https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 23:35:34 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-290228 EUVD-2026-290228 https://cve.radiocsirt.org/vuln/euvd-2026-290228 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3574 <p>The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s settings fields (including &#39;Navigation Font Size&#39;, &#39;Navigation Font Weight&#39;, &#39;Heading Font Size&#39;, &#39;Heading Font Weight&#39;, &#39;Text Font Size&#39;, and &#39;Text Font Weight&#39;) in all versions up to and including 1.0.4. This is due to insufficient input sanitization (no sanitize callback in register_setting()) and missing output escaping (no esc_attr() in the field_callback() printf output) on user-supplied values. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.</p> <p>The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s settings fields (including &#39;Navigation Font Size&#39;, &#39;Navigation Font Weight&#39;, &#39;Heading Font Size&#39;, &#39;Heading Font Weight&#39;, &#39;Text Font Size&#39;, and &#39;Text Font Weight&#39;) in all versions up to and including 1.0.4. This is due to insufficient input sanitization (no sanitize callback in register_setting()) and missing output escaping (no esc_attr() in the field_callback() printf output) on user-supplied values. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-3574 https://cve.radiocsirt.org/vuln/ghsa-7mrh-c2jm-p6fw <p>The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s settings fields (including &#39;Navigation Font Size&#39;, &#39;Navigation Font Weight&#39;, &#39;Heading Font Size&#39;, &#39;Heading Font Weight&#39;, &#39;Text Font Size&#39;, and &#39;Text Font Weight&#39;) in all versions up to and including 1.0.4. This is due to insufficient input sanitization (no sanitize callback in register_setting()) and missing output escaping (no esc_attr() in the field_callback() printf output) on user-supplied values. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.</p> <p>The Experto Dashboard for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin&#39;s settings fields (including &#39;Navigation Font Size&#39;, &#39;Navigation Font Weight&#39;, &#39;Heading Font Size&#39;, &#39;Heading Font Weight&#39;, &#39;Text Font Size&#39;, and &#39;Text Font Weight&#39;) in all versions up to and including 1.0.4. This is due to insufficient input sanitization (no sanitize callback in register_setting()) and missing output escaping (no esc_attr() in the field_callback() printf output) on user-supplied values. This makes it possible for authenticated attackers, with Administrator-level access and above, to inject arbitrary web scripts in the plugin settings page that will execute whenever a user accesses the settings page. This only affects multi-site installations and installations where unfiltered_html has been disabled.</p> https://cve.radiocsirt.org/vuln/ghsa-7mrh-c2jm-p6fw