/* Route-Critical (index, V6 §3.6.3 — erzeugt von tools/generate_critical_css.mjs) */ .mydraft-svg-icon{display:inline-block;vertical-align:middle;color:currentcolor;flex-shrink:0;transition:color var(--duration-fast, 150ms) ease,stroke var(--duration-fast, 150ms) ease,fill var(--duration-fast, 150ms) ease}.mydraft-svg-icon circle,.mydraft-svg-icon line,.mydraft-svg-icon path,.mydraft-svg-icon polygon,.mydraft-svg-icon polyline,.mydraft-svg-icon rect{transition:stroke var(--duration-fast, 150ms) ease,fill var(--duration-fast, 150ms) ease}@layer components{.live-pulse-dot{width:8px;height:8px}}@layer overrides{.live-pulse-dot{width:8px;height:8px;background-color:var(--threat-critical,#ef4444);border-radius:50%;display:inline-block;box-shadow:rgba(239,68,68,.7) 0 0 0 0}}@media (prefers-reduced-motion:reduce){@layer overrides{#news-popup,#news-toast-banner,.animate-pulse,.live-pulse-dot,.live-pulsing-dot,.news-item-card{animation:auto ease 0s 1 normal none running none;transition:none}}} 🔒 Stored Cross-Site Scripting in WordPress Comments Screen Contextual Help Tabs | Sichere Programmierung – TSECURITY.DE
EILMELDUNGEN LIVE
YouTube Security VideosAndroid Police: Is Apple running out of ideas? #shorts #iphone #apple #tech(18.10.2026 um 11:25 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-111992 | itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 Exam exam.php Exam::startExam topicid sql injection(18.10.2026 um 09:41 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-111880 | FreeRDP up to 3.31.x NTLM heap-based overflow (Nessus ID 366929)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-101895 | Google Angular HTML Parser lib/HTMLParser.js forcequirks infinite loop (Nessus ID 366927)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-102941 | gomarkdown 0.0.0-2024 URL Safety Check parser/parser.go parser.IsSafeURL memory corruption (Nessus ID 366928)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-102608 | ZoneMinder up to 1.38.2 Event Export downloadEvents Name os command injection (Nessus ID 366926)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-101896 | Google router Server-Side Rendering allocation of resources (Nessus ID 366925)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-111881 | FreeRDP up to 3.14.1/3.31.x WinPR BMP writer clipboard_synthesize_image_format_to_bmp integer underflow (Nessus ID 366924)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-101897 | Google Angular up to 1.21.0 Background Service Worker cross-domain policy (Nessus ID 366923)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-102607 | ZoneMinder up to 1.38.2 Event Export web/ajax/event.php exportEvents exportFile os command injection (Nessus ID 366922)(18.10.2026 um 09:53 Uhr)
•
YouTube Security VideosAndroid Police: Is Apple running out of ideas? #shorts #iphone #apple #tech(18.10.2026 um 11:25 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-111992 | itsmeravitejak Online-Examination-System up to e6208e630b14657999bbfe4c9912302d2a1e2449 Exam exam.php Exam::startExam topicid sql injection(18.10.2026 um 09:41 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-111880 | FreeRDP up to 3.31.x NTLM heap-based overflow (Nessus ID 366929)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-101895 | Google Angular HTML Parser lib/HTMLParser.js forcequirks infinite loop (Nessus ID 366927)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-102941 | gomarkdown 0.0.0-2024 URL Safety Check parser/parser.go parser.IsSafeURL memory corruption (Nessus ID 366928)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-102608 | ZoneMinder up to 1.38.2 Event Export downloadEvents Name os command injection (Nessus ID 366926)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-101896 | Google router Server-Side Rendering allocation of resources (Nessus ID 366925)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-111881 | FreeRDP up to 3.14.1/3.31.x WinPR BMP writer clipboard_synthesize_image_format_to_bmp integer underflow (Nessus ID 366924)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-101897 | Google Angular up to 1.21.0 Background Service Worker cross-domain policy (Nessus ID 366923)(18.10.2026 um 09:53 Uhr)
•
Sicherheitslücken (CVE)CVE-2026-102607 | ZoneMinder up to 1.38.2 Event Export web/ajax/event.php exportEvents exportFile os command injection (Nessus ID 366922)(18.10.2026 um 09:53 Uhr)
•
Intelligence View
⚡ tsecurity.de Intelligence

Stored Cross-Site Scripting in WordPress Comments Screen Contextual Help Tabs

The admin contextual help tab handler passed a link's href straight to jQuery, which parses markup-like values as HTML instead of treating them as a selector.…

Sichere Programmierung Vulnerability definition feed 1 Min. Lesezeit
Beitrag
0
Seite
0
↗ Quelle (Vulnerability definition feed)
Social ReaktionenReagiere als Erste:r — dein Feedback zählt!

