https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:47:50.247855+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2024-03714 bdu:2024-03714 2026-10-03T16:47:50.345193+00:00 bdu:2024-03714 https://cve.radiocsirt.org/vuln/bit-wordpress-2024-4439 BIT-wordpress-2024-4439 2026-10-03T16:47:50.345246+00:00

Affected: Bitnami: wordpress

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

 https://cve.radiocsirt.org/vuln/euvd-2026-2559 EUVD-2026-2559 2026-10-03T16:47:50.345297+00:00 EUVD-2026-2559 https://cve.radiocsirt.org/vuln/fkie_cve-2024-4439 fkie_cve-2024-4439 2026-10-03T16:47:50.345322+00:00

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

 https://cve.radiocsirt.org/vuln/ghsa-682x-vcqv-v7v6 GHSA-682x-vcqv-v7v6 2026-10-03T16:47:50.345363+00:00

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2024-4439 UBUNTU-CVE-2024-4439 2026-10-03T16:47:50.345392+00:00

Affected: Ubuntu:16.04:LTS: wordpress, Ubuntu:18.04:LTS: wordpress, Ubuntu:20.04:LTS: wordpress, Ubuntu:22.04:LTS: wordpress, Ubuntu:24.04:LTS: wordpress

WordPress Core is vulnerable to Stored Cross-Site Scripting via user display names in the Avatar block in various versions up to 6.5.2 due to insufficient output escaping on the display name. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. In addition, it also makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that have the comment block present and display the comment author's avatar.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2024-1060 WID-SEC-W-2024-1060 — WordPress: Schwachstelle ermöglicht Cross-Site Scripting 2026-10-03T16:47:50.345439+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in WordPress ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen.