XSS

Collabora Online contains multiple vulnerabilities that allow a remote, authenticated attacker to bypass security measures, conduct Cross-Site Scripting (XSS) attacks, or perform unauthorized information disclosure.

The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress contains a Stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject arbitrary web scripts via the mail subject parameter.

The Welcart e-Commerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'gid' parameter, allowing unauthenticated attackers to execute arbitrary JavaScript in the administrative dashboard.

The Relevanssi - A Better Search plugin for WordPress (v4.28.5 and earlier) is vulnerable to stored cross-site scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts when specific search-highlighting features are enabled.

The VikRentCar WordPress plugin contains a stored XSS vulnerability in the poplink parameter that is exploitable by unauthenticated attackers due to the public exposure of the vikwp_nonce token.

The PPWP Password Protect Pages plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting via improper input sanitization in shortcode attributes, allowing script injection into pages.

The Ninja Forms WordPress plugin is vulnerable to stored cross-site scripting (XSS) due to improper input sanitization and a flawed nonce implementation in the nf_ajax_submit endpoint, allowing unauthenticated attackers to execute arbitrary web scripts.

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post_content parameter, allowing unauthenticated attackers to execute arbitrary JavaScript if specific plugin settings are enabled.

The Content Egg plugin for WordPress contains a stored XSS vulnerability (CVE-2026-92424) allowing contributor-level users to inject malicious scripts into posts by impersonating an administrator during the import process.

Bold Grid W3 Total Cache versions from n/a through 2.10.7 contain an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability, which allows Stored XSS.

An unauthenticated Cross-Site Scripting (XSS) vulnerability in Easy Property Listings versions 3.5.25 and earlier allows attackers to inject malicious scripts into web pages viewed by other users.

Auction Nudge - Your eBay on Your Site versions 8.4.0 and earlier contain an unauthenticated Cross Site Scripting (XSS) vulnerability.

WP Crowdfunding versions 2.2.2 and earlier contain an unauthenticated sensitive data exposure vulnerability.

A reflected cross-site scripting vulnerability in WP Swings Upsell Order Bump Offer for WooCommerce (versions <= 3.1.6) allows attackers to execute arbitrary scripts in a user's browser via crafted input.

The NewsmanApp WordPress plugin contains a stored Cross-Site Scripting vulnerability in billing parameters that allows unauthenticated attackers to execute arbitrary scripts in the context of a user session.

The Mapster WP Maps plugin for WordPress up to version 2.0.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious scripts into map configurations via the REST API.

Codeastro Internet Banking System 2.0.0 contains a stored XSS vulnerability in the pages_add_acc_type.php component that allows authenticated attackers to inject malicious JavaScript, potentially leading to session hijacking.

The Schema App Structured Data plugin for WordPress through version 2.3.2 is vulnerable to stored cross-site scripting due to insufficient sanitization of comment content when the 'Remove Microdata' feature is active.

Highcharts Dashboards parses fullscreen labels as HTML, allowing an attacker who controls the Dashboards language options to execute script in the origin of the page hosting the dashboard.

The DSGVO All in one for WP plugin for WordPress is vulnerable to stored cross-site scripting (XSS) due to improper sanitization of comment content when specific integration settings are enabled.

CVE-2025-0133 is a reflected Cross-Site Scripting vulnerability in PAN-OS GlobalProtect portal and gateway login pages that allows arbitrary JavaScript execution via the user query parameter.

A cross-site scripting (XSS) vulnerability in Highcharts Core allows arbitrary JavaScript execution when an attacker-controlled chart configuration injects event-handler attributes into SVG breadcrumb elements.

The Vue I18n sanitizer fails to neutralize the iframe srcdoc attribute when escapeParameter is enabled, allowing attackers to bypass protections and perform DOM-based XSS via injected HTML.

A public exploit for CVE-2025-66849 has been published. The vulnerability is a stored XSS in the Ghost CMS HTML block that allows a Contributor to perform unauthorized actions by executing JavaScript in the context of an Owner account.

The VikRentCar plugin for WordPress (<= 1.4.8) contains a CSRF vulnerability in the condtext_update_tmpl function that permits unauthenticated attackers to achieve remote code execution by injecting PHP code into template files.

The Prime Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to inject malicious HTML attributes that execute in the context of victim browsers.

The MxChat AI Chatbot plugin for WordPress is vulnerable to unauthenticated stored DOM-based XSS, allowing script injection via the feedback parameter that executes in an administrator's session.

The affiliate-toolkit WordPress plugin contains a stored XSS vulnerability in the atkp_product_producturl parameter, allowing unauthenticated or contributor-level attackers to inject arbitrary web scripts.

TinyMCE is vulnerable to stored Cross-Site Scripting (XSS) via the media plugin, allowing attackers to inject malicious scripts through the data-mce-object attribute before sanitization occurs.

GFI KerioConnect versions before 10.0.8 Patch 2 are susceptible to stored XSS via maliciously crafted SVG attachments, allowing attackers to execute arbitrary JavaScript in authenticated user sessions.

Multiple vulnerabilities in GLPI allow remote attackers to perform SQL injection, cross-site scripting, and security policy bypass, resulting in data integrity loss.

The School Fees Management System version 1.0 is vulnerable to stored cross-site scripting (XSS) via the tname parameter in the new_term administrative component.

Onyx Craft versions through 5.0.0 contain a stored Cross-Site Scripting vulnerability in the output preview panel caused by insecure iframe sandbox configuration, allowing malicious preview content to access the parent document DOM.

LibreNMS versions through 24.9.1 are vulnerable to a reflected cross-site scripting (XSS) attack via the routing module, enabling remote attackers to execute arbitrary JavaScript in the context of an authenticated user session.

OpenPetra version 2023.02 contains an unauthenticated XSS vulnerability in the serverMFinDev.asmx component that allows attackers to steal user session cookies.

A reflected cross-site scripting (XSS) vulnerability in the Zenario CMS Organizer spare alias feature allows authenticated users to execute arbitrary JavaScript within the administrative interface.