The admin contextual help tab handler passed a link's href straight to jQuery, which parses markup-like values as HTML instead of treating them as a selector. Content from a pending comment could use this to run script in the browser of an administrator or moderator viewing the Comments screen. The fix resolves the help panel with $( document... Weiterlesen: Stored Cross-Site Scripting in WordPress Comments Screen Contextual H…

🔍 CTI & Forensik

Cyber Threat Intelligence & Forensik

ATT&CK-Navigator · IoC-Radar · Exploit-Belege
CTI Threat Relationship Graph
Akteure · Techniken · Beziehungen
3 Knoten · 2 Relationen
CVE / Incident Threat Actor Software MITRE ATT&CK CWE Weakness IoC
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken
Intelligence Digest — free The top security news daily · unsubscribe anytime
Community Rating & Social Proof
⭐ Leser-Wertung
–
Ø / 5.0
No reader ratings yet
Was this page helpful?
0
Jetzt Bewertung abgeben
🟢 Niedrig (1-3.9) 🟡 Mittel (4.0-6.9) 🔴 Hoch (7.0-8.9) Kritisch (9.0-10.0)
Powered by tsecurity.de tsecurity.de Hub
🚀 Auf tsecurity.de entdecken

Related story clusters & sources (vector AI)

19 sources
CVE-2026-111906 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha Elasticsearch/OpenSearch Administration API cross-site request forgery (EUVD-2026-103314)
18 more sources
VulDB Updates8 hours agoCVE-2026-111905 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha {userId} userId resource injection (EUVD-2026-103315) VulDB Updates8 hours agoCVE-2026-111904 | thorsten phpMyFAQ 4.2.0-alpha Open Question Controller /api/v4.0/open-questions OpenQuestionController information disclosure (EUVD-2026-103316) VulDB Updates8 hours agoCVE-2026-111903 | thorsten phpMyFAQ 4.2.0-alpha SvgSanitizer cross site scripting (EUVD-2026-103317) VulDB Updates8 hours agoCVE-2026-111894 | thorsten phpMyFAQ up to 4.1.8/4.2.0-alpha cleanUpContent cross site scripting (EUVD-2026-103325) VulDB Updates8 hours agoCVE-2026-111893 | Thorsten phpMyFAQ 4.2.0-alpha GroupController category-restrictions saveCategoryRestrictions categoryIds privileges management (EUVD-2026-103326) VulDB Updates8 hours agoCVE-2026-111892 | thorsten phpMyFAQ up to 4.2.0-alpha.2 Rate Limiting allocation of resources (EUVD-2026-103327)
+12
7 sources
CVE-2026-92883 | GitLab up to 19.2.7/19.3.4/19.4.1 HTML Attributes HTML injection (Nessus ID 366859)
6 more sources
VulDB Updates5 hours agoCVE-2026-85529 | GitLab up to 19.2.7/19.3.4/19.4.1 GraphQL API improper authorization (Nessus ID 366858) VulDB Updates5 hours agoCVE-2026-100755 | GitLab up to 19.2.7/19.3.4/19.4.1 Package Registry privileges management (Nessus ID 366855 / WID-SEC-2026-3858) VulDB Updates5 hours agoCVE-2026-14210 | GitLab up to 19.2.7/19.3.4/19.4.1 Labels improper authorization (Nessus ID 366853) VulDB Updates6 hours agoCVE-2026-92528 | GitLab up to 19.2.7/19.3.4/19.4.1 privileges management (Nessus ID 366866) VulDB Updates6 hours agoCVE-2026-101168 | GitLab up to 19.2.7/19.3.4/19.4.1 Pages information disclosure (Nessus ID 366862 / WID-SEC-2026-3858) VulDB Updates8 hours agoCVE-2026-96893 | GitLab up to 19.2.7/19.3.4/19.4.1 AI Conversation Context Construction neutralization (Nessus ID 366872)

Mehr aus dieser Kategorie

AWS IoT Core: qué es, cómo funciona y cuándo usarlo en tu proyecto
18.10.2026
Shopkeepers won't retype their udhaar khata. KhataLens reads it with Gemma 4, locally
18.10.2026
I let an AI coding agent build a 1,300-page site with a $0 server bill
18.10.2026
ScopeShield: Stop Working for Free — NDA-Safe Scope-Creep Auditor
18.10.2026
Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen
Pull to refresh
TTS Reader • tsecurity.de Voice
Nächster Beitrag