https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 27 Oct 2026 20:21:16 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-287077 EUVD-2026-287077 https://cve.radiocsirt.org/vuln/euvd-2026-287077 https://cve.radiocsirt.org/vuln/fkie_cve-2026-4025 <p>The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;align&#39; shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the &#39;align&#39; attribute. Specifically, the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;align&#39; shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the &#39;align&#39; attribute. Specifically, the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-4025 https://cve.radiocsirt.org/vuln/ghsa-3w3c-w6r8-vrjc <p>The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;align&#39; shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the &#39;align&#39; attribute. Specifically, the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The PrivateContent Free plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;align&#39; shortcode attribute in the [pc-login-form] shortcode in all versions up to, and including, 1.2.0. This is due to insufficient input sanitization and output escaping on the &#39;align&#39; attribute. Specifically, the attribute value flows from the shortcode through pc_login_form() to pc_static::form_align(), where it is directly concatenated into an HTML class attribute without esc_attr() or any escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://cve.radiocsirt.org/vuln/ghsa-3w3c-w6r8-vrjc