https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 11:14:49 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-09805 cnvd-2021-09805 https://cve.radiocsirt.org/vuln/cnvd-2021-09805 https://cve.radiocsirt.org/vuln/euvd-2026-334204 EUVD-2026-334204 https://cve.radiocsirt.org/vuln/euvd-2026-334204 https://cve.radiocsirt.org/vuln/fkie_cve-2020-28707 <p>The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the &#34;e&#34; variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,&#39;*&#39;) for that object.</p> <p>The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the &#34;e&#34; variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,&#39;*&#39;) for that object.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2020-28707 https://cve.radiocsirt.org/vuln/ghsa-8rwm-vgc4-5hgx <p>The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the &#34;e&#34; variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,&#39;*&#39;) for that object.</p> <p>The Stockdio Historical Chart plugin before 2.8.1 for WordPress is affected by Cross Site Scripting (XSS) via stockdio_chart_historical-wp.js in wp-content/plugins/stockdio-historical-chart/assets/ because the origin of a postMessage() event is not validated. The stockdio_eventer function listens for any postMessage event. After a message event is sent to the application, this function sets the &#34;e&#34; variable as the event and checks that the types of the data and data.method are not undefined (empty) before proceeding to eval the data.method received from the postMessage. However, on a different website. JavaScript code can call window.open for the vulnerable WordPress instance and do a postMessage(msg,&#39;*&#39;) for that object.</p> https://cve.radiocsirt.org/vuln/ghsa-8rwm-vgc4-5hgx https://cve.radiocsirt.org/vuln/gsd-2020-28707 gsd-2020-28707 https://cve.radiocsirt.org/vuln/gsd-2020-28707