https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 20:25:26 +0000 https://cve.radiocsirt.org/vuln/cve-2026-8698 <p><strong>Affected:</strong> cryptoprijzen Cryptocurrency Prijsvergelijking Widget</p> <p>The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient output escaping in the as_get_coin_shortcode() function, which renders the &#39;width&#39; (and &#39;height&#39;) shortcode attribute directly into the style attribute of an &lt;iframe&gt; element without applying any escaping function such as esc_attr(). An attacker-controlled value like &#39;100px;&#34;onload=&#34;alert(1)&#34; x=&#34;&#39; terminates the style attribute prematurely and injects an arbitrary HTML attribute into the iframe tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p><strong>Affected:</strong> cryptoprijzen Cryptocurrency Prijsvergelijking Widget</p> <p>The Cryptocurrency Prijsvergelijking Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in version 1.0. This is due to insufficient output escaping in the as_get_coin_shortcode() function, which renders the &#39;width&#39; (and &#39;height&#39;) shortcode attribute directly into the style attribute of an &lt;iframe&gt; element without applying any escaping function such as esc_attr(). An attacker-controlled value like &#39;100px;&#34;onload=&#34;alert(1)&#34; x=&#34;&#39; terminates the style attribute prematurely and injects an arbitrary HTML attribute into the iframe tag. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/cve-2026-8698