Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-80190 CVE record

CVSS 6.1 Medium

Apache Allura: Stored XSS via code repositories
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-85229 CVE record

CVSS 6.1 Medium

Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)
- Apache Software Foundation Apache SkyWalking
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-80180 CVE record

CVSS 6.1 Medium

Apache Allura: Stored XSS via markdown HTML processing
- Apache Software Foundation Apache Allura
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-85406 CVE record

CVSS 5.1 Medium

Eleveo Quality Management Conversation Review cross site scripting
- Eleveo Quality Management
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Sept 2026
CVE-2026-85405 CVE record

CVSS 5.1 Medium

Eleveo Call Recording Software roleAddAction.do cross site scripting
- Eleveo Call Recording Software
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Sept 2026
CVE-2026-85382 CVE record

CVSS 5.3 Medium

light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting
- light0011 cms
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 4 Sept 2026
CVE-2026-79419 CVE record

CVSS 8.7 High

A reflected cross-site scripting (XSS) vulnerability exists in EMX Tecnologia Gestao X Business Suite 8.4 and earlier.
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-79418 CVE record

CVSS 8.7 High

EMX Tecnologia Gestao X version <= 8.4 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Help Chat functionality.
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-78849 CVE record

CVSS 5.4 Medium

Cross Site Scripting vulnerability in Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 allows a remote attacker to execute arbitrary code via the captive_portal_s…
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-75170 CVE record

CVSS 6.1 Medium

Cross-site scripting (XSS) vulnerability in the /loginController/doLogin endpoint of the HubCore platform (version 14.1.1) allows a remote unauthenticated attacker to inject arbitrary JavaScript into…
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-38961 CVE record

CVSS 5.4 Medium

Cross-Site Scripting (XSS) vulnerability in the RSS Widget of Netgate pfSense Plus (versions 26.03, 25.11.1) and pfSense CE (version 2.8.1) allows remote authenticated attackers to inject arbitrary J…
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2022-35499 CVE record

CVSS 7.1 High

In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint is vulnerable to reflected cross-site scripting via injection in a arbitrary parameter appended to the URL.
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2022-35497 CVE record

CVSS 5.4 Medium

In Trimble TM4WEB 21.4.0.4 due to security misconfiguration with session identifiers, it is possible to recover valid session cookies via reflected cross-site scripting affecting the external documen…
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2022-26961 CVE record

CVSS 5.4 Medium

Italtel NetMatch-S 5.0.0-20200703 allows Multiple Stored XSS under NP_IBCF-NATUP-01/NMSCI-WebGui/backup_restore.jsp and NP_IBCF-MIBER-03/NMSCI-WebGui/storage.jsp via the name parameter.
- Cross-site scripting (XSS)
Not analysed yet 4 Sept 2026
CVE-2026-85453 CVE record

CVSS 5.3 Medium

MOOS core-moos through 10.4.0 MOOSDB HTTP Pages Stored Cross-Site Scripting
- themoos core-moos
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
sanitize-html npm

CVSS 6.1 Medium

ApostropheCMS: Mutation-XSS / allowedTags bypass via literal `</textarea/>` solidus close
- Cross-site scripting (XSS)
<2.17.6 · fixed in 2.17.6

GHSA-jxwj-j7wr-gfrw · CVE-2026-63670 Not analysed yet 3 Sept 2026
mkdocs-material PyPI

CVSS 5.4 Medium

Material for MkDocs: DOM XSS in search suggestions via query parameter
- Cross-site scripting (XSS)
>=7.2.0, <9.7.7 · fixed in 9.7.7

GHSA-xvg9-69gf-fjrf · CVE-2026-73295 Not analysed yet 3 Sept 2026
CVE-2026-85207 CVE record

CVSS 5.1 Medium

itsourcecode Online Medicine Delivery System index.php cross site scripting
- itsourcecode Online Medicine Delivery System
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 3 Sept 2026
CVE-2026-82024 CVE record

CVSS 5.1 Medium

LearnPress WordPress Plugin < 4.4.6 Stored XSS via Quiz Question Answer Titles
- ThimPress LearnPress
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-85303 CVE record

