Monthly
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.