https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 04:57:18 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-16306 cnvd-2025-16306 https://cve.radiocsirt.org/vuln/cnvd-2025-16306 https://cve.radiocsirt.org/vuln/euvd-2026-284142 EUVD-2026-284142 https://cve.radiocsirt.org/vuln/euvd-2026-284142 https://cve.radiocsirt.org/vuln/fkie_cve-2025-6944 <p>The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;uncode_hl_text&#39; and &#39;uncode_text_icon&#39; shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;uncode_hl_text&#39; and &#39;uncode_text_icon&#39; shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-6944 https://cve.radiocsirt.org/vuln/ghsa-qqj8-fpcc-c8fr <p>The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;uncode_hl_text&#39; and &#39;uncode_text_icon&#39; shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The Uncode Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s &#39;uncode_hl_text&#39; and &#39;uncode_text_icon&#39; shortcodes in all versions up to, and including, 2.9.4.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/ghsa-qqj8-fpcc-c8fr