Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.6 High
Penpot: Stored XSS via custom font family name injected into a @font-face style rule
- penpot
- Cross-site scripting (XSS)
- CVSS 7.4 High
LimeSurvey Community Edition 7.0.5 - Reflected XSS in user activation confirmation endpoint
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 7.2 High
LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
LimeSurvey Community Edition 7.0.5 - Stored XSS in replacement-fields
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 8.4 High
LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 3.5 Low
OpenSTAManager has HTML Injection in modules/utenti/edit.php
- Cross-site scripting (XSS)
<2.11-beta · fixed in 2.11-beta
GHSA-crx4-7mmq-j74j · CVE-2026-44701 - CVSS 7.1 High
LibreNMS — Stored XSS via SNMP/Syslog Data in Legacy Templates
- Cross-site scripting (XSS)
<26.5.0 · fixed in 26.5.0
GHSA-7w8c-qgxg-m7jx · CVE-2026-84192 - CVSS 7.0 High
FiftyOne before 1.21.0 Stored Cross-Site Scripting via Unescaped Field Description
- voxel51 fiftyone
- Cross-site scripting (XSS)
- CVSS 8.5 High
SunEditor Embed Plugin has DOM XSS via External Script Element After Iframe Embed
- Cross-site scripting (XSS)
>=3.0.0, <3.1.4 · fixed in 3.1.4
GHSA-w93q-cq9w-58p7 · CVE-2026-54606 - CVSS 6.4 Medium
Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI
- wpsoul Greenshift – animation and page builder blocks
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Reviews and Rating – Google Reviews <= 5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Shortcodes
- designextreme Reviews and Rating – Google Reviews
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Betheme <= 28.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_box_2' Shortcode
- MuffinGroup Betheme
- Cross-site scripting (XSS)
- CVSS 7.2 High
Formidable Forms <= 6.33.1 - Unauthenticated Stored Cross-Site Scripting via 'frm_user_id' Parameter
- strategy11team Formidable Forms – WordPress Form Builder for Contact Forms, Calculators, Quizzes & More
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Blocks
- jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Royal Elementor Addons < 1.7.1066 - Contributor+ Stored XSS via Image Accordion Widget Effect Settings
- Royal Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP Fastest Cache <= 1.5.0 - Unauthenticated Stored Cross-Site Scripting via HTTP Host Header
- emrevona WP Fastest Cache – WordPress Cache Plugin
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in Cockpit CMS v.2.13.5 and before allows a remote attacker to execute arbitrary code via the item.php, field-select.js and tags.js components
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Media Folders - Moderately critical - Cross site scripting - SA-CONTRIB-2026-080
- Drupal Media Folders
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Search API Autocomplete - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-082
- Drupal Search API Autocomplete
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
code-projects Online Shopping System sumit_form.php cross site scripting
- code-projects Online Shopping System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
WP Fastest Cache 0.9.0.3 - 1.5.0 - Unauthenticated Stored XSS via Host Header Cache Poisoning
- WP Fastest Cache
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field
- Creativeitem Ekushey Project Manager CRM
- Cross-site scripting (XSS)
- CVSS 8.7 High
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript
- Cross-site scripting (XSS)
>=53.0.0, <53.1.4 · fixed in 53.1.4
GHSA-qj6x-xx2h-8hvv · CVE-2026-55596 - CVSS 7.5 High
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41
- yootheme.com YOOtheme Pro extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Ultimate Member <= 2.12.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Textarea Profile Field with HTML Support (DOM Gadget via id Attribute)
- ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- Cross-site scripting (XSS)
- CVSS 8.1 High
hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass
- hbs
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute
- implecode eCommerce Product Catalog
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Reflected XSS in AshAuthentication confirmation and magic link interaction forms
- Cross-site scripting (XSS)
>=4.8.0, <4.14.2 || >=5.0.0-rc.0, <5.0.0-rc.13 · fixed in 4.14.2, 5.0.0-rc.13
GHSA-54fc-x3hv-ffhw · CVE-2026-66882 - CVSS 6.4 Medium
TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor
- cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
- Cross-site scripting (XSS)
- CVSS 7.2 High
Forminator Forms <= 1.57.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'error_description' Parameter
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
MetForm <= 4.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mf_form_id' Widget Setting
- roxnor MetForm – Contact Form, Survey, Quiz, Conditional Forms, Form Templates & Custom Form Builder for Elementor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Forminator Forms <= 1.57.0.2 - Unauthenticated Stored Cross-Site Scripting via Radio Field (Save and Continue Draft)
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Cross-site scripting in the comments bundle (see GHSA-628f-v4f6-p37r)
- Cross-site scripting (XSS)
- CWE-116
>=4.0.0, <5.3.50 || >=5.4.0, <5.7.12 · fixed in 5.3.50, 5.7.12
PKSA-3fqv-nq39-s3wg · CVE-2026-107845 - CVSS 6.4 Medium
tagDiv Composer <= 5.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
- tagDiv Composer
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute
- jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter
- netweblogic Events Manager – Calendar, Bookings, Tickets, and more!
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
FundEngine <= 1.8.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wfp_featured_video_url' Parameter
- roxnor FundEngine – Donation and Crowdfunding Platform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute
- cozythemes Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
- buildwps PPWP – Password Protect Pages
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String
- vrana adminer
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
A Stored XSS vulnerability in the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary JavaScr…
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
A Stored XSS vulnerability in forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c p…
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
A Stored XSS vulnerability in the custom bonus title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arbitrary Jav…
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
A Stored XSS vulnerability in the torrent remaster custom title feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject ar…
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
A Stored XSS vulnerability in the donor avatar mouse-over text feature in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote authenticated users to inject arb…
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability
- mra13 Stripe Payments
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
- Site Building with Toolset Toolset Blocks
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
- Nexcess Event Tickets
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- PixelYourSite Professional Boost
- Cross-site scripting (XSS)
- CVSS 8.7 High
Sakai Conversations has a Stored XSS Issue
- Cross-site scripting (XSS)
>=23.0, <=23.3 · no fixed version yet
GHSA-w2x5-gv52-9ccv · CVE-2026-54049 - CVSS 5.1 Medium
Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template
- dolibarr
- Cross-site scripting (XSS)
- CVSS 8.9 High
Combodo iTop: Reflected XSS in dashboard revert
- Combodo iTop
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name
- Baserow
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Johnson Controls Metasys 14 and others
- Johnson Controls Metasys 14
- Johnson Controls Metasys 15
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name
- horde imp
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
- Network Optix Nx Witness VMS
- Cross-site scripting (XSS)
- CVSS 8.8 High
Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook
- ransomlook
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
CVE-2026-17033 CVE Record
- Grafana OSS
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability
- thembay Urna
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability
- AmpleByte Pvt Limited Brave Conversion Engine (PRO)
- Cross-site scripting (XSS)