Vulnerability class
One vulnerable pattern found in several places in a codebase, or across several projects.
3 write-ups, 8 vulnerabilities
CVE-2026-6504 +5
6.4 · MediumVariant analysis of six WordPress plugins that printed an HTML tag name chosen by a Contributor without an allow-list, each leading to stored XSS.
CVE-2026-41490
8.3 · HighDagster’s DuckDB, Snowflake, BigQuery and DeltaLake I/O managers copied dynamic partition keys into SQL, so adding a partition was enough to inject queries.
CVE-2026-34160
8.6 · HighThe PENS endpoint of Chamilo LMS 2.0 fetched package URLs and posted callbacks to addresses chosen by anyone, internal hosts and cloud metadata included.
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-18988 | Easy Accordion | Stored XSS through accordionTitleTag in Easy Accordion | 6.4 Medium | |
| CVE-2026-11390 | News Kit Addons for Elementor | Stored XSS through the Site Logo Title and Single Author Box tags in News Kit Addons | 6.4 Medium | |
| CVE-2026-8607 | myCred | Stored XSS through the wrap shortcode attribute in myCred | 6.4 Medium | |
| CVE-2026-8613 | aThemes Addons for Elementor | Stored XSS through title_tag in aThemes Addons | 6.4 Medium | |
| CVE-2026-8677 | Prime Elementor Addons | Stored XSS through widget HTML tag settings in Prime Elementor Addons | 6.4 Medium | |
| CVE-2026-6504 | Royal Addons for Elementor | Stored XSS through title_tag in Royal Addons | 6.4 Medium | |
| CVE-2026-41490 | Dagster | SQL injection through dynamic partition keys in database I/O managers | 8.3 High | |
| CVE-2026-34160 | Chamilo LMS | Unauthenticated SSRF through PENS package and callback URLs | 8.6 High |