CVSS 6.5 Medium

WordPress Booking and Rental Manager plugin <= 2.7.7 - Cross Site Scripting (XSS) vulnerability
- Magepeople inc. Booking and Rental Manager
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-85302 CVE record

CVSS 6.5 Medium

WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability
- WPKoi WordPress Themes WPKoi Templates for Elementor
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84848 CVE record

CVSS 7.1 High

WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability
- brightvesseldev Quick Event Manager
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84812 CVE record

CVSS 7.1 High

WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability
- wordplus BP Better Messages
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84774 CVE record

CVSS 6.1 Medium

WordPress WP Statistics plugin <= 14.16.11 - Cross Site Scripting (XSS) vulnerability
- VeronaLabs WP Statistics
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84773 CVE record

CVSS 7.2 High

WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
- 作者: Shane Bishop EWWW Image Optimizer
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84765 CVE record

CVSS 7.1 High

WordPress Breadcrumb NavXT plugin <= 7.5.1 - Cross Site Scripting (XSS) vulnerability
- John Havlik Breadcrumb NavXT
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84763 CVE record

CVSS 7.1 High

WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability
- rometheme RTMKit
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81776 CVE record

CVSS 7.1 High

WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability
- advanpix WP QuickLaTeX
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81773 CVE record

CVSS 7.1 High

WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability
- Saturday Drive Ninja Forms File Uploads Extension
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81300 CVE record

CVSS 7.1 High

WordPress Calculation For Contact Form 7 plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability
- silverplugins217 Calculation For Contact Form 7
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81295 CVE record

CVSS 7.1 High

WordPress Under Construction plugin <= 5.82 - Cross Site Scripting (XSS) vulnerability
- UnderConstructionPage Under Construction
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81292 CVE record

CVSS 7.1 High

WordPress Simple Payment plugin <= 2.5.1 - Cross Site Scripting (XSS) vulnerability
- Ido Kobelkowsky Simple Payment
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81282 CVE record

CVSS 6.5 Medium

WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability
- VillaTheme Product Variations Swatches for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-81281 CVE record

CVSS 6.5 Medium

WordPress Graphene theme <= 2.9.4 - Cross Site Scripting (XSS) vulnerability
- silverks Graphene
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
github.com/siyuan-note/siyuan/kernel Go

CVSS 9.3 CriticalCritical · CVSS 9+

SiYuan: Stored and reflected XSS in SiYuan through an SVG sanitizer bypass
- Cross-site scripting (XSS)
<0.0.0-20260714095344-f08dee71ba8e · fixed in 0.0.0-20260714095344-f08dee71ba8e

GHSA-99rq-75j6-5j9f · CVE-2026-66394 Not analysed yet 3 Sept 2026
CVE-2026-85230 CVE record

CVSS 5.3 Medium

MISP Dashboard Button Widget Allows Persistent JavaScript URL Injection
- misp
- Cross-site scripting (XSS)
- CWE-20
Not analysed yet 3 Sept 2026
CVE-2026-85227 CVE record

CVSS 6.1 Medium

Reflected Cross-Site Scripting in MISP Event Filtering via taggedAttributes and galaxyAttachedAttributes Parameters
- misp
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-56128 CVE record

CVSS 5.1 Medium

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_schedule_edit.php
- Netgate pfSense Plus
- Netgate pfSense CE
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-56127 CVE record

CVSS 5.1 Medium

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via firewall_rules_edit.php
- Netgate pfSense Plus
- Netgate pfSense CE
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-56126 CVE record

CVSS 5.1 Medium

pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php
- Netgate pfSense Plus
- Netgate pfSense CE
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-84815 CVE record

CVSS 5.8 Medium

WordPress Enfold theme <= 8.0 - Cross Site Scripting (XSS) vulnerability
- Kriesi Enfold
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-78000 CVE record

CVSS 5.3 Medium

Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5
- j2commerce.com J2Store extension for Joomla
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-85159 CVE record

