https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 01:07:46 +0000 https://cve.radiocsirt.org/vuln/cve-2026-9019 <p><strong>Affected:</strong> brechtvds Easy Image Collage</p> <p>The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;grid[properties][borderColor]&#39; and &#39;grid[images][N][attachment_url]&#39; Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress&#39;s unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.</p> <p><strong>Affected:</strong> brechtvds Easy Image Collage</p> <p>The Easy Image Collage plugin for WordPress is vulnerable to Stored Cross-Site Scripting via &#39;grid[properties][borderColor]&#39; and &#39;grid[images][N][attachment_url]&#39; Parameters in all versions up to, and including, 1.13.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because the data is stored via update_post_meta() rather than wp_insert_post() post content, WordPress&#39;s unfiltered_html restriction does not apply, meaning Authors cannot be blocked from this attack path by capability controls alone.</p> https://cve.radiocsirt.org/vuln/cve-2026-9019