An incomplete URL sanitization routine in the Instatic isSafeUrl() function allows stored Cross-Site Scripting (XSS) via leading C0 control characters, enabling low-privileged users to achieve administrative account compromise.

Appsmith versions 1.95 and earlier are vulnerable to a stored XSS in the Table Widget component, allowing an authenticated attacker to perform administrative account takeover via session-based privilege escalation.

baserCMS versions 5.0.0 through 5.3.1 and 5.4.0 through 5.4.1 contain an SQL injection vulnerability in the Admin and Api/Admin interfaces allowing authenticated users to execute arbitrary SQL queries.

AivahThemes Hostme version 7.0 and earlier contains a DOM-based cross-site scripting vulnerability resulting from improper input sanitization during web page generation.

The Anti-Spam by CleanTalk plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session via the 'user_email' parameter.

OpenCATS versions prior to 0.12.0 are vulnerable to a stored cross-site scripting flaw that allows authenticated users to execute arbitrary JavaScript in the sessions of other users, including administrators.

Xxyopen Novel version 3.5.0 contains a DOM-based Cross-Site Scripting vulnerability in its comment module, allowing attackers to execute arbitrary JavaScript in the context of other users' sessions.

The Jane Menu WordPress plugin prior to 1.5.1 contains a vulnerability allowing unauthenticated attackers to perform Stored Cross-Site Scripting via improper capability and nonce checks in a form handler.

A Cross-Site Request Forgery (CSRF) vulnerability in the VikRentCar WordPress plugin (versions 1.4.8 and earlier) allows unauthenticated attackers to perform unauthorized administrative actions.

A logic error in the Stormshield Network Security (SNS) dynamic data file signature verification routine allows attackers to bypass validation and inject unauthenticated updates during the autoupdate process.

CVE-2025-3568 allows an authenticated low-privileged user to perform an administrative account takeover in Krayin CRM 2.0.0 and 2.1.0 by leveraging SVG-based XSS to bypass password verification controls.

CVE-2022-34961 is a stored cross-site scripting vulnerability in Open Source Social Network version 6.3 that allows authenticated attackers to execute malicious scripts via the location input field in the Users Timeline module.

IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability allowing authenticated attackers to inject and execute malicious JavaScript.

The Quiz Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper input sanitization, potentially allowing attackers to execute arbitrary scripts in a user’s browser.

CVE-2026-110897 is a stored Cross-Site Scripting (XSS) vulnerability in the PowerPack Lite for Beaver Builder WordPress plugin that allows unauthenticated or low-privileged attackers to execute arbitrary scripts in a victim's browser session.

A stored cross-site scripting (XSS) vulnerability (CVE-2026-110382) in the Simply Schedule Appointments WordPress plugin allows unauthenticated or low-privileged users to inject malicious scripts into administrative pages.

CVE-2026-109894 is a critical SQL injection vulnerability in the Arraytics Booktics plugin that allows unauthenticated attackers to execute arbitrary database queries.

PAYCOMET for WooCommerce versions 5.45 and earlier are vulnerable to reflected cross-site scripting (XSS), allowing unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.

An unauthenticated stored XSS vulnerability in the User Registration & Membership plugin allows attackers to inject arbitrary scripts via the checkbox field due to missing nonce validation.

An unauthenticated Stored Cross-Site Scripting vulnerability in The EU VAT Assistant for WooCommerce plugin (<= 2.1.30.260413) allows attackers to inject malicious scripts that execute in the administrator's context, potentially leading to account takeover.

The LearnPress WordPress plugin is vulnerable to Stored Cross-Site Scripting via the 'quantity' and 'order_comments' parameters, allowing script injection by unauthenticated or low-privileged users.

The WP Sessions Time Monitoring Full Automatic WordPress plugin up to version 1.1.5 is vulnerable to stored XSS via multiple input parameters, allowing unauthenticated attackers to execute arbitrary scripts in the context of user sessions.

An unauthenticated stored cross-site scripting vulnerability in the User Registration PRO premium WordPress plugin allows attackers to inject malicious scripts via the HTTP Referer header.

The WPConsent WordPress plugin up to version 1.1.9 is vulnerable to stored Cross-Site Scripting (XSS) via mXSS, allowing unauthenticated attackers to execute arbitrary scripts in a user's browser session.

An unauthenticated Stored Cross-Site Scripting (XSS) vulnerability in HivePress plugin versions 1.7.32 and earlier allows attackers to inject malicious scripts into attribute fields.

An unauthenticated Stored XSS vulnerability in the Salon Booking System WordPress plugin allows attackers to inject malicious scripts into checkout fields.

The SiteOrigin CSS WordPress plugin contains a stored DOM-based XSS vulnerability via the 'url' parameter, allowing unauthenticated attackers to execute arbitrary web scripts.

The Simply Schedule Appointments WordPress plugin is vulnerable to stored XSS via the 'status' parameter, allowing unauthenticated attackers to execute arbitrary scripts in an administrator's browser session.

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (<= 7.5.5) is vulnerable to Stored XSS due to improper input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via comment content.

An unauthenticated stored XSS vulnerability in the Flying Scripts WordPress plugin (CVE-2026-109990) allows attackers to execute arbitrary JavaScript by bypassing core sanitization through an output-buffer rewriter.

The RSS Aggregator by Feedzy WordPress plugin is vulnerable to Stored Cross-Site Scripting via malicious RSS feed input, allowing unauthenticated attackers to execute arbitrary scripts in the context of the target site.

An unauthenticated reflected XSS vulnerability (CVE-2026-104252) in the Vitess vttablet twopczHandler allows attackers to execute arbitrary JavaScript in the context of an operator's session, potentially exposing sensitive debug information.

A critical reflected XSS vulnerability (CVE-2026-102989) in TanStack Start server-functions allows unauthenticated attackers to execute arbitrary JavaScript in the context of the application origin.

The Mang Board WP plugin for WordPress through version 2.4.0 is vulnerable to stored cross-site scripting (XSS) via the 'data_type' parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

The Premium Packages - Sell Digital Products Securely plugin for WordPress is vulnerable to unauthenticated stored cross-site scripting (XSS) via the 'order_email' parameter due to insufficient input validation.

