Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.2 High
WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
- WP Media WP Rocket
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Envira Gallery <= 1.12.4 - Authenticated (Author+) Stored Cross-Site Scripting via Gallery Description
- smub Envira Gallery – Image Photo Gallery, Albums, Video Gallery, Slideshows & More
- Cross-site scripting (XSS)
- CVSS 7.5 High
Joomla Extension - digital-peak.com - Authenticated, privileged stored XSS in DP Calendar 7.0.0-8.19.5, 9.0.0-10.12.0
- digital-peak.com DP Calendar extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0
- mrvinoth.com All Video Share extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
All-in-One WP Migration Unlimited Extension <= 2.84 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ai1wm_backups_path' Parameter
- servmask All-in-One WP Migration Unlimited Extension
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Cross-site scripting in Synology Chat Server
- Synology Chat Server
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Cross-site scripting in Synology Chat Server
- Synology Chat Server
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Loops & Logic - Reflected XSS
- Tangible Loops & Logic
- Cross-site scripting (XSS)
- CVSS 7.2 High
Booking for Appointments and Events Calendar <= 2.2 - Unauthenticated Stored Cross-Site Scripting via Customer Name Fields in Booking Submission
- melograno Booking for Appointments and Events Calendar – Amelia
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Tsuyoshi Saito SOY Gallery
- Tsuyoshi Saito SOY Gallery
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Tsuyoshi Saito SOY Calendar
- Tsuyoshi Saito SOY Calendar
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Tsuyoshi Saito SOY Calendar
- Tsuyoshi Saito SOY Calendar
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter
- wpmet ElementsKit Pro
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Avada (Fusion) Builder <= 3.15.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'size' Shortcode Attribute
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
LiteSpeed Cache <= 7.7 - Authenticated (Author+) Stored Cross-Site Scripting via img Tag Attributes
- litespeedtech LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 7.2 High
Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
LiteSpeed Cache <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- litespeedtech LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 9.2 CriticalCritical · CVSS 9+
Cross-site scripting in Pocket
- Cross-site scripting (XSS)
- CVSS 8.8 High
Cross-site scripting in wallabag android-app
- wallabag android-app
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute
- nextendweb Smart Slider 3
- Cross-site scripting (XSS)
- CVSS 7.2 High
Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
- Cross-site scripting (XSS)
- CVSS 7.2 High
TranslatePress <= 3.3.3 - Unauthenticated Stored Cross-Site Scripting via Comment Noise-Key Injection into HTML Parser
- cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a c…
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field.
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature.
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Dimension Stored XSS via Trusted CA Certificate Configuration
- WatchGuard Dimension
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page
- WatchGuard Dimension
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Dimension Stored XSS in Scheduled Report Task
- WatchGuard Dimension
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Frappe 15.11.0 through 16.32.0 Stored XSS via Workspace Link Description
- frappe
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Trilium: Note Import to RCE via Book Note
- Trilium
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
Trilium: Note Import to RCE via Mind Elixir dangerouslySetInnerHtml
- Trilium
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.2 High
Spring Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- Spring Authorization Server
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Spring Framework Cross-site Scripting via EscapedErrors
- Spring Framework
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Trilium: Malicious import with GeoMap marker title XSS leads to RCE on the desktop client
- Trilium
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.8 Medium
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Rem...
- Cross-site scripting (XSS)
<9.1.3 · fixed in 9.1.3
PYSEC-2026-3747 · CVE-2026-79720 - CVSS 6.8 Medium
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Rem...
- Cross-site scripting (XSS)
<9.1.3 · fixed in 9.1.3
PYSEC-2026-4002 · CVE-2026-79719 - CVSS 6.8 Medium
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Rem...
- Cross-site scripting (XSS)
<9.1.3 · fixed in 9.1.3
PYSEC-2026-4001 · CVE-2026-79718 - CVSS 5.4 Medium
Silverstripe Framework: Possible XSS attack through media embed
- Cross-site scripting (XSS)
<6.2.2 · fixed in 6.2.2
GHSA-gvrw-qqp5-jgc5 · CVE-2026-54720 - CVSS 5.3 Medium
Doggo vulnerable to cross-site scripting via unescaped date field values
- Cross-site scripting (XSS)
>=0.1.0, <0.14.8 · fixed in 0.14.8
GHSA-w9rp-cf93-86pj · CVE-2026-66353 - CVSS 6.1 Medium
Reflected XSS in Seres Software's syWEB
- Seres Software syWEB
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Flowintel HTML Injection in MISP Case History Timeline via Crafted Object Attributes
- flowintel
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in BilPark's DoXBASE
- BilPark Informatics Technologies Industry and Trade Inc. DoXBASE
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Flowintel Stored XSS in Calendar via Malicious Case Title
- flowintel
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Flowintel Stored XSS in Case Notes via Malicious Mermaid Diagram Content
- flowintel
- Cross-site scripting (XSS)
- CVSS 7.0 High
Cross-site scripting in Siemens Element maps-ng V47 and others
- Siemens Element maps-ng V47
- Siemens Element maps-ng V48
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
HTML Injection in Softtr's E-Commerce Pack
- Softtr Informatics Technology Trading Limited Company E-Commerce Pack
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP w3all phpBB plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability
- axew3 WP w3all phpBB
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress CozyStay theme <= 1.10.0 - Cross Site Scripting (XSS) vulnerability
- LoftOcean CozyStay
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Music Player for WooCommerce plugin <= 1.8.9 - Cross Site Scripting (XSS) vulnerability
- codepeople Music Player for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress CP Media Player plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
- codepeople CP Media Player
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Fluent Boards Pro plugin <= 2.0.11 - Cross Site Scripting (XSS) vulnerability
- WP Manage Ninja Fluent Boards Pro
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Realtyna Organic IDX plugin plugin <= 5.4.1 - Cross Site Scripting (XSS) vulnerability
- Realtyna Organic IDX plugin
- Cross-site scripting (XSS)
- CVSS 8.8 High
12 Step Meeting List 3.17 - 3.19.16 - Unauthenticated Stored XSS via Geocode Event Log
- 12 Step Meeting List
- Cross-site scripting (XSS)
- CVSS 3.5 Low
CMP - Coming Soon & Maintenance < 4.1.18 - Editor+ Stored XSS via niteoCS_socialmedia
- CMP
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - joomlaeventmanager.net - Reflected XSS via the PDF export link in Joomla Events Manager < 5.0.1
- joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla
- Cross-site scripting (XSS)
- CVSS 8.2 High
Spring Security Authorization Server Default Consent Page is vulnerable to Cross-Site Scripting (XSS)
- Spring Security
- Cross-site scripting (XSS)
- CVSS 8.7 High
Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML
- penpot
- Cross-site scripting (XSS)