https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 13:54:17 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292031 EUVD-2026-292031 https://cve.radiocsirt.org/vuln/euvd-2026-292031 https://cve.radiocsirt.org/vuln/fkie_cve-2026-6439 <p>The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The &#39;lang&#39; POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a &lt;textarea&gt; element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.</p> <p>The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The &#39;lang&#39; POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a &lt;textarea&gt; element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-6439 https://cve.radiocsirt.org/vuln/ghsa-gc8m-6q8j-fh75 <p>The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The &#39;lang&#39; POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a &lt;textarea&gt; element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.</p> <p>The VideoZen plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 1.0.1. This is due to insufficient input sanitization and output escaping in the videozen_conf() function. The &#39;lang&#39; POST parameter is stored directly via update_option() without any sanitization, and later echoed inside a &lt;textarea&gt; element without applying esc_textarea() or any equivalent escaping function. This makes it possible for authenticated attackers with Administrator-level access and above to inject arbitrary web scripts into the plugin settings page that will execute whenever any user accesses that page.</p> https://cve.radiocsirt.org/vuln/ghsa-gc8m-6q8j-fh75