https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 13 Oct 2026 03:00:17 +0000 https://cve.radiocsirt.org/vuln/cve-2026-6404 <p><strong>Affected:</strong> simonholliday Anomify AI – Anomaly Detection and Alerting</p> <p>The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;anomify_api_key&#39; parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value=&#34;...&#34;) without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin&#39;s settings page.</p> <p><strong>Affected:</strong> simonholliday Anomify AI – Anomaly Detection and Alerting</p> <p>The Anomify AI – Anomaly Detection and Alerting plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;anomify_api_key&#39; parameter in versions up to and including 0.3.6. This is due to insufficient input sanitization and missing output escaping: the plugin applies sanitize_text_field() to the Metric Data Key input before saving it via update_option(), but sanitize_text_field() strips HTML tags without encoding double-quote characters, and the value is then echoed directly into an HTML attribute context (value=&#34;...&#34;) without esc_attr(). This makes it possible for authenticated attackers with administrator-level access to inject arbitrary web scripts that execute whenever a user visits the plugin&#39;s settings page.</p> https://cve.radiocsirt.org/vuln/cve-2026-6404