https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 22 Oct 2026 16:09:03 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-41280 cnvd-2022-41280 https://cve.radiocsirt.org/vuln/cnvd-2022-41280 https://cve.radiocsirt.org/vuln/euvd-2026-11125 EUVD-2026-11125 https://cve.radiocsirt.org/vuln/euvd-2026-11125 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0661 <p>The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.</p> <p>The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2022-0661 https://cve.radiocsirt.org/vuln/ghsa-g5jf-j433-qxmq <p>The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.</p> <p>The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading to a stored cross-site scripting (XSS) vulnerability. Further it is also possible to inject PHP code, leading to a Remote Code execution (RCE) vulnerability, even if the DISALLOW_FILE_EDIT and DISALLOW_FILE_MOD constants are both set.</p> https://cve.radiocsirt.org/vuln/ghsa-g5jf-j433-qxmq https://cve.radiocsirt.org/vuln/gsd-2022-0661 gsd-2022-0661 https://cve.radiocsirt.org/vuln/gsd-2022-0661