https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 16 Oct 2026 16:24:43 +0000 https://cve.radiocsirt.org/vuln/cve-2026-4279 <p><strong>Affected:</strong> breadbutter Bread &amp; Butter: AI-Powered Lead Intelligence</p> <p>The Bread &amp; Butter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;breadbutter-customevent-button&#39; shortcode in all versions up to, and including, 8.2.0.25. This is due to insufficient input sanitization and output escaping on the &#39;event&#39; shortcode attribute. The customEventShortCodeButton() function takes the &#39;event&#39; attribute value and directly interpolates it into a JavaScript string within an onclick HTML attribute without applying esc_attr() or esc_js(). Notably, the sister function customEventShortCode() properly uses esc_js() for the same attribute, but this was omitted in the button variant. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page and clicks the injected button.</p> <p><strong>Affected:</strong> breadbutter Bread &amp; Butter: AI-Powered Lead Intelligence</p> <p>The Bread &amp; Butter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;breadbutter-customevent-button&#39; shortcode in all versions up to, and including, 8.2.0.25. This is due to insufficient input sanitization and output escaping on the &#39;event&#39; shortcode attribute. The customEventShortCodeButton() function takes the &#39;event&#39; attribute value and directly interpolates it into a JavaScript string within an onclick HTML attribute without applying esc_attr() or esc_js(). Notably, the sister function customEventShortCode() properly uses esc_js() for the same attribute, but this was omitted in the button variant. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the page and clicks the injected button.</p> https://cve.radiocsirt.org/vuln/cve-2026-4279