An unencoded exception reflection vulnerability in the Blazor WebAssembly development server allows remote attackers to perform cross-site scripting (XSS) via the unauthenticated /_framework/debug endpoint.

An unauthenticated stored XSS vulnerability in AcyMailing WordPress plugin version 11.1.0 and earlier allows attackers to inject malicious scripts via the customField[] parameter.

EdgeEver versions 1.112.0 and earlier contain a stored XSS vulnerability in the setMemoDragPreview function that allows for session token theft via malicious notebook or memo titles.

The HivePress WordPress plugin for versions 1.7.31 and below contains a stored Cross-Site Scripting (XSS) vulnerability that allows unauthenticated attackers to execute arbitrary scripts in the context of user profiles.

An unauthenticated stored XSS vulnerability in WP Photo Album Plus <= 9.3.03.002 allows attackers to inject malicious scripts via REQUEST_URI session history due to insecure output rendering.

The WPAdverts plugin for WordPress contains a stored XSS vulnerability (CVE-2026-100178) that allows unauthenticated attackers to inject malicious scripts via the 'adverts_location' parameter.

The WP Meteor Website Speed Optimization Addon for WordPress versions 3.4.18 and earlier contains a Stored XSS vulnerability allowing unauthenticated attackers to inject malicious scripts via the comment author name field.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress up to version 1.8.15 contains a Stored XSS vulnerability in the 'attachments[name]' parameter that allows unauthenticated attackers to inject malicious scripts.

The LazyLoad Plugin for WordPress up to version 2.4.0 is vulnerable to Stored Cross-Site Scripting (XSS) due to improper sanitization of the comment_content parameter, allowing attackers to inject malicious scripts that execute upon administrator approval.

The Presto Player WordPress plugin is vulnerable to Stored Cross-Site Scripting via the presto-player tag, allowing unauthenticated attackers to execute arbitrary web scripts.

The Real Estate Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization of the first_name parameter, allowing unauthenticated attackers to bypass reCAPTCHA and execute arbitrary scripts.

The Podlove Podcast Publisher plugin for WordPress contains an unauthenticated Stored XSS vulnerability in the Auphonic Webhook implementation, allowing for arbitrary script injection via crafted POST requests.

An unauthenticated stored XSS vulnerability in the Easy Digital Downloads WordPress plugin allows attackers to inject malicious scripts via PayPal IPN parameters.

The @tinacms/web-components package is vulnerable to stored Cross-Site Scripting (XSS) due to a failure to validate URL schemes in the tina-markdown component, allowing attackers to execute arbitrary code in the browser context of site visitors.

An unauthenticated stored XSS vulnerability in the Contao comments-bundle allows remote attackers to execute arbitrary JavaScript in the context of administrative sessions, potentially leading to full system compromise.

AstronRPA versions 1.1.6 and earlier contain a cross-site scripting vulnerability in the smart-component chat that allows remote attackers to trigger arbitrary OS command execution by injecting malicious prompt content.

JHipster is affected by multiple vulnerabilities allowing a remote, authenticated attacker to execute Cross-Site Scripting (XSS) or SQL Injection attacks, compromising application integrity.

The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress are vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the Popup Builder's save_popup_content AJAX action.

IBM Guardium Data Protection 12.2.2 is susceptible to an unauthenticated remote denial-of-service attack via malformed gRPC task data that causes the edge-controller process to crash.

IBM DataPower Gateway versions 10.6.0.0 through 10.6.0.10 contain a reflected cross-site scripting (XSS) vulnerability allowing unauthenticated remote attackers to execute arbitrary JavaScript in the Web UI.

Ghost versions 6.22.1 through 6.64.0 are vulnerable to stored cross-site scripting due to improper Content-Type handling in the local storage adapter, allowing staff-level users to execute malicious scripts on the site domain.

A vulnerability in Payload CMS versions 3.x and 4.x-canary allows unauthorized users with document read permissions to access active API keys stored within authentication collections.

The Post SMTP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the user_email parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative log views.

An insufficient character blacklist in @vue/server-renderer allows attackers to inject arbitrary HTML attributes by including carriage return characters in dynamic binding keys.

A vulnerability in the Zabbix Frontend allows a remote, authenticated attacker to execute arbitrary scripts in a user's browser via a Cross-Site Scripting (XSS) attack.

An authenticated attacker can exploit a vulnerability in SmarterTools SmarterMail to bypass security controls and hijack other user accounts via identity impersonation.

IBM Business Process Manager contains multiple cross-site scripting vulnerabilities that allow an unauthenticated remote attacker to inject malicious scripts into user sessions.

A vulnerability in the jQuery library allows remote, anonymous attackers to conduct a cross-site scripting (XSS) attack by exploiting DOM manipulation and event handling flaws.

The WP Mail Catcher plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via inadequate sanitization of PHPMailer error messages, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative sessions.

The Strong Testimonials WordPress plugin (up to version 3.3.11) is vulnerable to stored Cross-Site Scripting (XSS) via the 'platform_user_photo' custom field, allowing unauthenticated attackers to execute malicious scripts in victims' browsers.

An unauthenticated stored XSS vulnerability in The Transliterator plugin (<= 2.5.8) allows attackers to inject malicious JavaScript into WordPress comments, leading to arbitrary code execution in the context of site viewers.

A stored XSS vulnerability in SEOPress versions up to 10.2 allows unauthenticated attackers to execute arbitrary scripts by injecting malicious code into the Author Display Name field.

An unauthenticated Stored Cross-Site Scripting vulnerability in the GD Rating System plugin for WordPress allows attackers to execute arbitrary JavaScript via the gdrts_live_handler AJAX action by bypassing a trivially accessible nonce.

An unauthenticated stored Cross-Site Scripting vulnerability in the Welcart e-Commerce WordPress plugin allows attackers to inject malicious scripts via settlement notification parameters.

The Real Cookie Banner plugin (<= 5.3.5) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via inadequate input sanitization in comment anchor tags, allowing unauthenticated attackers to execute arbitrary scripts in the browser context of site visitors.

