CVE Watch11 de nov. de 2026

CVE-2026-124255

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allo

CVSS

5.3

Média

EPSS

—

KEV

—

Exploit Today

0-100

Publicado: 11 de nov. de 2026 · Última mod.: 11 de nov. de 2026 · CWE-80

EPSS · 30d

Ainda não há histórico EPSS suficiente.

Descrição técnica

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Franky Events Made Easy events-made-easy allows Code Injection.This issue affects Events Made Easy: from n/a through 3.3.5.

Referências oficiais

patchstack.comhttps://patchstack.com/database/wordpress/plugin/events-made-easy/vulnerability/wordpress-events-made-easy-plugin-3-3-5-content-injection-vulnerability?_s_id=cve

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2026-1246887.1 ALT

—

———In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.8h CVE-2026-1246877.1 ALT

—

———In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.8h CVE-2026-1257784.3 MÉD

—

———Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in myCred myCred mycred allows Code Injection.This issue affects myCred: from n/a through 4.0.2.10h CVE-2026-1257465.3 MÉD

—

———Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ProPluginsLab Back In Stock Notifier for WooCommerce back-in-stock-notifier-for-woocommerce allows Code Injection.This issue affects Back In Stock Notifier for WooCommerce: from n/a through 7.5.2.10h CVE-2026-1242625.3 MÉD

—

———Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter ad-inserter allows Code Injection.This issue affects Ad Inserter: from n/a through 2.8.19.10h CVE-2026-1210285.3 MÉD

—

——0Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong Testimonials strong-testimonials allows Code Injection.This issue affects Strong Testimonials: from n/a through 3.3.17.10h