CVE Vulnerability Catalog

CVE-2026-7174: Stored Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Specifically, in the Name and Field parameters of the endpoint /tools/discount_wizard/discount_config during the process of creating discounts assigned to an event. This vulnerability allows JavaScript code to be injected into the affected parameters, which executes when an event’s discount list page is displayed. Successful exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data.

CVE-2026-7173: Cross-Site Scripting vulnerability in Entradium, by Crocantickets. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to the victim and steal their session data. (Stored XSS) The City parameter in the endpoint /events/<event_name>/edit_general during the process of creating or editing events assigned to a promoter allows for the injection of JavaScript that will execute on the event’s public page. (Reflected XSS) The Description parameter in the endpoint /events/<event_name>/edit-general when attempting to create or modify an event without filling in all required fields.

CSRF vulnerability allows unauthorized deletion of alert commands via sequential, unvalidated GET requests when an authenticated administrator visits a malicious page. Affects Pandora FMS from version 777 onwards.

CSRF vulnerability allows unauthorized deletion of event responses via a forged GET request when an authenticated administrator visits a malicious page. Affects Pandora FMS from version 777 onwards.

In JetBrains YouTrack before 2026.2.19422, SSRF was possible via the GitHub VCS integration.

In JetBrains YouTrack before 2026.2.19422, iDOR in inbox threads allowed reading other users' notifications.

In JetBrains YouTrack before 2026.2.19422, missing authorisation allowed reloading of translation catalogs.

In JetBrains YouTrack before 2026.2.19422, privilege escalation was possible via user group membership changes.

In JetBrains YouTrack before 2026.2.19422, DoS attack was possible via crafted PSD attachments.

In JetBrains YouTrack before 2026.2.19422, iDOR in the issue activities API allowed reading restricted issues.

The Awesome Support – WordPress HelpDesk & Support Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gdpr-data' parameter in all versions up to, and including, 6.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users against other accounts because the AJAX handlers accept an arbitrary gdpr-user ID without verifying it belongs to the requester, and the required wpas-gdpr-nonce is emitted via wp_localize_script to every logged-in user on frontend plugin pages and on /wp-admin/profile.php.

The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting via User Meta Merge via 'user-mediaurl' Media Field in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by Subscriber-level users who can store a payload in user meta fields such as the biography, session_tokens (via a crafted User-Agent at login), or persisted_preferences (via the REST API), which are then promoted to the site-wide redux_demo option when a media URL repair is triggered on the demo panel.

The Ad Inserter plugin for WordPress up to version 2.8.18 is vulnerable to Reflected XSS via the 's' search parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user clicks a crafted link. Exploitation requires an ad block with {title} or {short-title} placeholder enabled on search pages.

The Duplicate Post plugin for WordPress up to version 1.5.6 is vulnerable to Stored XSS via the 'noti_token' parameter. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. This requires the site owner to enable User Level Permissions for the Subscriber role.

MISP contains a reflected XSS vulnerability in the analyst data notes panel. The seed path parameter supplied via URL is passed directly into inline JavaScript without sanitization. An attacker can trick an authenticated user into visiting a crafted URL, allowing arbitrary JavaScript execution in the victim's browser. Affects versions prior to the fix (commit 58925dbf0, post v2.5.48).

MISP contains a reflected XSS vulnerability in legacy taxonomy tag confirmation forms (add and disable tag). The forms echoed user-supplied tag names without escaping. An attacker can trick an administrator into visiting a crafted URL with a malicious tag, allowing arbitrary JavaScript execution in the admin's session. Affects versions <2.5.48.

The bbp style pack plugin for WordPress up to version 6.4.8 is vulnerable to Stored XSS via 'display_name' and 'bbp_reply_content' parameters. Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to inject arbitrary scripts that execute when a user accesses an injected page. Successful exploitation requires wrapping the reply in a <pre> block to prevent quote conversion.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (attacker-chosen name matching the form's url.<name> predefined value). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a Text Area field with 'url.<name>' Predefined Value and predefinedClick disabled.

The Calculated Fields Form plugin for WordPress up to version 5.5.1.3 is vulnerable to Reflected DOM-Based XSS via the 'x' parameter (any URL parameter consumed by the form's calculated equation). Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user clicks a crafted link. Exploitation requires a public form with a Select2 dropdown populated via a calculated equation using GETURLPARAMETER() and setChoices().

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress up to version 3.0.1 is vulnerable to Reflected XSS via URL. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts that execute when a user accesses an injected page. Exploitation requires the victim to be on a mobile user-agent and click the WeChat share icon, but script execution is automatic once the dialog opens.