The Ultimate Member WordPress plugin (<= 2.13.1) contains a stored XSS vulnerability in the form_id parameter, allowing unauthenticated attackers to execute arbitrary scripts in the administrator dashboard.

The @a2ui/web_core package (CVE-2026-10032) contains a critical cross-site scripting (XSS) vulnerability in the openUrl function, allowing arbitrary JavaScript execution via agent-supplied javascript: URIs.

CVE-2025-22131 is a stored cross-site scripting vulnerability in PHPOffice PhpSpreadsheet caused by improper sanitization of XLSX sheet names in navigation HTML, allowing for session cookie theft.

An unauthenticated stored XSS vulnerability in the JetAppointment WordPress plugin allows attackers to inject malicious scripts via the friendlyTime parameter that execute in an administrator's browser context.

The W3 Total Cache plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, CVE-2026-87920, allowing unauthenticated attackers to execute arbitrary web scripts via flawed Output-Buffer Regex rewriting.

The CMB2 plugin for WordPress (<= 2.13.0) is vulnerable to Stored XSS via the file_list field type, allowing unauthenticated attackers to inject malicious scripts into public-facing forms or user meta boxes.

The GSpeech TTS plugin for WordPress (<= 3.22.0) is vulnerable to Stored Cross-Site Scripting via improper input sanitization and output-buffer manipulation, allowing unauthenticated attackers to execute arbitrary JavaScript.

The MW WP Form WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization of the 'post_id' parameter, enabling unauthenticated attackers to bypass CSRF protections and execute arbitrary scripts in victim sessions.

The Relevanssi plugin for WordPress is vulnerable to stored Cross-Site Scripting (XSS) due to insufficient input sanitization of comment content, allowing unauthenticated attackers to execute arbitrary scripts.

An unauthenticated stored XSS vulnerability in the JetFormBuilder WordPress plugin allows attackers to inject arbitrary web scripts via the 'choice' Post Meta field.

The Mang Board plugin for WordPress (<= 2.4.2) is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'data_type' parameter, allowing attackers to inject malicious scripts that execute in the context of user browsers.

The Newsletter plugin for WordPress versions <= 9.4.0 is vulnerable to Stored XSS via the 'np1' parameter, allowing unauthenticated attackers to execute arbitrary scripts due to missing input sanitization and endpoint security controls.

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts in the browsers of site visitors.

The No External Links WordPress plugin (<= 5.2.0) is vulnerable to Stored Cross-Site Scripting (XSS) via the /goto/ redirect feature, allowing unauthenticated attackers to inject malicious scripts.

The Smash Balloon Social Post Feed WordPress plugin is vulnerable to Stored XSS that can be escalated to arbitrary plugin installation and remote code execution.

Relevanssi Premium for WordPress versions 2.31.4 and earlier contain a stored cross-site scripting vulnerability in the click-tracking feature that allows unauthenticated attackers to execute arbitrary web scripts.

The Download Monitor plugin for WordPress versions up to 5.2.10 is vulnerable to Stored Cross-Site Scripting via a malicious postMessage injection that executes when an administrator interacts with a compromised download object.

The Kubio AI Page Builder plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability in the 'comment' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of victim browsers.

The BA Book Everything plugin for WordPress contains a Stored XSS vulnerability in the booking_service_qty parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of an administrator.

The Ninja Forms WordPress plugin versions 3.15.4 and earlier contain a stored Cross-Site Scripting vulnerability allowing unauthenticated attackers to inject malicious scripts via Paragraph Text fields with Rich Text Editor enabled.

The Visitors Traffic Real Time Statistics Pro WordPress plugin contains an unauthenticated stored XSS vulnerability allowing remote attackers to execute arbitrary JavaScript in the context of an administrator's browser.

A vulnerability in Ghost versions 5.2.0 through 6.61.9 allows unauthenticated remote attackers to manipulate Stripe Checkout flows to modify member records and inject malicious content into newsletters.

The Business Essentials for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization in the gateway field.

The Form Maker by 10Web WordPress plugin contains a stored cross-site scripting vulnerability in longitude and latitude fields that allows unauthenticated attackers to execute arbitrary scripts in the context of other users.

The Appointment Hour Booking plugin for WordPress is vulnerable to Stored DOM-based XSS via the Schedule Calendar List Renderer due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts.

The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via billing fields, allowing unauthenticated attackers to execute arbitrary scripts in administrative sessions.

The Extendify plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the 'styles.blocks' parameter, allowing arbitrary script injection.

The AI Engine plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to achieve arbitrary script execution in an administrator's browser session.

A stored cross-site scripting (XSS) vulnerability in the CommonsMetadata component, tracked as CVE-2026-103584, allows attackers to inject 'javascript:' URIs into image metadata, leading to unauthorized script execution in the wiki origin.

A stored XSS vulnerability in the PageForms extension allows attackers with page-edit permissions to inject malicious javascript: URIs via the redirect parameter.

An unauthenticated stored XSS vulnerability in the Post Views Stats Counter WordPress plugin (<= 1.1.7) allows attackers to inject malicious JavaScript into the administrator's dashboard via the User-Agent header.

An unauthenticated stored DOM-based XSS vulnerability in the Frontend Post Submission Manager Lite plugin (<= 1.3.4) allows script injection via the post_content parameter when guest submissions are enabled.

Angular platform-server is vulnerable to XSS when ProcessingInstruction nodes containing untrusted input are nested within fallback raw-content elements during server-side rendering.

An unauthenticated stored cross-site scripting vulnerability in the Grav Data Manager plugin allows attackers to execute malicious JavaScript in the context of an administrator's session.

SiYuan versions prior to v3.8.4 are vulnerable to a path traversal attack via the exportBrowserHTML endpoint, allowing authenticated administrators to overwrite arbitrary index.html files.

A stored XSS vulnerability in the Code16 Sharp rich text editor allows authenticated attackers to execute arbitrary JavaScript by exploiting browser-side HTML entity decoding within the iframe srcdoc attribute.

