https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 07 Nov 2026 06:34:14 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120533 <p>The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types &#39;spinner&#39;, &#39;slider&#39;, &#39;color&#39;, and &#39;date&#39; receive per-type value validation that would block the entity-encoded payload.</p> <p>The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types &#39;spinner&#39;, &#39;slider&#39;, &#39;color&#39;, and &#39;date&#39; receive per-type value validation that would block the entity-encoded payload.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120533 https://db.gcve.eu/vuln/ghsa-f947-r9p9-x3x7 <p>The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types &#39;spinner&#39;, &#39;slider&#39;, &#39;color&#39;, and &#39;date&#39; receive per-type value validation that would block the entity-encoded payload.</p> <p>The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via theme_opts Parameter via User Profile in all versions up to, and including, 4.5.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the host theme to have registered a Redux field of a CSS-emitting type (such as link_color, border, or typography) with an output CSS selector, as only the field types &#39;spinner&#39;, &#39;slider&#39;, &#39;color&#39;, and &#39;date&#39; receive per-type value validation that would block the entity-encoded payload.</p> https://db.gcve.eu/vuln/ghsa-f947-r9p9-x3x7