https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 23 Oct 2026 03:05:10 +0000 https://cve.radiocsirt.org/vuln/cnvd-2021-66918 cnvd-2021-66918 https://cve.radiocsirt.org/vuln/cnvd-2021-66918 https://cve.radiocsirt.org/vuln/euvd-2026-23954 EUVD-2026-23954 https://cve.radiocsirt.org/vuln/euvd-2026-23954 https://cve.radiocsirt.org/vuln/fkie_cve-2021-24535 <p>The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it&#39;s settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin&#39;s settings), or both frontend and backend.</p> <p>The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it&#39;s settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin&#39;s settings), or both frontend and backend.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-24535 https://cve.radiocsirt.org/vuln/ghsa-6g8x-82fh-m598 <p>The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it&#39;s settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin&#39;s settings), or both frontend and backend.</p> <p>The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it&#39;s settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin&#39;s settings), or both frontend and backend.</p> https://cve.radiocsirt.org/vuln/ghsa-6g8x-82fh-m598 https://cve.radiocsirt.org/vuln/gsd-2021-24535 gsd-2021-24535 https://cve.radiocsirt.org/vuln/gsd-2021-24535