The EmbedVideo MediaWiki extension contains a stored Cross-Site Scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into wiki pages when the configuration $wgEmbedVideoRequireConsent is disabled.

A vulnerability in the CirrusSearch extension for MediaWiki allows remote, unauthenticated attackers to execute cross-site scripting (XSS) attacks through improper input sanitization.

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter, allowing unauthenticated attackers to inject malicious scripts that execute in the context of administrator sessions.

The AMP for WP WordPress plugin is vulnerable to stored Cross-Site Scripting via insufficient sanitization of comment content, allowing unauthenticated attackers to execute arbitrary web scripts.

An unauthenticated Stored Cross-Site Scripting vulnerability in Zero Spam for WordPress (CVE-2026-96752) allows attackers to inject malicious scripts into logs via nested POST array keys in Contact Form 7 submissions.

Themify Builder versions 7.8.1 and earlier are vulnerable to Stored Cross-Site Scripting (XSS) via the css[fonts] parameter, allowing unauthenticated attackers to inject malicious scripts due to exposed nonces.

An unauthenticated stored DOM-based cross-site scripting vulnerability in the HT Contact Form plugin for WordPress allows attackers to execute arbitrary scripts via crafted draft resume URLs.

An unauthenticated stored cross-site scripting vulnerability in the Fancy Product Designer WordPress plugin allows attackers to inject malicious scripts via the output_format parameter.

Snipe-IT contains a stored XSS vulnerability in the uploaded-files API due to the failure to apply safe-inline allowlists to XML documents, allowing authenticated attackers to execute arbitrary JavaScript in the victim's session context via CVE-2026-63498.

SunEditor versions up to 2.47.10 contain a critical XSS vulnerability (CVE-2026-59167) where insufficient sanitization of namespaced HTML tags allows for arbitrary JavaScript execution via event-handler attributes.

Authenticated users can achieve arbitrary code execution in OpenC3 COSMOS by writing malicious payloads into user-writable configuration overlays that are subsequently rendered as code by the application.

Home Assistant contains a stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-91130) in the Statistics Graph card, allowing arbitrary JavaScript execution when viewing entities with malicious names.

OpenPLC Runtime v3 contains a cross-site scripting vulnerability that allows attackers to hijack operator session cookies and issue unauthorized commands to industrial control processes.

The WPC Product Bundles for WooCommerce plugin for WordPress is vulnerable to Stored XSS via the 'qty' parameter, allowing unauthenticated attackers to execute arbitrary scripts in the context of administrative or user sessions.

CVE-2026-94504 describes a stored cross-site scripting vulnerability in Ninja Forms version 3.15.3, allowing attackers to execute arbitrary scripts in an administrator's browser session via the legacy submission editor.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the Translation Memory Suggestion Panel, allowing unauthenticated attackers to execute arbitrary scripts in administrator sessions.

An authenticated remote attacker can exploit a vulnerability in Grafana to execute a Cross-Site Scripting (XSS) attack by injecting malicious scripts into the application.

The Quill Forms WordPress plugin (<= 5.7.1) contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious JavaScript via form entry fields.

Multiple vulnerabilities in the jQuery library allow remote, anonymous attackers to conduct Cross-Site Scripting (XSS) attacks by injecting malicious scripts into victim browser sessions.

The Semantic MediaWiki smwtask API module fails to enforce authorization, enabling unauthenticated remote attackers to perform sensitive information disclosure, queue administrative maintenance jobs, and manipulate stored semantic data.

The Jeg Kit for Elementor plugin for WordPress contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to execute arbitrary scripts when a specific widget is rendered.

Ourphp versions 7.2.0 and earlier are vulnerable to reflected cross-site scripting (XSS) via the 'out' parameter in the 'ourphp_out.php' endpoint, allowing unauthorized script execution in a victim's browser session.

The Complianz GDPR/CCPA Cookie Consent Banner plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the Elementor Cookie Blocker, allowing attackers to execute arbitrary JavaScript in the context of an administrator-approved comment.

An improper CSRF protection flaw in django-page-cms versions up to 2.0.13 enables attackers to force authenticated editors to inject stored XSS payloads.

A stored Cross-Site Scripting (XSS) vulnerability in the Vendure Admin Dashboard allows authenticated administrators to execute arbitrary JavaScript in the context of other users viewing entity lists, leading to potential account takeover.

SiYuan versions prior to 3.8.4 contain a cross-site scripting vulnerability in bookmark label rendering that enables remote code execution due to insecure Electron configuration.

The @nuxtjs/mdc package contains an XSS vulnerability (CVE-2026-63671) due to improper sanitization of SVG xlink:href attributes and iframe data:text/html sources during markdown parsing.

A vulnerability in djust caused multi-tenant isolation to fail open on WebSocket and SSE paths, allowing unauthorized cross-tenant data disclosure due to improper tenant context propagation.

Flowise versions before 3.1.4 contain authorization gaps in Enterprise endpoints that allow authenticated users to perform cross-tenant operations including unauthorized workspace deletion and SSO credential access.

An unauthenticated remote attacker can exploit a reflected XSS vulnerability in the Teamcenter authentication redirect flow to execute arbitrary JavaScript in the context of an authenticated user session.

The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe webhook listener due to missing signature verification and improper output sanitization.

A vulnerability in the Governikus AusweisApp2 software allows a remote, unauthenticated attacker to execute a Cross-Site Scripting (XSS) attack.

CVE-2026-90943 is a stored cross-site scripting vulnerability in filament-comments <= 3.0.0, allowing authenticated users to inject malicious scripts into comment bodies for execution in the browsers of other users.

Amundsen frontend versions through 4.3.0 allow Stored Cross-Site Scripting via unsanitized rendering of metadata descriptions, enabling arbitrary JavaScript execution in victim browsers.

The Kirki plugin for WordPress version 6.2.0 and below is susceptible to unauthenticated Stored Cross-Site Scripting (XSS) via the 'comment' parameter, potentially leading to unauthorized script execution in administrative or user sessions.

