https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:56:29 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-326454 EUVD-2026-326454 https://cve.radiocsirt.org/vuln/euvd-2026-326454 https://cve.radiocsirt.org/vuln/fkie_cve-2026-9019 <p>The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;grid[properties][borderColor]&#39; and &#39;grid[images][N][attachment_url]&#39; Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress&#39;s unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.</p> <p>The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;grid[properties][borderColor]&#39; and &#39;grid[images][N][attachment_url]&#39; Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress&#39;s unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-9019 https://cve.radiocsirt.org/vuln/ghsa-92m7-mvx5-mh88 <p>The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;grid[properties][borderColor]&#39; and &#39;grid[images][N][attachment_url]&#39; Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress&#39;s unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.</p> <p>The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;grid[properties][borderColor]&#39; and &#39;grid[images][N][attachment_url]&#39; Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress&#39;s unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.</p> https://cve.radiocsirt.org/vuln/ghsa-92m7-mvx5-mh88