https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 12:12:21 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-284389 EUVD-2026-284389 https://cve.radiocsirt.org/vuln/euvd-2026-284389 https://cve.radiocsirt.org/vuln/fkie_cve-2025-13308 <p>The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;reject_url&#39; parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the &#34;No, I do not approve of this connection&#34; button, granted they can successfully trick the victim into performing an action such as clicking on a link.</p> <p>The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;reject_url&#39; parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the &#34;No, I do not approve of this connection&#34; button, granted they can successfully trick the victim into performing an action such as clicking on a link.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-13308 https://cve.radiocsirt.org/vuln/ghsa-fwgp-xx7q-2jwf <p>The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;reject_url&#39; parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the &#34;No, I do not approve of this connection&#34; button, granted they can successfully trick the victim into performing an action such as clicking on a link.</p> <p>The Application Passwords plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the &#39;reject_url&#39; parameter in all versions up to, and including, 0.1.3. This is due to insufficient input sanitization and output escaping on user supplied URLs, which allows javascript: URI schemes to be embedded in the reject_url parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks the &#34;No, I do not approve of this connection&#34; button, granted they can successfully trick the victim into performing an action such as clicking on a link.</p> https://cve.radiocsirt.org/vuln/ghsa-fwgp-xx7q-2jwf