#StoredXSS
LightNews LightNews
Just got my first XSS vulnerability accepted on OpenBugBounty! 🎉

Found a Stored XSS and reported it responsibly.

Full write-up here: medium.com/@moohammaduz...

Starting my bug bounty journey! 🚀

#BugBounty #XSS #CyberSecurity #EthicalHacking #StoredXSS #CyberSecurityStudent
My First XSS Vulnerability. The Day I Started My Bug Bounty Journey
Introduction:
medium.com
March 1, 2026 at 6:27 PM
securityonline.bsky.social
Details and PoC exploit code for a critical WordPress stored XSS are public. Learn how CVE-2026-93485 enables RCE and patch WordPress today.

#WordPress #CVE202693485 #StoredXSS #RCE #Cybersecurity #Infosec
WordPress Stored XSS Details and PoC Publicly Disclosed
TL;DR On September 21, 2026, security researcher Rafie Muhammad published technical analysis of a high-severity flaw in WordPress core. The WordPress stored XSS flaw, tracked as CVE-2026-93485, allows unauthenticated visitors to execute arbitrary scripts through crafted comments. Furthermore, full technical details of the vulnerability and working proof-of-concept exploit code have been publicly disclosed. Why It Matters WordPress powers over 43 percent of all websites on the internet.
securityonline.info
September 23, 2026 at 12:59 PM
donwebmedia.bsky.social
CVE-2026-5191: XSS en Tiled Gallery Carousel

CVE-2026-5191 WordPress vulnerabilidad: cualquier contributor puede inyectar XSS en tu galería. Verificá versión del plugin y aplicá el parche.

#cve20265191 #storedxss #tiledgallerycarousel #wordpressplugins #seguridadwordpress
CVE-2026-5191: XSS en Tiled Gallery Carousel - Seguridad en Wordpress
CVE-2026-5191 expone el plugin Tiled Gallery Carousel Without JetPack hasta v3.1 a Stored XSS. Qué riesgo implica y cómo mitigarlo.
seguridadenwordpress.com
June 3, 2026 at 3:57 AM
0xberserkr.bsky.social
Cross-site Scripting - I have just completed this room! Check it out: tryhackme.com/room/xss #tryhackme #XSS #Cross-SiteScripting #DOM #ReflectedXSS #StoredXSS #BlindXSS #Polyglot #xss via
@realtryhackme
#infosec #hacking
TryHackMe | Cyber Security Training
An online platform for learning and teaching cyber security, all through your browser.
tryhackme.com
September 30, 2023 at 3:44 PM
donwebmedia.bsky.social
CVE-2026-7661: XSS en Bootstrap Shortcode WordPress

CVE-2026-7661 WordPress afecta Bootstrap Shortcode hasta v1.0: un Contributor puede inyectar scripts en tu sitio. Verificá si estás expuesto y qué hacer...

#cve20267661 #bootstrapshortcode #storedxss #wordpressseguridad #wordfence
CVE-2026-7661: XSS en Bootstrap Shortcode WordPress - Seguridad en Wordpress
CVE-2026-7661 es una vulnerabilidad Stored XSS en Bootstrap Shortcode para WordPress que permite a usuarios Contributor inyectar scripts maliciosos en cualquier página del sitio.
seguridadenwordpress.com
May 12, 2026 at 2:08 PM
securityonline.bsky.social
The Roundcube security update fixes 12 webmail flaws, including a zero-click stored XSS and an SSRF bypass. Update to 1.6.19 or 1.7.4 now.

#Roundcube #Webmail #XSS #SSRF #EmailSecurity #StoredXSS #PatchNow #Infosec
Roundcube Security Update Fixes 12 Webmail Flaws
Roundcube shipped a security update on September 6, 2026. The Roundcube security update patches 12 vulnerabilities across the 1.6 LTS and 1.7 branches. The fixes include a zero-click stored XSS, an SSRF bypass, and several email header injection flaws. Why this matters Roundcube is one of the most widely deployed open-source webmail clients. Many hosting providers and Nextcloud installs bundle it.
securityonline.info
September 6, 2026 at 2:32 PM
securityonline.bsky.social
A Confluence vulnerability, CVE-2026-21580, is a stored XSS flaw (CVSS 8.6) allowing unauthenticated attacks. A Jira flaw also patched. Update now.