CVSS 5.3 Medium

AVideo Reflected XSS via cancelUri in userLogin.php
- WWBN AVideo
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-85158 CVE record

CVSS 5.3 Medium

AVideo Reflected XSS via videoEmbeded.php link parameter
- WWBN AVideo
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-76178 CVE record

CVSS 9.2 CriticalCritical · CVSS 9+

Multiple vulnerabilities in Ocsreports for OCS Inventory NG
- OCS Inventory NG Ocsreports
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-3852 CVE record

CVSS 6.4 Medium

Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Media Follow 'skype_url' Shortcode Parameter
- Elegant Themes Divi
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-2573 CVE record

CVSS 6.4 Medium

GutenKit <= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'postBodyCss'
- ataurr GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor
- Cross-site scripting (XSS)
Not analysed yet 3 Sept 2026
CVE-2026-85022 CVE record

CVSS 5.1 Medium

langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 3 Sept 2026
CVE-2026-85021 CVE record

CVSS 5.3 Medium

langgenius dify Splash Layout splash.tsx router.replace cross site scripting
- langgenius dify
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 3 Sept 2026
@dicebear/core +1 npm

CVSS 4.7 Medium

DiceBear: SVG injection via the unescaped rotate option in @dicebear/core (and fontSize/fontWeight in @dicebear/initials)
- Cross-site scripting (XSS)
- CWE-184
<9.4.3 · fixed in 9.4.3

GHSA-gcr2-9v8m-gq45 · CVE-2026-68921 Not analysed yet 2 Sept 2026
CVE-2026-75134 CVE record

CVSS 5.1 Medium

SEOWriting WordPress Plugin 1.12.5 Stored XSS via iframe onload
- SEOWriting
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2026-84677 CVE record

CVSS 5.4 Medium

Cross-site scripting in Jenkins Project Jenkins update-center2
- Jenkins Project Jenkins update-center2
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2026-84673 CVE record

CVSS 8.8 High

Cross-site scripting in Jenkins Project Jenkins Customizable Header Plugin
- Jenkins Project Jenkins Customizable Header Plugin
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2026-84665 CVE record

CVSS 8.0 High

Cross-site scripting in Jenkins Project Jenkins SonarQube Scanner Plugin
- Jenkins Project Jenkins SonarQube Scanner Plugin
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2026-84648 CVE record

CVSS 8.8 High

Cross-site scripting in Jenkins
- Jenkins
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
sulu/sulu Packagist

CVSS 5.4 Medium

Sulu: Stored XSS via media download inline-disposition override
- Cross-site scripting (XSS)
<2.6.25 || >=3.0.0-alpha1, <3.0.8 · fixed in 2.6.25, 3.0.8

GHSA-pp4x-ccxq-6r33 · CVE-2026-82396 Not analysed yet 2 Sept 2026
@tiptap/core npm

CVSS 4.0, no score published

Tiptap: mergeAttributes() turns an own __proto__ key into inherited executable DOM attributes
- Cross-site scripting (XSS)
- Prototype pollution
>=2.0.0-alpha.0, <3.30.4 · fixed in 3.30.4

GHSA-cp6q-959q-f8rh Not analysed yet 2 Sept 2026
livewire/livewire Packagist

CVSS 5.1 Medium

Livewire DOM-based cross-site scripting during client-side state handling
- Cross-site scripting (XSS)
- Prototype pollution
>=3.0.0-beta.1, <3.8.3 || >=4.0.0-beta.1, <4.3.4 · fixed in 3.8.3, 4.3.4

GHSA-g3hc-697w-wm82 · CVE-2026-81887 Not analysed yet 2 Sept 2026
CVE-2024-3773 CVE record

CVSS 5.9 Medium

LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode
- LiveJournal Shortcode
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026
CVE-2026-83547 CVE record

CVSS 6.8 Medium

Xpro Elementor Addons 1.6.0 - 1.7.3 - Contributor+ Stored XSS via Multiple Widgets
- Xpro Addons
- Cross-site scripting (XSS)
Not analysed yet 2 Sept 2026