https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 12:07:27 +0000 https://cve.radiocsirt.org/vuln/cve-2026-10738 <p><strong>Affected:</strong> weaverlancegmailcom jQuery Hover Footnotes</p> <p>The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier (&#39;{{...}}&#39; Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core&#39;s wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts.</p> <p><strong>Affected:</strong> weaverlancegmailcom jQuery Hover Footnotes</p> <p>The jQuery Hover Footnotes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Footnote Qualifier (&#39;{{...}}&#39; Syntax) in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attribute-breakout payload (e.g., a double-quote followed by an event handler) contains no angle brackets and therefore bypasses WordPress core&#39;s wp_kses_post() filtering, which only strips disallowed HTML tags rather than sanitizing attribute contexts.</p> https://cve.radiocsirt.org/vuln/cve-2026-10738