A Cross-site Scripting (XSS) vulnerability exists in the VikWidgetsLoader WordPress plugin before version 1.12.3. The plugin fails to properly sanitize or escape certain block attributes before outputting them in HTML attributes. This flaw allows users with the Contributor role to inject arbitrary JavaScript code that executes in the browsers of users viewing the affected posts, including administrators and editors reviewing submissions.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the All-in-One Video Gallery WordPress plugin versions before 5.0.0. The plugin fails to properly validate and escape certain shortcode attributes, allowing users with contributor role or higher to inject malicious scripts that are stored and executed when the shortcode is rendered in pages or posts.
A Server-Side Request Forgery (SSRF) vulnerability exists in the Stape Conversion Tracking WordPress plugin versions 2.3.0 through 2.3.10. The plugin fails to validate sub-paths appended to its same-origin proxy upstream endpoint, allowing unauthenticated attackers to redirect server-side requests to arbitrary hosts, including internal and loopback addresses. This can lead to SSRF and Cross-Site Scripting (XSS) due to the response body and content type being returned from the site's origin with security headers stripped. The issue is fixed in version 2.3.11.
A stored cross-site scripting (XSS) vulnerability exists in the Text Typing WordPress plugin versions before 2.2.2. This flaw allows users with Contributor role or higher to inject malicious scripts via a block attribute that is not properly sanitized or escaped. The injected script executes in the browsers of users viewing the affected page.
A cross-site scripting (XSS) vulnerability exists in the Enable Media Replace WordPress plugin versions before 4.2.3. The flaw occurs because replaced media files are not processed through the WordPress upload pipeline, bypassing the SVG sanitizer prefilter. This allows an authenticated user with upload permissions to upload an SVG file containing malicious script that executes when the file is opened directly. The vulnerability requires the SVG-enabling feature of the plugin to be active.
A reflected cross-site scripting (XSS) vulnerability exists in the Duplicator WordPress plugin versions before 5.1.0. The flaw arises because the plugin does not properly sanitize and escape a parameter before reflecting it on an administrative page. This vulnerability can be exploited if a logged-in administrator is tricked into opening a crafted link, allowing execution of arbitrary scripts in their session.
A stored cross-site scripting (XSS) vulnerability exists in the SEOPress WordPress plugin versions before 10.4. The plugin fails to properly sanitize and escape certain analytics tracking settings before outputting them in an inline script on every front-end page. This flaw allows users with a specific SEOPress capability, which can be delegated by an administrator to lower-privileged roles, to inject malicious scripts that execute in the browsers of any site visitor, including logged-in administrators viewing the front end.
A cross-site scripting (XSS) vulnerability exists in the Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before version 2.4.29. Users with author-level access or higher can inject arbitrary JavaScript into form button configurations, which executes in the browser of any user clicking the button, including administrators.
Form Maker by 10Web WordPress plugin versions before 1.15.51 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated users to submit malicious scripts that execute in the administrator's browser when viewing form submissions. The issue arises from inconsistent escaping of user-submitted field values on the submissions admin page. A fixed version 1.15.51 is available to address this vulnerability.
A cross-site scripting (XSS) vulnerability exists in the CookieYes WordPress plugin versions before 3.5.8. This flaw allows users with the Contributor role to inject JavaScript into cookie-category script fields without proper sanitization or escaping. The injected script executes in the browsers of site visitors and administrators reviewing the content.
A cross-site scripting (XSS) vulnerability exists in CGI for Perl versions before 5.00. The flaw arises because arguments are inserted between HTML comment tags without proper escaping, allowing text containing the sequence '-->' to prematurely close the comment and inject arbitrary HTML. This can lead to HTML injection in applications that pass request data into comments.
A cross-site scripting (XSS) vulnerability exists in CGI versions from 4.62 up to but not including 5.00 for Perl. The flaw arises because the URL returned by the url and self_url methods can contain a raw apostrophe due to how URI's canonical method processes it. This raw apostrophe can appear in single-quoted HTML attributes or JavaScript strings, enabling XSS attacks. The issue is fixed in version 5.00.
CVE-2026-121733 is a stored cross-site scripting (XSS) vulnerability in Webkul Bagisto versions prior to 2.4.5. Authenticated customers can upload HTML files without validation via the RMA send-message endpoint. These HTML files can contain JavaScript that executes in the shop's origin when accessed by an administrator. The issue is fixed in version 2.4.5.