WordPress 7.1.4 patches 22 flaws, including an upgrade-window RCE
Supported branches should install 7.1.4 or the matching legacy release; the advisory assigns no CVE IDs or scores.
Stories per day · 30 days
2 RSS
Relatedwordpress4interactivity-api3rce2remote-code-execution2access-control1apache-answer1cms1customizer1cve-2026-649441input-sanitization1oss1patchstack1race-condition1xss1
25 stories, newest first · one card per story
Stories tagged #stored-xss
WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE
Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.
1
WordPress 7.1.4 fixes 22 flaws, including upgrade RCE
The unauthenticated race needs a seconds-long update window and a web-reachable wp-content/upgrade directory; backports reach 4.7.39.
WordPress 7.1.4 fixes upgrade RCE and multiple stored XSS bugs
Fixes are being backported through the 4.7 line, and automatic background updates should install 7.1.4.
1
CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content
Apache Answer through 2.0.2 stores imported question HTML unsanitized, enabling stored cross-site scripting.
Four ways back in: the WordPress XSS campaign that hides its own admin account
Attackers are exploiting stored XSS in two WordPress plugins to install hidden admin backdoors.
15
CVE-2026-93684: Apache Impala: Stored XSS in Impala query plans
Apache Impala stored XSS lets SELECT-only users run script in the query-plan Web UI.
SCHUTZWERK-SA-2024-006: Stored Cross-Site Scripting via text fields in H5P module (h5p-nodejs-library) of Lumi Education
Stored XSS in Lumi Education h5p-nodejs-library before 9.3.3 runs injected script in viewers' browsers.
CVE-2026-86507: Apache Roller: Stored XSS in comment moderation via comment author URL
Apache Roller 6.1.5 stored XSS can run in moderator or administrator sessions via comment-author URLs.
CVE-2026-82381: Apache Roller: Stored cross-site scripting in the authoring UI
Apache Roller 6.1.5 stored XSS lets authors inject content that runs in the authoring UI.
VU#699627: Readwise Reader for Android, version 8.7.2, contains multiple XSS vulnerabilities
CERT/CC discloses three stored XSS flaws in Readwise Reader Android 8.7.2 that can run JavaScript in WebView.
WordPress Comment2Shell Vulnerability Lets Hackers Take Over Sites Through Comments
WordPress patched CVE-2026-93485, a stored XSS called Comment2Shell that can lead to admin-triggered command execution.
5
SCHUTZWERK-SA-2024-007: Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
Stored XSS in Lumi Education h5p-nodejs-library through 10.0.4 lets uploaded H5P content run JavaScript.
Hackers Can Manipulate Web Cache Keys to Access Restricted Data and Poison Websites
Researcher Alex Brumen demonstrates Nginx cache key injection enabling restricted-data access, cache-poisoned denial of service, and stored XSS.
5
WordPress 7.1.1 Fixes 11 Security Flaws Including Stored XSS and Path Traversal
WordPress 7.1.1 patches 11 core vulnerabilities, including stored XSS in wpautop() and an authenticated path traversal in the REST Templates Controller reported by Anthropic.
2
WordPress Urges Immediate Update After Fixing 11 Security Vulnerabilities
WordPress 7.1.1 fixes 11 core vulnerabilities including stored XSS, path traversal, and authorization bypass flaws; admins urged to update immediately.
3
WordPress 7.1.1 Maintenance and Security Release
WordPress 7.1.1 patches an unauthenticated stored XSS (CVE-2026-93485) in wpautop(), exploitable via published comments, with CVSS 3.1 score 7.1.
3
Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories
Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.
1
Telegram Desktop Flaw Lets Attackers Steal Chat Messages Through Poisoned HTML Exports
Telegram Desktop XSS in bot inline keyboard buttons let attackers steal chat content from exported HTML archives; patched in 7.0.1.
1
Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps
ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.
Okta Patches Auth0 and Access Gateway Vulnerabilities Let Attackers Enable XSS, Authentication Bypass and SQL Injection
Okta patches three high-severity flaws in Auth0 AD/LDAP Connector and Access Gateway: stored XSS, auth bypass, SQL injection.
9
CVE-2026-52307: Stored XSS in 1CMS v5.6
CVE-2026-52307: authenticated stored XSS in 1CMS (ClassCMS) v5.6 Column Management lets attackers inject scripts via the title field.
[webapps] PodcastGenerator 3.2.9 - Stored XSS
A stored cross-site scripting flaw in PodcastGenerator 3.2.9 is documented with a public proof-of-concept exploit on Exploit-DB.
[webapps] Bludit CMS - Stored XSS
A stored cross-site scripting (XSS) vulnerability in Bludit CMS was disclosed through a public proof-of-concept published on Exploit-DB.