CVE-2026-7543

Publié : 16 juillet 2026

Modifié : 16 juillet 2026

Score CVSS

7.2

HIGH

Description détaillée

The Breakdance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fields' parameter in versions up to, and including, 2.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://breakdance.com/breakdance-2-7-2-security-update/https://www.wordfence.com/threat-intel/vulnerabilities/id/64f07bca-5d04-4b28-b775-f47ed692575e?source=cve

Dernières Vulnérabilités

CVE-2023-49900

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command.

VOIR DÉTAILS

CVE-2023-49899

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.

VOIR DÉTAILS

CVE-2026-22752

Authentication bypass by primary weakness vulnerability in Spring Security Spring Authorization Server. This issue affects Spring Authorization Server: from 7.0.0 through 7.0.4, from 1.5.0 through 1.5.6, from 1.4.0 through 1.4.9, from 1.3.0 through 1.3.10.

VOIR DÉTAILS