#Atlassian #Confluence #CVE202621580 #StoredXSS #Jira #InfoSec
CVE-2026-21580: Stored XSS Hits Atlassian Confluence
TL;DR Atlassian patched two high-severity flaws in its self-hosted products. The first, CVE-2026-21580, is a stored XSS bug in Confluence. This Confluence vulnerability scores a CVSS of 8.6 and needs no authentication. Why it matters Confluence and Jira sit at the center of many teams' workflows. A flaw there can expose sensitive project data. The stored XSS bug lets an attacker run code in a victim's browser.
securityonline.info
August 19, 2026 at 6:40 AM
securityonline.bsky.social
A Ninja Forms vulnerability chain hits 600K+ sites. CVE-2026-65048 is an unauthenticated stored XSS rated CVSS 9.3. Update to 3.14.10 now.

#NinjaForms #WordPress #StoredXSS #CVE202665048 #PluginSecurity #InfoSec
600K Sites at Risk: Ninja Forms Stored XSS Flaw CVE-2026-65048 Hits CVSS 9.3
TL;DR Researchers disclosed four flaws in the Ninja Forms WordPress plugin, which runs on more than 600,000 sites. The worst is a Ninja Forms vulnerability tracked as CVE-2026-65048, an unauthenticated stored XSS rated CVSS 9.3. All four are fixed in version 3.14.10. Why it matters Ninja Forms sits on over 600,000 active installations. A single form page can therefore expose a large audience.
securityonline.info
July 23, 2026 at 1:01 AM
ahmandonk.bsky.social
📰 Zimbra Desak Pengguna Segera Patch Celah XSS Kritis pada Classic Web Client

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/07/11/zimbra-classic-web-client-xss-patch/

#cyber#cyberSecurityl#emailServere#storedXsse#vulnerabilitya#webmail##xss##zcsr#zimbrar#zimbraCollaborationSuite
July 11, 2026 at 12:38 PM
threadlinqs.bsky.social
One opened email is enough - a Zimbra webmail flaw runs attacker code and steals your session. Patch to 10.1.19 now. https://intel.threadlinqs.com/threat/TL-2026-1208 #ThreatIntel #Zimbra #Custom #StoredXSS
Zimbra Collaboration Suite Classic Web Client Stored XSS (patched in 10.1.19, no CVE yet)
July 11, 2026 at 7:41 AM
securityonline.bsky.social
A Roundcube zero-click XSS, CVE-2026-54433, lets an email run script with no click. Roundcube 1.7.2 also fixes a second stored XSS. Update now.

#Roundcube #XSS #ZeroClick #Webmail #StoredXSS #CyberSecurity #Vulnerability #InfoSec
Roundcube 1.7.2 Patches Zero-Click Stored XSS CVE-2026-54433
TL;DR Roundcube shipped versions 1.7.2 and 1.6.17 to fix six security bugs. The headline flaw is a Roundcube zero-click XSS, tracked as CVE-2026-54433, in plain-text message rendering. The update also closes a second stored XSS, an SSRF bypass, and three more issues. Why It Matters Roundcube runs on countless self-hosted mail servers. So a zero-click bug is dangerous, because the victim only has to open the email.
securityonline.info
July 9, 2026 at 3:01 PM
securityonline.bsky.social
Progress patched three MOVEit Transfer flaws, including a stored XSS bug (CVE-2026-11903). No exploitation is confirmed. Update now.

#MOVEit #MOVEitTransfer #StoredXSS #XSS #CVE #ProgressSoftware #PatchNow #InfoSec
MOVEit Transfer Fixes Stored XSS and Two Other Vulnerabilities
TL;DR Progress released a MOVEit Transfer security bulletin on July 8, 2026. It fixes three flaws, and the top one is a stored XSS bug, CVE-2026-11903, rated CVSS 8.0. None of the three is a pre-auth remote code execution, and Progress reports no known exploitation. Why it matters MOVEit Transfer moves sensitive files for thousands of organizations. So attackers watch it closely.
securityonline.info
July 9, 2026 at 11:30 AM
donwebmedia.bsky.social
CVE-2026-8977: XSS en WP GDPR Cookie Consent

¿Tu sitio usa WP GDPR Cookie Consent ≤ 1.0.0? La CVE-2026-8977 WordPress permite a cualquier subscriber inyectar scripts en tus páginas. Actualizá hoy.