The Simple Ajax Chat plugin for WordPress contains a stored cross-site scripting vulnerability in versions <= 20260811, allowing unauthenticated attackers to inject malicious scripts due to exposed nonces and insufficient input sanitization.

The Vigilant security plugin for WordPress version 2.10.2 and earlier is vulnerable to Stored Cross-Site Scripting via the User-Agent header, allowing unauthenticated attackers to execute arbitrary scripts in the dashboard.

An unauthenticated stored XSS vulnerability in WP Photo Album Plus versions 9.2.08.003 and earlier allows attackers to inject malicious scripts via the HTTP_X_FORWARDED_FOR header, which is logged without sanitization.

An insecure sandbox configuration in the Open WebUI terminal port preview feature allows authenticated users to execute arbitrary JavaScript in the application's origin, leading to session token theft and account takeover.

Joplin is affected by multiple vulnerabilities that allow a remote attacker to execute arbitrary code, escalate privileges, bypass security controls, perform cross-site scripting (XSS), or manipulate sensitive data, potentially leading to a full account takeover.

The Sidebar Manager Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization of the sbm_description parameter, allowing unauthenticated attackers to execute arbitrary scripts in victim browsers.

A stored cross-site scripting (XSS) vulnerability in the PAN-OS web interface allows an authenticated administrator to execute arbitrary JavaScript within the context of the management interface.

The WPBot - AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 8.7.3, allowing unauthenticated attackers to execute arbitrary web scripts.

The Repeater Fields for Gravity Forms plugin for WordPress is vulnerable to Stored XSS due to improper sanitization of multi-input sub-fields, allowing unauthenticated attackers to execute arbitrary JavaScript.

The Contact Form to DB WordPress plugin (<= 1.7.5) is vulnerable to unauthenticated Stored Cross-Site Scripting via the cntctfrm_contact_dropdown parameter, allowing attackers to execute scripts in an administrator's browser session.

The @xmldom/xmldom library fails to validate attribute names during the use of Element.setAttribute, allowing attackers to inject malicious attributes into serialized XML output leading to potential XSS.

The xmldom serializer fails to properly validate element and attribute names when the requireWellFormed option is enabled, allowing attackers to inject arbitrary markup via line-terminated strings.

The @xmldom/xmldom library fails to validate the target parameter in createProcessingInstruction, enabling attackers to break out of XML processing instructions and inject arbitrary content when serializing with the requireWellFormed flag.

The SVGO 'removeScripts' plugin is vulnerable to XSS bypasses due to insufficient validation of namespace-prefixed SVG anchors and control-character obfuscation in URL schemes, potentially allowing script execution when untrusted SVG content is rendered.

An improper iteration pattern over live NamedNodeMap objects in MapLibre GL JS allows attackers to bypass XSS sanitization by injecting consecutive malicious attributes, resulting in zero-click execution when rendered.

The User Profile Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient input sanitization, allowing unauthenticated attackers to execute arbitrary scripts via the 'Biographical Info' field.

An unauthenticated XSS vulnerability in the AVideo YPTSocket plugin allows attackers to execute arbitrary JavaScript in victim browsers via crafted websocket callback messages.

The Contact Form by Supsystic WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting due to insufficient sanitization of X-Forwarded-For headers.

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the LazyLoad Background Mutator, allowing unauthenticated attackers to execute arbitrary scripts after moderator approval.

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to stored cross-site scripting via insufficient input sanitization in the comment content aria-label placeholder, allowing attackers to execute arbitrary scripts in the browsers of site visitors.

An unauthenticated stored XSS and arbitrary file write vulnerability in Ninja Forms versions 3.15.1 and earlier allows attackers to inject malicious scripts by exploiting input validation flaws in the File Uploads add-on.

An unauthenticated Stored Cross-Site Scripting vulnerability in the SureForms WordPress plugin (up to 2.12.2) allows attackers to inject malicious scripts that execute in victim browsers.

The QuickCal WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via custom field parameters, allowing attackers to execute arbitrary scripts in the context of site users.

The iubenda All-in-one Compliance for GDPR / CCPA Cookie Consent plugin for WordPress contains a stored XSS vulnerability in versions 3.13.4 and earlier, allowing unauthenticated attackers to inject malicious scripts when the Secondary parser engine is enabled.

Grav Shortcode Core versions prior to 6.2.5 are vulnerable to stored cross-site scripting (XSS) due to improper input sanitization in the [lorem] and [details] tags.

DPCalendar Free versions 10.11.2 and earlier contain a stored XSS vulnerability in the location title field, allowing an Author-role user to bypass content moderation and execute arbitrary JavaScript in the browsers of site visitors.

PodcastGenerator version 3.2.9 contains a stored Cross-Site Scripting (XSS) vulnerability allowing unauthenticated attackers to inject malicious scripts into the application.

An XSS vulnerability in league/commonmark allows attackers to execute arbitrary JavaScript by prepending a U+000C form feed character to malicious attribute names, bypassing security filters in the AttributesExtension.

An arbitrary file upload vulnerability in the Gravity Forms WordPress plugin (<= 3.0.2) allows unauthenticated attackers to write arbitrary files to the temporary upload directory, potentially leading to remote code execution or stored XSS.

Bludit CMS version 3.22.0 contains a stored XSS vulnerability in its SVG upload process, allowing attackers to execute arbitrary JavaScript via malicious XML processing instructions.

An unauthenticated stored XSS vulnerability in the Welcart e-Commerce WordPress plugin (CVE-2026-19914) allows attackers to inject malicious scripts that execute in the context of administrative sessions.

An unauthenticated stored XSS vulnerability in the Listdom WordPress plugin allows attackers to inject arbitrary scripts when specific premium add-ons are enabled.

The Affiliate Super Assistent plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability via the doCommentShortcode function, allowing unauthenticated attackers to execute arbitrary scripts in the context of a victim's session.

An authenticated SQL injection vulnerability in CubeCart 6.7.4 allows administrative users to execute arbitrary SQL commands due to improper sanitization of the download_expire parameter.

C-MOR Video Surveillance versions up to 6.0104 are vulnerable to an unauthenticated directory traversal attack in the show-movies.pml component, allowing remote attackers to read arbitrary files.

