tag
Xss
WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell")
CVE-2026-64638 — nicknamed XSS2Shell by its discoverers at pwn.ai — is a pre-authentication reflected XSS in the WordPress login page that chains through five to seven stages into full remote code execution on the server. It is one of the most impactful…
WordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594)
The "List Site Contributors" WordPress plugin reflects the alpha query parameter into page output without sanitization, allowing an attacker to inject arbitrary HTML/JavaScript that executes in a victim's browser when they visit a crafted link. The included…
OWASP CoreRuleSet Multipart Charset WAF Bypass (CVE-2026-21876)
CVE-2026-21876 is a bypass in the OWASP Core Rule Set (CRS) rule 922110, which is meant to block multipart/form-data parts that declare a forbidden (non-ASCII-safe) character set such as IBM037/EBCDIC. The rule only inspects the charset of the last part in a…
oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)
oRPC's OpenAPI reference plugin renders the generated API docs page by embedding the OpenAPI spec directly into an inline <script id="spec" type="application/json"> block using JSON.stringify(spec), with no HTML-context encoding. Because JSON.stringify() does…
OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)
OpenSTAManager fails to sanitize the righe GET parameter before reflecting it into a hidden HTML input's value attribute across six modificaiva.php modal files (contracts, quotes, invoices, DDT, orders, and interventions modules). Because the parameter is…
NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)
The NextScripts Social Networks Auto-Poster plugin for WordPress fails to sanitize or escape the snapFB post-meta value that backs its [nxsfbembed] shortcode. A user with Contributor-level access (or higher) can store arbitrary JavaScript in this field when…
Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406)
The Gravity Forms WordPress plugin (<= 2.9.28) reflects the formids array values from the args parameter of the gformgetconfig AJAX action verbatim into its HTTP response, which is served with Content-Type: text/html; charset=UTF-8. Because the value is…
BentoPDF Stored XSS to File Exfiltration (CVE-2026-41653)
BentoPDF's Markdown-to-PDF tool renders user-supplied Markdown through markdown-it with html: true enabled and injects the resulting HTML directly into the DOM via innerHTML, with no sanitizer (e.g. DOMPurify) in between. A crafted .md file containing an <img…
FirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition
FirefUXSS is a universal XSS issue in Firefox Focus for iOS where redirect-scheme validation can be bypassed via a race condition. A burst of benign redirects can desynchronize validation from navigation commit, allowing a final javascript: redirect to…
Next.js CSP Nonce Cache-Poisoned XSS (CVE-2026-44581)
CVE-2026-44581 is a reflected XSS issue in Next.js App Router nonce handling. Malformed nonce values from a Content-Security-Policy request header can be reflected into rendered HTML script attributes without safe attribute-context escaping. In caching…
Next.js beforeInteractive Script XSS (CVE-2026-44580)
CVE-2026-44580 is an XSS vulnerability in Next.js next/script rendering for beforeInteractive scripts. Vulnerable versions serialize script props with JSON.stringify and inject them into inline HTML via dangerouslySetInnerHTML without safe HTML escaping for…