#cve20268977 #storedxss #wpgdprcookieconsent #wordpressxss #pluginsvulnerables
CVE-2026-8977: XSS en WP GDPR Cookie Consent - Seguridad en Wordpress
CVE-2026-8977 es un Stored XSS en WP GDPR Cookie Consent hasta 1.0.0. Cualquier subscriber puede inyectar scripts en el sitio. Parche disponible.
seguridadenwordpress.com
June 10, 2026 at 3:47 AM
donwebmedia.bsky.social
CVE-2026-5714: XSS Stored en Enable Media Replace

CVE-2026-5714 en Enable Media Replace: Stored XSS que afecta 600k+ sitios hasta v4.1.8. Cualquier Autor puede inyectar scripts. ¿Ya actualizaste a 4.1.9?

#cve20265714 #enablemediareplace #storedxss #pluginsvulnerables #wordpressseguridad
CVE-2026-5714: XSS Stored en Enable Media Replace - Seguridad en Wordpress
Enable Media Replace hasta versión 4.1.8 tiene un Stored XSS (CVE-2026-5714) explotable con acceso Autor. La versión 4.1.9 lo corrige.
seguridadenwordpress.com
June 9, 2026 at 2:27 PM
donwebmedia.bsky.social
CVE-2026-7556: XSS en FV Flowplayer para WordPress

¿Tu WordPress tiene FV Flowplayer instalado? CVE-2026-7556 permite XSS almacenado vía comentarios con CVSS 6.1. Verificá si estás expuesto y cómo soluci...

#cve20267556 #fvflowplayer #storedxss #wordpressplugins #seguridadwordpress
CVE-2026-7556: XSS en FV Flowplayer para WordPress - Seguridad en Wordpress
CVE-2026-7556 es una Stored XSS en FV Flowplayer Video Player (versiones hasta 7.5.49.7212). CVSS 6.1, solo explotable con parse_comments activo.
seguridadenwordpress.com
June 9, 2026 at 12:39 PM
donwebmedia.bsky.social
CVE-2026-3722: Stored XSS en Auto Image Attributes

CVE-2026-3722 WordPress seguridad: Stored XSS en Auto Image Attributes afecta versiones hasta 4.9. ¿Tenés el plugin instalado? Actualizá en 5 minutos.

#cve20263722 #storedxss #autoimageattributes #wordpressplugins #wordfence
CVE-2026-3722: Stored XSS en Auto Image Attributes - Seguridad en Wordpress
CVE-2026-3722 es un Stored XSS en Auto Image Attributes para WordPress que afecta hasta la versión 4.9 y permite inyectar scripts vía metadatos de imágenes.
seguridadenwordpress.com
June 2, 2026 at 8:58 AM
donwebmedia.bsky.social
CVE-2026-9644: XSS en LiveSmart Video Chat WordPress

CVE-2026-9644 WordPress afecta LiveSmart Video Chat ≤1.2: un contributor puede inyectar scripts que se ejecutan en todos los visitantes. Verificá si est...

#cve20269644 #storedxss #livesmartvideochat #wordpressvulnerabilidades #wordfence
CVE-2026-9644: XSS en LiveSmart Video Chat WordPress - Seguridad en Wordpress
CVE-2026-9644 es un Stored XSS en LiveSmart Video Chat ≤1.2 que permite a un contributor inyectar scripts maliciosos en páginas WordPress. CVSS 6.1.
seguridadenwordpress.com
May 29, 2026 at 1:24 AM
donwebmedia.bsky.social
CVE-2026-7509: Stored XSS en KIA Subtitle WordPress

¿Usás KIA Subtitle en tu WordPress? CVE-2026-7509 permite inyectar scripts maliciosos vía shortcode. Verificá tu versión y actualizá a 4.0.2 ahora.

#cve20267509 #kiasubtitle #storedxss #wordpressplugins #shortcodevulnerabilidad
CVE-2026-7509: Stored XSS en KIA Subtitle WordPress - Seguridad en Wordpress
CVE-2026-7509 es una vulnerabilidad Stored XSS en KIA Subtitle para WordPress que afecta versiones hasta 4.0.1. La versión 4.0.2 la corrige.
seguridadenwordpress.com
May 25, 2026 at 4:25 AM
donwebmedia.bsky.social
CVE-2026-2955: XSS en plugin AIWU para WordPress

CVE-2026-2955 vulnerabilidad wordpress en plugin AIWU hasta v1.4.14: XSS almacenado via X-Forwarded-For. Chequeá si sos vulnerable y actualizá ahora.

