Base de CVEs

CVE-2025-15692 Baixa · 3.5 CWE-79 02/09/2026

Icegram Express < 5.8.6 - Admin+ Stored XSS

The Icegram Express WordPress plugin before 5.8.6 does not properly escape a list description setting before outputting it within an HTML attribute, which could allow users with the Administrator role and above to perform Stored Cross-Site Scripting attacks.

CVE-2024-3773 Média · 5.9 CWE-79 02/09/2026

LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

CVE-2026-81201 Média · 6.1 CWE-79 02/09/2026

Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3.

CVE-2026-81167 Média · 4.8 CWE-79 02/09/2026

Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Address Suggestion allows Cross-Site Scripting (XSS). This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25.

CVE-2026-81160 Média · 6.1 CWE-79 02/09/2026

Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0.

CVE-2026-76759 Alta · 7.3 CWE-79 02/09/2026

Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102

Vulnerability in Drupal Screenshot. This issue affects Screenshot versions: *.*.

CVE-2026-18986 Média · 4.8 CWE-79 02/09/2026

Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0.

CVE-2026-84803 Crítica · 9.0 CWE-79 02/09/2026

SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist

SiYuan before v3.8.2 contains a stored cross-site scripting vulnerability in asset serving due to an incomplete extension blocklist that misses script-capable file types. Attackers can upload files with extensions like .xht, .ehtml, .xsl, .xbl, or .rdf that resolve to executable media types and execute JavaScript to steal API tokens and compromise workspaces.

CVE-2026-84793 Média · 4.8 CWE-79 02/09/2026

Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages.

CVE-2026-84781 Média · 6.5 CWE-79 02/09/2026

WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.4 versions.

CVE-2026-83562 Média · 6.5 CWE-79 02/09/2026

WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.

CVE-2026-81775 Alta · 7.1 CWE-79 02/09/2026

WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Estatik <= 4.3.4 versions.

CVE-2026-81771 Alta · 7.1 CWE-79 02/09/2026

WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in TrustedSite <= 1.2.5 versions.

CVE-2026-81770 Alta · 7.1 CWE-79 02/09/2026

WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Interactive Geo Maps <= 1.6.30 versions.

CVE-2026-81289 Alta · 7.1 CWE-79 02/09/2026

WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.13.1 versions.

CVE-2026-81288 Alta · 7.1 CWE-79 02/09/2026

WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Upsell Order Bump Offer for WooCommerce <= 3.1.5 versions.

CVE-2026-75528 Alta · 7.2 CWE-79 02/09/2026

Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log

The Broken Link Checker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author URL / Link Log in all versions up to, and including, 2.4.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to perform the plugin's standard dismiss-and-recheck workflow on a link submitted by the attacker via the WordPress comment author URL field, after which the attacker's HTTP server issues a redirect to a URL containing an HTML/JavaScript payload that is stored verbatim in the link log.

CVE-2025-7963 Média · 6.4 CWE-79 02/09/2026

Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function

The Easy Waveform Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the shortcode_easywaveformplayer() function in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-82883 Alta · 7.1 CWE-79 02/09/2026

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1.

CVE-2026-3850 Média · 6.4 CWE-79 02/09/2026

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the `redirect_url` parameter of the `et_pb_contact_form` shortcode in all versions up to, and including, 4.27.6. This is due to the `redirect_url` attribute being sanitized with `esc_attr()` instead of `esc_url()` before being rendered into the `data-redirect_url` HTML data attribute. Additionally, `redirect_url` is absent from the hardcoded `$url_options` array in `class-et-builder-element.php`, so it does not receive `esc_url_raw()` sanitization during shortcode parsing. After a successful form submission, client-side JavaScript reads this data attribute and passes it directly to `window.location.href`, executing arbitrary JavaScript from a `javascript:` URI. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that execute whenever a user submits the contact form.

CVE-2026-81807 Alta · 8.8 CWE-79 02/09/2026

Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification

The Simple Ajax Chat WordPress plugin before 20260827 does not escape chat message content before rendering it, allowing unauthenticated users to inject arbitrary HTML attributes into the page and run scripts in the browser of anyone viewing the chat, including administrators.

CVE-2026-81737 Alta · 8.8 CWE-79 02/09/2026

FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information

The FAQ Builder AYS WordPress plugin before 1.8.5 does not sanitize or escape content submitted by unauthenticated visitors before storing it and outputting it in an admin area page, and the escaping it does apply is undone by a subsequent decoding step, leading to Stored XSS which will execute in the context of a logged in administrator.

CVE-2026-77792 Alta · 7.5 CWE-79 02/09/2026

RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field

The RegistrationMagic WordPress plugin before 6.0.9.9 does not escape a registration form field value before outputting it in an HTML attribute on an administrative page, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

CVE-2026-19723 Alta · 7.1 CWE-79 02/09/2026

Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.

CVE-2026-19719 Média · 6.8 CWE-79 02/09/2026

Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when a visitor interacts with the affected button. Exploitation requires the Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 to be running a non-default icon display configuration.