bypass validation. Attackers with admin.pages permission can inject malicious JavaScript through shortcode attributes that execute in any viewer's browser, including administrators, enabling session hijacking via admin nonce theft. | ||||
| CVE-2026-65697 | 2026-07-23 | 6.1 Medium | ||
| Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry. | ||||
| CVE-2026-65900 | 1 Cure53 | 1 Dompurify | 2026-07-23 | 6.1 Medium |
| DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected. | ||||
| CVE-2026-56809 | 1 Ricoh | 1 Multiple Laser Printers And Mfps Which Implement Web Image Monitor | 2026-07-23 | N/A |
| Multiple laser printers and MFPs (multifunction printers) which implement Ricoh Web Image Monitor contain a reflected cross-site scripting vulnerability. An arbitrary script may be executed on the web browser of the user who accesses a crafted URL. | ||||