Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability
- GoodLayers Tourmaster
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
- Franky Events Made Easy
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability
- ThemeGrill Magazine Blocks
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability
- Inisev Social Media & Share Icons
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP WPComplete
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability
- Code for Recovery 12 Step Meeting List
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Hugo 0.93.0 through 0.165.0 Stored Cross-Site Scripting via Unescaped Code-Fence Attribute Values
- hugo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - joomlack.fr - Reflected XSS in Page Builder CK < 3.6.5
- joomlack.fr Page Builder CK extension for Joomla
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Piwigo Public Authentication cross site scripting
- Piwigo
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.2 Medium
Hepta Platforms｜Heptabase - Stored Cross-Site Scripting
- Hepta Platforms Heptabase
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parame…
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
justhtml before 3.11.0 XSS via selectedcontent projection
- EmilStenstrom justhtml
- Cross-site scripting (XSS)
- CVSS 7.1 High
Brave Popup Builder < 0.8.6 - Unauthenticated Reflected XSS via UTM Parameters
- Brave
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SourceCodester Stock Management System getOrderReport.php cross site scripting
- SourceCodester Stock Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Stock Management System printOrder.php cross site scripting
- SourceCodester Stock Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting
- SourceCodester Class and Exam Timetabling System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
Joomla Extension - fabrikar.com - Unauthenticated stored XSS in Fabrik < 4.7.2
- fabrikar.com Fabrik extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Image Photo Gallery Final Tiles Grid <= 3.6.12 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'delay' Shortcode Attribute
- wpchill Image Photo Gallery Final Tiles Grid
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
MC4WP: Mailchimp for WordPress <= 4.12.0 - Authenticated (Author+) Stored Cross-Site Scripting via Form Response Messages
- dvankooten MC4WP: Mailchimp for WordPress
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0
- joomgalleryfriends.net JoomGallery extension for Joomla
- Cross-site scripting (XSS)
- CVSS 8.8 High
Slider Hero < 9.1.3 - Unauthenticated Stored XSS via Slider Type Change and Add-Slider Handlers
- Slider Hero with Video Background, Animation
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field
- Post Grid, Slider & Carousel Ultimate
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)
- perber leafwiki
- Cross-site scripting (XSS)
- CVSS 8.8 High
Combodo iTop: Reflected XSS in foreign key search criteria
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Typemill has Stored HTML Attribute Injection in Metadata Fields
- typemill
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in universal search
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.2 High
YOURLS has stored XSS in referrer statistics chart via crafted Referer header
- Cross-site scripting (XSS)
>=1.5.1, <1.10.4 · fixed in 1.10.4
GHSA-5h77-88j3-r659 · CVE-2026-63135 - CVSS 8.2 High
Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors
- Cross-site scripting (XSS)
- CWE-116
<0.19.1 · fixed in 0.19.1
GHSA-jg4p-g6xj-4qmf · CVE-2026-61824 - CVSS 5.5 Medium
stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
reflected cross site scripting vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 3.8 Low
HTML injection vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in tag admin
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
stored cross site scripting issue in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
HTML injection vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 3.5 Low
HTML injection vulnerability in Esri Portal for ArcGIS
- Esri Portal for ArcGIS
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in synchro/synchro_import.php
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 7.1 High
Combodo iTop: Reflected XSS in dashboard save
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.0 High
Combodo iTop: Reflected XSS in run_query.php
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
- AWS Amazon OpenSearch Service
- OpenSearch Dashboards dashboards-observability plugin
- Cross-site scripting (XSS)
- CVSS 7.3 High
Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - j2commerce.com - Stored XSS in Guest checkout in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav: Page editors can inject arbitrary script into rendered pages via the Twig sandbox's assets.addJs/addCss allowlist, escalating to super-admin
- Cross-site scripting (XSS)
<2.0.20 · fixed in 2.0.20
GHSA-8hgv-xc77-jmcr · CVE-2026-86197 - CVSS 4.1 Medium
DiscordChatExporter: HTML attribute injection via unescaped emoji name in HTML export
- Tyrrrz DiscordChatExporter
- Cross-site scripting (XSS)
- CVSS 8.2 High
DiscordChatExporter: Stored XSS in HTML export when markdown formatting is disabled
- Tyrrrz DiscordChatExporter
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Element Web: A malicious homeserver can inject HTML in Element Web using its homepage
- element-hq element-web
- Cross-site scripting (XSS)
- CVSS 8.5 High
Jet Admin Stored XSS
- Jet Admin
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66
- yootheme.com Zoo extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - yootheme.com - Reflected XSS and open redirect via the submission redirect parameter in Zoo < 4.1.66
- yootheme.com Zoo extension for Joomla
- Cross-site scripting (XSS)
- Open redirect
- CVSS 5.1 Medium
Cross-site scripting in Japan Science and Technology Agency (JST) Miraikan Assist App Android version and others
- Japan Science and Technology Agency (JST) Miraikan Assist App Android version
- Japan Science and Technology Agency (JST) Miraikan Assist App iOS version
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting
- Drag and Drop Multiple File Upload for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.2 High
WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values
- WPForms Pro
- Cross-site scripting (XSS)
- CVSS 7.5 High
Cross-site scripting in Rocket.Chat
- Rocket.Chat
- Cross-site scripting (XSS)
- CVSS 2.0 Low
TREK: Stored cross-user HTML injection via trip title in the Journey suggestion banner
- mauriceboe TREK
- Cross-site scripting (XSS)
- CVSS 7.3 High
LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API
- Kovah LinkAce
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
BigBlueButton: Stored XSS in Screenshare Recording Playback via Unescaped Meeting Name
- bigbluebutton
- Cross-site scripting (XSS)