https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 20 Oct 2026 15:05:37 +0000 https://db.gcve.eu/vuln/cve-2026-110290 <p><strong>Affected:</strong> ajay WebberZone Top 10 — Popular Posts</p> <p>The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;other_attributes (parsed to inject instance_id) + undeclared is_widget&#39; parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to &#39;1&#39; via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.</p> <p><strong>Affected:</strong> ajay WebberZone Top 10 — Popular Posts</p> <p>The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;other_attributes (parsed to inject instance_id) + undeclared is_widget&#39; parameter in all versions up to, and including, 4.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires setting the undeclared is_widget flag to &#39;1&#39; via block JSON, which activates the vulnerable code path that concatenates the attacker-controlled instance_id value into an unescaped HTML class attribute.</p> https://db.gcve.eu/vuln/cve-2026-110290