CVE Intelligence
Início / CVEs

Base de CVEs

Vulnerabilidades publicadas, com severidade, exploração conhecida e fontes oficiais.

Severidade
Limpar

9.994 resultado(s)

Exportar esta busca: RSS · CSV · STIX
CVE-2026-62084 Média · 6.5 CWE-79 30/09/2026
WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.
CVE-2026-103388 Média · 6.2 CWE-79 30/09/2026
MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48.
CVE-2026-97298 Média · 6.5 CWE-79 30/09/2026
WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.
CVE-2026-97292 Média · 6.5 CWE-79 30/09/2026
WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability
Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.
CVE-2026-97288 Média · 6.5 CWE-79 30/09/2026
WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.
CVE-2026-97289 Alta · 7.1 CWE-79 30/09/2026
WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.
CVE-2026-97301 Média · 6.5 CWE-79 30/09/2026
WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.
CVE-2026-97286 Média · 6.5 CWE-79 30/09/2026
WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.
CVE-2026-97279 Média · 6.5 CWE-79 30/09/2026
WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.
CVE-2026-97272 Alta · 7.1 CWE-79 30/09/2026
WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.
CVE-2026-97271 Alta · 7.1 CWE-79 30/09/2026
WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.
CVE-2026-97270 Média · 6.5 CWE-79 30/09/2026
WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.
CVE-2026-97266 Média · 6.5 CWE-79 30/09/2026
WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.
CVE-2026-97262 Média · 6.5 CWE-79 30/09/2026
WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.
CVE-2026-97253 Alta · 7.1 CWE-79 30/09/2026
WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0.
CVE-2026-97250 Alta · 7.1 CWE-79 30/09/2026
WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Geo Mashup <= 1.13.21 versions.
CVE-2026-97238 Média · 5.5 CWE-79 30/09/2026
WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in JetEngine <= 3.8.14.3 versions.
CVE-2026-97237 Alta · 7.1 CWE-79 30/09/2026
WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.14.3.
CVE-2026-97236 Média · 6.5 CWE-79 30/09/2026
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-97235 Alta · 7.1 CWE-79 30/09/2026
WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in ThemeREX Addons < 2.45.0 versions.
CVE-2026-97077 Alta · 7.1 CWE-79 30/09/2026
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.18 versions.
CVE-2026-97067 Média · 6.5 CWE-79 30/09/2026
WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.7 versions.
CVE-2026-97065 Alta · 7.1 CWE-79 30/09/2026
WordPress Happyforms plugin <= 1.26.15 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Happyforms <= 1.26.15 versions.
CVE-2026-96836 Alta · 7.1 CWE-79 30/09/2026
WordPress Parsi Date plugin <= 6.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Parsi Date <= 6.3 versions.
CVE-2026-96835 Média · 6.5 CWE-79 30/09/2026
WordPress King Addons for Elementor plugin <= 51.1.85 - Cross Site Scripting (XSS) vulnerability
Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.85 versions.