Agentejo Cockpit CMS versions up to 2.6.3 contain a stored XSS vulnerability via the asset upload endpoint, allowing attackers to execute arbitrary JavaScript by uploading and accessing malicious .shtml files.

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

A stored cross-site scripting (XSS) vulnerability in Phpgurukul Teachers Record Management System version 1.0 allows authenticated administrators to execute arbitrary JavaScript in the context of other users.

WP Rocket versions up to and including 3.21.0.1 are vulnerable to unauthenticated Stored Cross-Site Scripting via the rocket_beacon AJAX endpoint.

SiYuan versions prior to 3.8.1 are vulnerable to server-side request forgery through a DNS rebinding attack, enabling unauthorized access to cloud metadata services and internal network resources.

An unauthenticated stored Cross-Site Scripting (XSS) vulnerability in the Amelia WordPress plugin allows attackers to inject malicious scripts into appointment bookings, which execute in an administrator's browser context.

An improper input neutralization vulnerability (CVE-2026-40541) in Synology Chat Server allows authenticated remote attackers to achieve arbitrary file access and denial-of-service within the DSM environment.

The Optimole WordPress plugin is vulnerable to stored cross-site scripting due to improper sanitization of the above_fold_images parameter, allowing unauthenticated attackers to execute arbitrary JavaScript in victim browsers.

The TranslatePress plugin for WordPress is vulnerable to unauthenticated stored XSS through improper sanitization of comment data, allowing attackers to inject persistent malicious scripts.

An unauthenticated stored XSS vulnerability in LiteSpeed Cache versions 7.8.1 and below allows attackers to inject malicious scripts into WordPress comments by bypassing wp_kses input sanitization.

The Forminator Forms WordPress plugin (up to v1.57.0.1) is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) via the Rich-Text Textarea field, allowing malicious script execution in the context of victim browsers.

A stored cross-site scripting (XSS) vulnerability in the si-map component of Element maps-ng allows unauthenticated attackers to execute arbitrary scripts in a victim's browser via crafted map pin tooltips.

CVE-2024-5961 is a reflected cross-site scripting (XSS) vulnerability in 2ClickPortal versions 7.2.31 through 7.6.4, enabling arbitrary script execution via the search function parameter.

A vulnerability in the Plate @platejs/media package allows attackers to bypass URL sanitization and achieve Cross-Site Scripting (XSS) by embedding malicious JavaScript URIs in media documents (CVE-2026-55596).

The NotificationX Pro plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to improper input sanitization and output escaping in versions up to and including 3.1.4.

Heptabase contains a stored cross-site scripting (XSS) vulnerability allowing authenticated remote attackers to execute arbitrary JavaScript in the context of other users.

The justhtml library before version 1.15.0 contains multiple vulnerabilities in URL sanitization, HTML serialization, and Markdown passthrough that allow attackers to inject malicious HTML and JavaScript.

J2Commerce versions 4.1.5 and earlier are vulnerable to stored XSS via guest checkout, allowing unauthenticated attackers to execute malicious JavaScript in the administrator's browser upon order review.

The YOURLS URL shortener is vulnerable to stored cross-site scripting (XSS) via the Referer header, allowing unauthenticated attackers to execute arbitrary JavaScript in an administrator's browser context.

IBM App Connect Enterprise contains a vulnerability, identified as CVE-2024-44280, that allows a remote, anonymous attacker to execute Cross-Site Scripting (XSS) attacks within the context of the affected application.

An authenticated administrator can execute arbitrary code on LibreNMS servers by injecting commands into the Signal Alert Transport configuration fields, triggering unsafe system exec calls.

An authenticated, remote attacker can exploit a flaw in Grafana to perform unauthorized information disclosure due to improper access control.

The Infility Global WordPress plugin is vulnerable to Stored XSS via the /cf7_record endpoint, allowing unauthenticated attackers to execute arbitrary scripts in the context of authenticated users.

An unauthenticated stored Cross-Site Scripting vulnerability in the Platnosci Online Blue Media WordPress plugin allows attackers to inject malicious scripts into the checkout page.

A stored cross-site scripting (XSS) vulnerability in the vcita WordPress plugin up to version 4.6.0 allows unauthenticated attackers to inject arbitrary scripts via the 'business_id' parameter.

A stored Cross-Site Scripting (XSS) vulnerability (CVE-2026-34491) in Johnson Controls Metasys allows low-privileged users to execute arbitrary scripts in the context of other users' sessions, potentially leading to session hijacking.

SiYuan versions prior to 3.7.4 contain an authentication bypass vulnerability allowing unauthenticated remote attackers to retrieve decrypted content from encrypted notebooks.

CamaleonCMS versions 2.9.2 and earlier are vulnerable to privilege escalation via an IDOR parameter confusion flaw in the UsersController, allowing authenticated attackers to overwrite arbitrary user credentials.

An unauthenticated arbitrary file write vulnerability (CVE-2026-72748) in the AVideo aVideoEncoderChunk.json.php endpoint allows remote attackers to upload arbitrary content to the server, potentially leading to remote code execution.

A vulnerability in the jsoup library allows a remote attacker to execute arbitrary scripts in the context of a user's browser via Cross-Site Scripting (XSS).

An unauthenticated stored cross-site scripting vulnerability in FormGent versions 1.9.2 and below allows attackers to inject malicious scripts into form fields that execute upon viewing.

The TranslatePress plugin for WordPress is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization of URL-encoded gettext markers, allowing unauthenticated attackers to inject persistent malicious scripts.

An unauthenticated stored cross-site scripting vulnerability in the FluentSMTP WordPress plugin allows attackers to inject malicious scripts into email logs that execute in an administrator session.

An XSS vulnerability in the @tryghost/activitypub package (CVE-2026-53950) allows attackers to inject arbitrary JavaScript via malicious ActivityPub server posts.

Authenticated users can bypass SSRF protection in Open WebUI by wrapping internal IPv4 addresses in NAT64 IPv6 transition prefixes, allowing unauthorized access to cloud metadata and internal network services.

