Skip to content
Threat Feed
Subscribe

Tag

Cms-Plugin

2 briefs RSS
high advisory

Stored XSS in Grav Data Manager Plugin (CVE-2026-100673)

An unauthenticated stored cross-site scripting vulnerability in the Grav Data Manager plugin allows attackers to execute malicious JavaScript in the context of an administrator's session.

Grav Data Manager plugin web-vulnerability xss cms-plugin
1r 2t 1c
high threat

Authorization Bypass in @jhb.software/payload-alt-text-plugin

The @jhb.software/payload-alt-text-plugin v0.7.0 fails to restrict Payload Local API calls, allowing authenticated users to bypass collection-level access controls to read and modify document data.

exploited payload-alt-text-plugin authorization-bypass cms-plugin cwe-863
2t