https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 17:51:34 +0000 https://cve.radiocsirt.org/vuln/cnvd-2026-06911 cnvd-2026-06911 https://cve.radiocsirt.org/vuln/cnvd-2026-06911 https://cve.radiocsirt.org/vuln/euvd-2026-289819 EUVD-2026-289819 https://cve.radiocsirt.org/vuln/euvd-2026-289819 https://cve.radiocsirt.org/vuln/fkie_cve-2025-15486 <p>The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin&#39;s shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server.</p> <p>The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin&#39;s shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-15486 https://cve.radiocsirt.org/vuln/ghsa-qpqf-m7vq-xvqj <p>The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin&#39;s shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server.</p> <p>The Kunze Law plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin&#39;s shortcode in all versions up to, and including, 2.1 due to the plugin fetching HTML content from a remote server and injecting it into pages without any sanitization or escaping. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. Additional presence of a path traversal vulnerability in the shortcode name allows writing malicious HTML files to arbitrary writable locations on the server.</p> https://cve.radiocsirt.org/vuln/ghsa-qpqf-m7vq-xvqj