Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.4 Medium
User Profile Builder <= 4.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date' Shortcode Attribute
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 5.8.1 - Unauthenticated Stored Cross-Site Scripting via 'lsd[displ][style]' Parameter
- webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WordPress Social Login and Register plugin <= 7.8.2 - Cross Site Scripting (XSS) vulnerability
- miniOrange WordPress Social Login and Register
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress SliceWP plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
- iova.mihai SliceWP
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress RegistrationMagic plugin <= 6.0.9.8 - Cross Site Scripting (XSS) vulnerability
- Metagauss RegistrationMagic
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Kalles Addons plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability
- The4 Kalles Addons
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Super Store Finder plugin <= 7.10 - Cross Site Scripting (XSS) vulnerability
- highwarden Super Store Finder
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Tailored Tools plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability
- Tailored Media Tailored Tools
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Email Essentials plugin <= 6.0.6 - Cross Site Scripting (XSS) vulnerability
- Acato Email Essentials
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress LeadConnector plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- varunvairavanlc LeadConnector
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Uncode theme <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
- Uncode
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Email Subscribers & Newsletters plugin <= 5.9.33 - Cross Site Scripting (XSS) vulnerability
- Icegram Email Subscribers & Newsletters
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Typora Mermaid Rendering cross site scripting
- Typora
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting
- code-projects Online Shopping System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.6 High
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in MegaMenu Layout Container & Embed Inputs in Helix Ultimate < 2.2.11
- joomshaper.com Helix Ultimate extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Wicket: XSS in AbstractSingleSelectChoice via getNullValidDisplayValue
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in Palette via getAdditionalAttributes
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in MetaDataHeaderItem via addTagAttribute
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in Button via its model object
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Apache Wicket: XSS in AjaxEditableLabel and its subclasses via IChoiceRenderer and defaultNullLabel
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown
- apconw Aix-DB
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting
- yaojingang GEOFlow
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.4 Medium
Default webserver configuration with incorrect CSP
- pretix venueless
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
code-projects Simple Inventory System User Registration register.php cross site scripting
- code-projects Simple Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
A Stored Cross-Site Scripting (XSS) Vulnerability in Nokia NSP
- Nokia NSP
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting
- code-projects Employee Leave Managing System
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.4 High
Stored XSS in AshAdmin relationship typeahead via unescaped label_field content
- Cross-site scripting (XSS)
>=0.13.0, <1.3.1 · fixed in 1.3.1
GHSA-m23x-576h-73w8 · CVE-2026-77850 - CVSS 5.3 Medium
SeaCMS err.php cross site scripting
- SeaCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Stored Cross-Site Scripting (XSS) in TaskRunHandler.post() in web/handlers/task.py in QD 20220208 through 20250803.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
TechStore 1.0 is vulnerable to Cross Site Scripting (XSS).
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SourceCodester Queue Management System add_customer.php cross site scripting
- SourceCodester Queue Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
SiYuan before v3.8.1 Stored XSS via block name
- siyuan
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
SiYuan before v3.8.1 Stored XSS via confirmDialog
- siyuan
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 8.8 High
Readest: unsanitized iframe srcdoc attribute in the EPUB sanitizer can lead to arbitrary code execution
- readest
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Beetel 450TC3 User Management cross site scripting
- Beetel 450TC3
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting
- coppermine-gallery Coppermine Photo Gallery
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
coppermine-gallery Coppermine Photo Gallery edit_profile Endpoint profile.php cross site scripting
- coppermine-gallery Coppermine Photo Gallery
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web Form Dropdown/Radio Field
- Groundhogg — CRM, Newsletters, and Marketing Automation
- Cross-site scripting (XSS)
- CVSS 3.5 Low
MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List
- MW WP Form
- Cross-site scripting (XSS)
- CVSS 8.8 High
Customer Reviews for WooCommerce < 5.118.0 - Unauthenticated Stored XSS via 'comment' Parameter
- Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
Geotargeting WP < 3.5.6.2 - Reflected XSS
- geotargetingwp
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
SOGO Add Script to Individual Pages Header Footer <= 3.9 - Contributor+ Stored XSS via Post Metabox
- SOGO Add Script to Individual Pages Header Footer
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Formwork < 2.3.11 Stored XSS via Referer Header
- Formwork
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Profile Builder < 4.0.1 - Contributor+ Stored XSS via Format Date Shortcode
- User Profile Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
silverstripe/versioned has XSS in archive admin restore
- Cross-site scripting (XSS)
<3.2.1 · fixed in 3.2.1
GHSA-m4g4-86qc-v8w7 · CVE-2026-55779 - CVSS 4.3 Medium
PrivateBin has stored Cross-Side-Scripting (XSS) vulnerability in attachment download link via dangerous MIME types with required user-interaction
- Cross-site scripting (XSS)
<2.0.5 · fixed in 2.0.5
GHSA-f2xf-7x3g-4272 · CVE-2026-55696 - CVSS 6.9 Medium
MongoSQL Transition Readiness Tool Improper Output Encoding in Generated HTML Reports
- MongoDB BI Connector Transition Readiness Report
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
MongoDB BI Connector Transition Readiness Report Improper HTML Encoding When Processing Database Metadata
- MongoDB BI Connector Transition Readiness Report
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
Snipe-IT has CSS Injection via `header_color` Setting
- Cross-site scripting (XSS)
<8.6.2 · fixed in 8.6.2
GHSA-w7qw-5wfv-gwx9 · CVE-2026-55481 - CVSS 6.2 Medium
Snipe-IT vulnerable to stored XSS via inline-served attachment
- Cross-site scripting (XSS)
<8.6.2 · fixed in 8.6.2
GHSA-jhph-5q74-pmfx · CVE-2026-55466 - CVSS 4.8 Medium
Snipe-IT vulnerable to stored XSS via Markdown custom field
- Cross-site scripting (XSS)
<8.6.2 · fixed in 8.6.2
GHSA-r52f-r9v5-66xr · CVE-2026-55464 - CVSS 4.3 Medium
Yamcs has DOM XSS in Extension Routing
- Cross-site scripting (XSS)
>=5.13.0, <5.13.2 || <5.12.8 · fixed in 5.13.2, 5.12.8
GHSA-9272-wg2r-7xmx · CVE-2026-55566 - CVSS 6.5 Medium
Yamcs has Reflected XSS in the URL of the Authorize Endpoint
- Cross-site scripting (XSS)
<5.9.4 · fixed in 5.9.4
GHSA-rxpg-wjf8-qv9c · CVE-2026-55549 - CVSS 5.4 Medium
Stored XSS in Akıllı Ticaret's E-Commerce Pack
- Akilli Ticaret Software Technologies Ltd. E-Commerce Pack
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress JetEngine plugin <= 3.8.14.2 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetEngine
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in Ceviz Informatics's Web Design
- Ceviz Informatics Inc. Web Design
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in Dayneks Software's E-Commerce Platform
- Dayneks Software Industry and Trade Inc. E-Commerce Platform
- Cross-site scripting (XSS)
- CVSS 7.2 High
Customer Reviews for WooCommerce <= 5.106.0 - Unauthenticated Stored Cross-Site Scripting via Aggregated Review Form
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)