https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-12T10:58:08.634755+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-126498 fkie_cve-2026-126498 2026-11-12T10:58:08.635989+00:00

WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.

 https://db.gcve.eu/vuln/ghsa-43p2-x762-x6h7 GHSA-43p2-x762-x6h7 2026-11-12T10:58:08.636044+00:00

WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to inject HTML by supplying a malicious post slug via the CreatePost API. The raw slug is concatenated into an anchor by augmentReadingDestination() for paid-shortcode posts, executing script for RSS/Atom feed readers, newsletter recipients and ActivityPub viewers.