LibreNMS versions prior to 26.5.0 are affected by multiple vulnerabilities including RCE, SSRF, and XSS, posing a significant risk for unauthorized system access and network reconnaissance.

A Cross-Site Scripting (XSS) vulnerability in @angular/platform-server (CVE-2026-69149) allows script injection via improper serialization of fallback raw-content elements during server-side rendering.

The better-auth library fails to validate redirect_uri schemes in its oidc-provider and mcp plugins, allowing attackers to inject javascript: URIs that lead to XSS and potential account takeover.

An unauthenticated stored XSS vulnerability in the OpenClaw Dashboard allows remote attackers to execute arbitrary JavaScript in administrative sessions via the sessions API.

IBM Tivoli System Automation Application Manager 4.1 and WebSphere Application Server are affected by a reflected cross-site scripting vulnerability in the administrative console login page that allows unauthenticated attackers to execute arbitrary JavaScript.

VaahCMS versions 2.0.0 through 2.3.4 contain a malicious obfuscated JavaScript payload in OTP email templates that executes unauthorized code in victim browsers, enabling credential theft and DOM manipulation.

An attacker can exploit multiple vulnerabilities in BlackBerry UEM Management Console to perform cross-site scripting attacks, cause a denial of service, and disclose information.

An unauthenticated attacker can exploit a Stored Cross-Site Scripting vulnerability (CVE-2026-16655) in the Fluent Forms WordPress plugin, versions up to and including 6.2.7, via insufficient input sanitization of the Name Field Nested `password` Member, allowing injection of arbitrary web scripts that execute in a user's browser upon page access.

The GTM4WP (Google Tag Manager) plugin for WordPress, in versions up to and including 1.22.3, is vulnerable to stored cross-site scripting (XSS) via CVE-2026-16597, allowing unauthenticated attackers to inject arbitrary web scripts through WooCommerce billing fields during a guest checkout, which execute when a user accesses the compromised page.

The Database for CF7 plugin for WordPress is vulnerable to stored Cross-Site Scripting (XSS) via Array Form Field Values, allowing unauthenticated attackers to inject arbitrary web scripts by sending specially crafted array-structured input to the Contact Form 7 REST API endpoint /wp-json/contact-form-7/v1/contact-forms/{id}/feedback, which are insufficiently sanitized and executed when a user accesses an affected page.

A high-severity Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-13440, exists in the StoreGrowth: Smart Sales Booster for WooCommerce WordPress plugin (versions up to and including 2.1.0) due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts via the 'message_popup' parameter that execute when a user accesses an affected page, facilitated by an exposed nonce.

An anonymous, remote attacker can exploit multiple vulnerabilities in Apache Wicket to perform Cross-Site Scripting (XSS) attacks and bypass existing security measures, potentially leading to unauthorized client-side script execution and further compromise of user sessions or data.

SiYuan before v3.7.2 is vulnerable to stored cross-site scripting (XSS) due to improper escaping of the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing attackers with editor permissions to inject malicious onload handlers that execute arbitrary code in the Electron renderer with full Node.js access, leading to remote code execution.

Authenticated attackers can exploit stored and reflected cross-site scripting (XSS) vulnerabilities, identified as CVE-2026-66394, in SiYuan versions prior to v3.7.3 by bypassing the application's SVG sanitization to execute arbitrary scripts within the application's origin, potentially leading to session hijacking and data exfiltration.

Multiple vulnerabilities have been discovered in GLPI, including SQL injection, cross-site scripting (XSS), and privilege escalation, which could allow an attacker to compromise data integrity, bypass security policies, and elevate their privileges within the system.

A critical cross-site scripting (XSS) vulnerability has been identified in Zabbix, which a remote, unauthenticated attacker can exploit to execute malicious scripts within a user's browser session, potentially leading to unauthorized actions or data theft.

Multiple vulnerabilities in OmniFaces versions prior to 1.14.3, 2.7.33, 3.14.23, 4.7.12, and 5.4.2 allow attackers to exploit forged combined-resource IDs leading to server-side request forgery (SSRF)-like behavior or information disclosure, achieve client-side arbitrary code execution via cross-site scripting (XSS) in `o:hashParam`, bypass session authentication for push channels resulting in unauthorized message interception, and cause denial-of-service (DoS) via unbounded caches.

A stored web worker XSS vulnerability, CVE-2026-59214, in Open WebUI versions prior to 0.10.0 allows a low-privileged user to inject malicious Python code into chat messages that, when executed by an administrator or privileged user via a 'Run' click, triggers authenticated same-origin requests to create server-side functions with arbitrary commands, leading to remote code execution on the Open WebUI server.

The VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to and including 1.8.13 is vulnerable to Stored Cross-Site Scripting (XSS) via the 'vbfX' parameter, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses an infected page.

A stored cross-site scripting (XSS) vulnerability, CVE-2024-58355, affects Cal.com (calcom/cal.diy) versions through 4.7.15, allowing an attacker to inject arbitrary HTML/JavaScript into a booking-question label that executes in a victim's browser when they view a crafted booking URL, potentially leading to session hijacking, data theft, or defacement.

CVE-2024-58353 describes a cross-site scripting (XSS) vulnerability in Cal.com (repository calcom/cal.diy) versions up to and including 4.7.15, where an attacker can inject malicious HTML/JavaScript into booking question labels that is then executed via React's dangerouslySetInnerHTML when a victim visits a publicly accessible single booking view, allowing for arbitrary client-side code execution, particularly impacting self-hosted instances with open registration.

A vulnerability in DOMPurify before version 3.4.11 allows attackers to achieve stored Cross-Site Scripting (XSS) by manipulating the `ALLOWED_ATTR` allowlist through an `uponSanitizeAttribute` hook, leading to client-side code execution.

Russia-aligned threat actor TA488 (Void Blizzard, Laundry Bear) exploited CVE-2025-66376, a critical XSS vulnerability in Zimbra Collaboration Suite webmail, for at least five months in 2025 via crafted emails to gain persistent access, exfiltrate user credentials, 2FA codes, and bulk emails from Ukrainian government and US defense industrial base targets.