Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-18147 CVE record

CVSS 8.1 High

Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 10.0 Extended Update Support
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-79946 CVE record

CVSS 5.3 Medium

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability.
- Dell Secure Connect Gateway 5.0 - Application
- Dell Secure Connect Gateway 5.0 - Appliance
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-86772 CVE record

CVSS 5.1 Medium

Snipe-IT 8.6.3 Stored XSS via Department Names
- grokability snipe-it
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-87814 CVE record

CVSS 8.4 High

SiYuan before v3.8.2 Stored XSS via Asset Preview
- siyuan
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-87813 CVE record

CVSS 8.4 High

SiYuan before v3.8.2 Stored XSS via unescaped asset filenames
- siyuan
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-87812 CVE record

CVSS 7.4 High

SiYuan before v3.8.2 Stored XSS via Bazaar iconURL
- siyuan
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-87811 CVE record

CVSS 8.4 High

SiYuan before v3.8.2 Stored XSS via notebook template paths
- siyuan
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2025-3271 CVE record

CVSS 4.8 Medium

DOM-based XSS vulnerability in OpenText™ Documentum Webtop
- OpenText™ Documentum Webtop
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-14989 CVE record

CVSS 7.2 High

Cookie Banner for GDPR / CCPA <= 4.4.1 - Unauthenticated Stored Cross-Site Scripting via 'wpl_user_preference' Parameter
- wplegalpages WPLP Cookie Consent – Cookie Banner & Consent Management for GDPR, CCPA & Google Consent Mode
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-17149 CVE record

CVSS 6.4 Medium

myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program <= 3.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wrapper' Shortcode Attribute
- saadiqbal Points Management System For Gamification, Ranks, Badges, and Loyalty Rewards Program – myCred
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2025-7062 CVE record

CVSS 5.2 Medium

Stored Cross-Site Scripting via file upload in H5P module (h5p-nodejs-library) of Lumi Education
- Lumi Education UG h5p-nodejs-library
- Cross-site scripting (XSS)
- CWE-20
Not analysed yet 9 Sept 2026
CVE-2026-85418 CVE record

CVSS 5.4 Medium

Orbit Fox < 3.0.9 - Contributor+ Stored XSS via Beaver Builder Pricing Table Widget
- Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-83541 CVE record

CVSS 6.8 Medium

Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget
- Sina Extension for Elementor
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2025-15690 CVE record

CVSS 6.8 Medium

Content Mask 1.7.1 - 1.8.5.5 - Contributor+ Stored XSS via Post Scripts and Styles
- Content Mask
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-83593 CVE record

CVSS 7.2 High

WPBot <= 8.7.3 - Unauthenticated Stored Cross-Site Scripting via 'conversation' Parameter
- quantumcloud WPBot – AI ChatBot for Live Support, Lead Generation, AI Services
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-19945 CVE record

CVSS 6.4 Medium

WP Crowdfunding <= 2.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'first_name' Parameter
- themeum WP Crowdfunding
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-75966 CVE record

CVSS 6.4 Medium

Podlove Podcast Publisher <= 4.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'episode_contributor[..][..][comment]' Parameter
- eteubert Podlove Podcast Publisher
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-19797 CVE record

CVSS 6.1 Medium

User Access Manager <= 2.3.18 - Reflected Cross-Site Scripting via 'tab_group_section' Parameter
- gm_alex User Access Manager
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-77187 CVE record

CVSS 6.4 Medium

My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'before' and 'after' Shortcode Attributes
- joedolson My Calendar – Accessible Event Manager
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-77186 CVE record

CVSS 6.4 Medium

My Calendar <= 3.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fallback' Shortcode Attribute
- joedolson My Calendar – Accessible Event Manager
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-84293 CVE record

CVSS 7.2 High

Repeater Fields for Gravity Forms <= 3.0.4 - Unauthenticated Stored Cross-Site Scripting via Repeated Multi-Input Sub-Field Values
- addonsorg Repeater Fields for Gravity Forms
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-7804 CVE record