#cve20262955 #xsswordpress #pluginaiwu #storedxss #seguridadwordpress
CVE-2026-2955: XSS en plugin AIWU para WordPress - Seguridad en Wordpress
CVE-2026-2955 afecta al plugin AIWU en versiones hasta 1.4.14 con XSS almacenado. Cómo detectarlo y solucionarlo.
seguridadenwordpress.com
May 24, 2026 at 7:31 PM
donwebmedia.bsky.social
CVE-2026-1543 en Avada Builder: actualizá ya

¿Tenés Avada Builder hasta v3.15.2? CVE-2026-1543 permite XSS almacenado desde cualquier suscriptor. Actualizá a 3.15.3 ahora y revisá si tu sitio fue c...

#cve20261543 #avadabuilder #storedxss #fusionbuilder #wordpressseguridad
CVE-2026-1543 en Avada Builder: actualizá ya - Seguridad en Wordpress
CVE-2026-1543 es una vulnerabilidad Stored XSS en Avada Builder hasta v3.15.2. La versión parcheada es 3.15.3.
seguridadenwordpress.com
May 22, 2026 at 4:32 AM
donwebmedia.bsky.social
CVE-2026-0703: XSS en NextMove Lite WooCommerce

CVE-2026-0703 es un Stored XSS en NextMove Lite para WooCommerce (hasta v2.23.0). Conocé el impacto, cómo verificar tu tienda y qué hacer ahora.

#nextmovelite #storedxss #woocommerceseguridad #cve20260703 #wordpressvulnerabilidades
CVE-2026-0703: XSS en NextMove Lite WooCommerce - Seguridad en Wordpress
CVE-2026-0703 afecta NextMove Lite para WooCommerce hasta la versión 2.23.0 con un Stored XSS que puede comprometer el admin de tu tienda.
seguridadenwordpress.com
May 3, 2026 at 7:33 PM
donwebmedia.bsky.social
Gravity Forms: 5 vulnerabilidades XSS críticas sin parchear

Gravity Forms vulnerabilidad XSS crítica: 5 fallos Stored XSS afectan 6M sitios. Ataques sin autenticación confirmados. Actualiza a 2.10.1 inmediatamente.

#gravityforms #xss #cve20265109 #storedxss #wordpressplugins
Gravity Forms: 5 vulnerabilidades XSS críticas sin parchear - Seguridad en Wordpress
Cinco vulnerabilidades Stored XSS en Gravity Forms afectan a más de 6 millones de sitios. La versión 2.10.1 incluye el parche.
seguridadenwordpress.com
May 2, 2026 at 10:38 PM
donwebmedia.bsky.social
CVE-2026-6809: XSS en Social Post Embed WordPress

CVE-2026-6809 afecta Social Post Embed hasta v2.0.1: XSS almacenado vía Threads embed. Cómo funciona el ataque y cómo actualizar a la versión segura 2.0.2.

#cve20266809 #storedxss #socialpostembed #wordpressseguridad #wordfence
CVE-2026-6809: XSS en Social Post Embed WordPress - Seguridad en Wordpress
CVE-2026-6809 es un Stored XSS en Social Post Embed para WordPress que permite a un Contributor inyectar JavaScript malicioso vía el handler de Threads embed.
seguridadenwordpress.com
April 29, 2026 at 12:00 PM
donwebmedia.bsky.social
CVE-2026-0894: XSS en Custom Post Widget WordPress

CVE-2026-0894 Custom Post Widget: vulnerabilidad crítica detectada. Aprende cómo proteger tu WordPress. Detalles, parches y soluciones aquí.

#cve20260894 #storedxss #custompostwidget #wordpresssecurity #wordfence
CVE-2026-0894: XSS en Custom Post Widget WordPress - Seguridad en Wordpress
El CVE-2026-0894 es una vulnerabilidad Stored XSS en Custom Post Widget que afecta versiones hasta 3.3.9. Cómo parchear y auditar tu WordPress.
seguridadenwordpress.com
April 20, 2026 at 6:27 AM
sailingbikeruk.bsky.social
This was a struggle, but it seems it wasn't me it was them. Request Catcher appears broken.

Cross-site Scripting - I have just completed this room! Check it out: https://tryhackme.com/room/xssgi #tryhackme #XSS #DOM #ReflectedXSS #StoredXSS #BlindXSS #Polyglot #xssgi via...
TryHackMe | Cyber Security Training
TryHackMe is a free online platform for learning cyber se...
tryhackme.com
November 24, 2024 at 8:09 PM