Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.1 Medium
Kubeflow Pipelines: Reflected XSS in the frontend pod information and events error responses
- kubeflow pipelines
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
- altair
- altair-graphql altair-express-middleware
- Cross-site scripting (XSS)
- CWE-829
- CVSS 8.1 High
OpenEMR: Stored XSS via `text()` Misuse in Double-Quoted HTML Attribute
- openemr
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Cross-site scripting in OpenText Directory Services (OTDS)
- OpenText Directory Services (OTDS)
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - balbooa.com - Stored XSS in reviews via inconsistent sanitization in Gridbox < 2.20.5.0
- balbooa.com Gridbox extension for Joomla
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - balbooa.com - Unauthenticated stored XSS in the "Recent Comments / Recent Reviews" widget in Gridbox < 2.20.5.0
- balbooa.com Gridbox extension for Joomla
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6
- tassos.gr Advanced Custom Fields extension for Joomla
- tassos.gr Smile Pack extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
HomeBox: Stored XSS via `javascript:` URI in Custom Entity Fields
- sysadminsmedia homebox
- Cross-site scripting (XSS)
- CVSS 7.6 High
HeyForm: Uploaded HTML files are served as text/html on the app origin with no CSP — stored XSS
- heyform
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Huginn before 2026.11.05 Stored XSS via OAuth Service Display Name
- huginn
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
HTML Injection in Fileorbis
- Fileorbis
- Cross-site scripting (XSS)
-
Apache OFBiz: Reflected Cross-site Scripting in Catalog Image Viewer Enables Script Execution in a User Session
- Apache Software Foundation Apache OFBiz
- Cross-site scripting (XSS)
-
Apache Sling Engine: Include-protection mitigations bypassable via uncovered response-wrapper paths
- Apache Software Foundation Apache Sling Engine
- Cross-site scripting (XSS)
- CWE-693
- CVSS 10.0 CriticalCritical · CVSS 9+
Apache Juneau: Cross-site scripting via unescaped request variables in HTML-doc chrome
- Apache Software Foundation Apache Juneau
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in SHIRASAGI
- SHIRASAGI
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.16 - Authenticated (Custom+) Stored Cross-Site Scripting via theme_opts Parameter via User Profile
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.16 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'multi_media' Field Array Key
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Customer Reviews for WooCommerce <= 5.126.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slides_to_show' Shortcode Attribute
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
SourceCodester Online Food Ordering System Category Management add_category.php cross site scripting
- SourceCodester Online Food Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
VitaFit Cloud API Stored XSS via SVG File Upload
- Shenzhen Shine Industrial Co., Ltd. VitaFit
- Cross-site scripting (XSS)
- CVSS 2.3 Low
jsondiffpatch before 0.7.7 XSS via Array-Move Destination in HTML Formatters
- benjamine jsondiffpatch
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
vtenext before 25.02.2 Reflected XSS via widgetInfoList in HomeWidgetBlockList
- vtenext
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Nexus Repository 3 - Stored Cross-Site Scripting in OCI Attestations Tab
- Sonatype Nexus Repository 3
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Zammad: Stored XSS in ticket article rendering in the new Vue-based interface
- zammad
- Cross-site scripting (XSS)
- CWE-116
- CVSS 5.1 Medium
EmpireSoft EmpireCMS index.php cross site scripting
- EmpireSoft EmpireCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
InfiniFlow RAGFlow Images API file_utils.py cross site scripting
- InfiniFlow RAGFlow
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
DataGerry < 3.3.0 SSTI via DocAPI Template Rendering
- DataGerry
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Cisco Unified Communications Manager Cross-Site Scripting Vulnerability
- Cisco Unified Communications Manager
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
odf-kit: HTML injection leading to XSS in odtToHtml() and odsToHtml() via unescaped style attribute values
- Cross-site scripting (XSS)
>=0.6.0, <0.14.2 · fixed in 0.14.2
GHSA-3cgg-c5pp-57h6 · CVE-2026-113787 - CVSS 6.1 Medium
Reflected XSS via client window id in URL client window mode
- Eclipse Foundation Eclipse Mojarra
- Cross-site scripting (XSS)
-
SQL::Abstract::Tree versions before 2.000001_04 for Perl allow cross-site scripting via unescaped SQL text and bind values in the html profile
- Cross-site scripting (XSS)
-
Web::Simple versions before 0.036 for Perl do not escape values interpolated into double-quoted strings in HTML::Tags output
- Cross-site scripting (XSS)
-
Data::MuForm versions through 0.05 for Perl render attribute values and option labels into HTML without escaping
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability
- Noptin
- Cross-site scripting (XSS)
- CVSS 7.2 High
Remove Google Fonts <= 1.7 - Unauthenticated Stored Cross-Site Scripting via Comment Field via Regex-Mangled Output Buffer
- easywpstuff Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
- Coupa Total Spend Management Platform
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Multiple vulnerabilities in Coupa’s Total Spend Management Platform
- Coupa Total Spend Management Platform
- Cross-site scripting (XSS)
- CVSS 7.2 High
Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field
- wingerspeed Slim Jetpack
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Simple CAPTCHA with Cloudflare Turnstile <= 1.44.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- elliotvs Simple CAPTCHA with Cloudflare Turnstile
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability
- Aguila Technologies WP Customer Area
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress wpDiscuz plugin <= 7.6.73 - Cross Site Scripting (XSS) vulnerability
- AdvancedCoding wpDiscuz
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Cross Site Scripting (XSS) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability
- Aguila Technologies WP Customer Area
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Booking System plugin <= 2.1.0.6 - Cross Site Scripting (XSS) vulnerability
- Roland Murg WP Booking System
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Photo Album Plus plugin <= 9.3.05.003 - Cross Site Scripting (XSS) vulnerability
- Jacob N. Breetvelt WP Photo Album Plus
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
- Awesomemotive Contact Form by WPForms
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks
- VikWidgetsLoader
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
All-in-One Video Gallery < 5.0.0 - Contributor+ Stored XSS via Shortcode Attribute
- All-in-One Video Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Text Typing < 2.2.2 - Contributor+ Stored XSS
- Text Typing
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Enable Media Replace < 4.2.3 - Author+ Stored XSS via SVG Upload
- Enable Media Replace
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter
- Duplicator
- duplicator-pro
- Cross-site scripting (XSS)
- CVSS 7.1 High
SEOPress < 10.4 - Authenticated Stored XSS via Analytics Tracking Settings
- SEOPress
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Kali Forms < 2.4.29 - Author+ Stored XSS via Button Click Action
- Kali Forms — Contact Form & Drag-and-Drop Builder
- Cross-site scripting (XSS)
- CVSS 7.5 High
Form Maker by 10Web < 1.15.51 - Unauthenticated Stored XSS via Submission Field Values
- Form Maker by 10Web
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts
- CookieYes
- Cross-site scripting (XSS)
-
CGI versions before 5.00 for Perl allow HTML injection via text containing --> in comment
- Cross-site scripting (XSS)
-
CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and self_url
- Cross-site scripting (XSS)
-
CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and start_form
- Cross-site scripting (XSS)
- Open redirect
- CVSS 7.2 High
HumHub 1.19.0 - Stored cross-site scripting in friendship confirmation
- HumHub Community Edition
- Cross-site scripting (XSS)
- CVSS 3.3 Low
Cross-site scripting in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Cross-site scripting (XSS)