CVSS 6.1 Medium

Product Filter for WooCommerce by WBW <= 3.4.2 - Reflected Cross-Site Scripting via 'wpf_fid' Parameter
- woobewoo Product Filter for WooCommerce by WBW
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-13709 CVE record

CVSS 6.4 Medium

Graphina <= 3.1.11 - Authenticated (Author+) Stored Cross-Site Scripting via 'iq_tree_tree_chart_template' Widget Setting
- iqonicdesign Graphina – Charts and Graphs For Elementor
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-13359 CVE record

CVSS 7.2 High

Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown Parameter
- bestweblayout Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-87632 CVE record

CVSS 4.3 Medium

Cross-site scripting in Google Chrome
- Google Chrome
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-75308 CVE record

CVSS 6.1 Medium

yshopmall <=3.3 is vulnerable to Cross Site Scripting (XSS).
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-75307 CVE record

CVSS 6.1 Medium

zhitan-ems 1.0.0 is vulnerable to Cross Site Scripting (XSS) via SVG file upload through the /equipmentFile/upload endpoint.
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-71803 CVE record

CVSS 5.4 Medium

money-pos 1.0 contains a stored Cross-Site Scripting (XSS) vulnerability.
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
CVE-2026-71802 CVE record

CVSS 5.4 Medium

A stored Cross-Site Scripting (XSS) vulnerability exists in the announcement preview component of REBUILD 4.4.3.
- Cross-site scripting (XSS)
Not analysed yet 9 Sept 2026
svgo npm

CVSS 8.2 High

SVGO: removeScripts allows executable links through namespace and control-character bypasses
- Cross-site scripting (XSS)
- CWE-184
>=1.0.0, <2.8.4 || >=3.0.0, <3.3.5 || >=4.0.0, <4.1.0 · fixed in 2.8.4, 3.3.5, 4.1.0

GHSA-w27v-7q3p-w38r · CVE-2026-84370 Not analysed yet 8 Sept 2026
svgo npm

CVSS 6.1 Medium

SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements
- Cross-site scripting (XSS)
>=1.0.0, <2.8.4 || >=3.0.0, <3.3.5 || >=4.0.0, <4.1.0 · fixed in 2.8.4, 3.3.5, 4.1.0

GHSA-4vpr-x523-8j87 · CVE-2026-84369 Not analysed yet 8 Sept 2026
maplibre-gl npm

CVSS 10.0 CriticalCritical · CVSS 9+

MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip
- Cross-site scripting (XSS)
<6.4.1 · fixed in 6.4.1

GHSA-jrc7-96c5-q579 · CVE-2026-85061 Not analysed yet 8 Sept 2026
CVE-2026-85982 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Stored Cross-Site Scripting (XSS) in Auth0 AD/LDAP Connector
- Auth0 AD/LDAP Connector
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-85630 CVE record

CVSS 6.1 Medium

HTML::FormHandler versions before 0.410002 for Perl render field attributes into HTML without escaping using the process_attrs method
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-85485 CVE record

CVSS 6.1 Medium

HTML::FormHandler versions before 0.410002 for Perl render some error messages into HTML without escaping
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-85484 CVE record

CVSS 6.1 Medium

HTML::FormHandler versions before 0.410002 for Perl render option group labels and radio button labels into HTML without escaping
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-19872 CVE record

CVSS 6.1 Medium

HTML::FormHandler versions before 0.410000 for Perl allow cross-site scripting via a submitted value rendered unescaped in an error message
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-71357 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75678 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-71565 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75687 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75672 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75734 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75706 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75730 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75719 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75707 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75690 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75715 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2025-64838 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75646 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75640 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75643 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-19612 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75660 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-19479 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75735 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75637 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75705 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026
CVE-2026-75694 CVE record

CVSS 5.4 Medium

Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
Not analysed yet 8 Sept 2026