Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.8 Medium
All in One SEO < 5.0.0.1 - Contributor+ Stored XSS via ai-assistant Block
- All in One SEO
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Icegram Express < 5.8.6 - Admin+ Stored XSS
- Icegram Express
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Entity Browser - Moderately critical - Cross site scripting - SA-CONTRIB-2026-094
- Drupal Entity Browser
- Cross-site scripting (XSS)
- CVSS 7.3 High
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
- Drupal Screenshot
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 7.3 High
Screenshot - Critical - Unsupported - SA-CONTRIB-2026-102
- Drupal Screenshot
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103
- Drupal Address Suggestion
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116
- Drupal Monster Menus
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Slick Carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2026-117
- Drupal Slick Carousel
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
- WC Lovers WCFM Marketplace
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability
- Estatik
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress TrustedSite plugin <= 1.2.5 - Cross Site Scripting (XSS) vulnerability
- TrustedSite
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability
- MapGeo Interactive Geo Maps
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.13.1 - Cross Site Scripting (XSS) vulnerability
- MP3 Audio Player for Music, Radio & Podcast by Sonaar
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
- WP Swings Upsell Order Bump Offer for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Gallery PhotoBlocks plugin <= 1.3.4 - Cross Site Scripting (XSS) vulnerability
- WP Chill Gallery PhotoBlocks
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege e...
- Cross-site scripting (XSS)
>=3.0.0, <3.5.8 · fixed in 3.5.8
GHSA-9437-39hj-3c93 · CVE-2026-32773 - CVSS 8.6 High
SiYuan before v3.8.2 Stored XSS via incomplete asset blocklist
- siyuan
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Craft CMS 5.0.0-RC1 before 5.10.11 Stored XSS via site name
- cms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Broken Link Checker <= 2.4.13 - Unauthenticated Stored Cross-Site Scripting via Comment Author URL / Link Log
- wpmudev Broken Link Checker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Easy Waveform Player <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode_easywaveformplayer Function
- tymotey Easy Waveform Player
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
- Marcus Login With Ajax
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter
- Elegant Themes Divi
- Cross-site scripting (XSS)
- CVSS 8.8 High
Simple Ajax Chat < 20260827 - Unauthenticated Stored XSS via Chat Message Linkification
- Simple Ajax Chat
- Cross-site scripting (XSS)
- CVSS 8.8 High
FAQ Builder AYS 1.6.3 - 1.8.4 - Unauthenticated Stored XSS via ays_get_user_information
- FAQ Builder AYS
- Cross-site scripting (XSS)
- CVSS 7.5 High
RegistrationMagic < 6.0.9.9 - Unauthenticated Stored XSS via Rating Field
- RegistrationMagic
- Cross-site scripting (XSS)
- CVSS 7.1 High
Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler
- Social Media Share Buttons & Social Sharing Icons
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title
- Social Media Share Buttons & Social Sharing Icons
- Cross-site scripting (XSS)
- CVSS 7.1 High
Photo Gallery by 10Web < 1.8.44 - Reflected XSS via title and paged Parameters
- Photo Gallery by 10Web
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
BEAF < 4.7.19 - Author+ Stored XSS via Before Label
- Ultimate Before After Image Slider & Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
BEAF < 4.7.19 - Author+ Stored XSS via After Label
- Ultimate Before After Image Slider & Gallery
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Dynamic Content (Legacy JSON Format) Shortcode
- Elegant Themes Divi
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
OpenCart Autocomplete Workflow edit.php cross site scripting
- OpenCart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
OpenCart Autocomplete Workflow address.php cross site scripting
- OpenCart
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
NocoBase Rich Text Field Stored Cross-Site Scripting via API
- nocobase
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
BookStack before 26.05.4 Stored XSS via Drawing Upload
- bookstack
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
AVideo Stored XSS via Live Schedule Title Description
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
ApostropheCMS: Stored XSS via SVG SMIL URI-list scheme-policy bypass
- Cross-site scripting (XSS)
>=1.9.0, <2.17.7 · fixed in 2.17.7
GHSA-g8qq-57p8-ggw5 · CVE-2026-84371 - CVSS 5.1 Medium
Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
- cypht
- Cross-site scripting (XSS)
- CVSS 8.4 High
Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in AOS-CX Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) AOS-CX
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
league/commonmark XSS: `on*` event-handler filter in `AttributesExtension` bypassed with a U+000C form feed
- Cross-site scripting (XSS)
- CWE-86
>=2.7.0, <2.9.1 · fixed in 2.9.1
GHSA-f8fg-pg57-v4j8 · CVE-2026-86431 - CVSS 6.1 Medium
Unauthenticated Reflected Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) Fabric Composer
- Cross-site scripting (XSS)
- CVSS 8.8 High
Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in HPE Networking Fabric Composer Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) Fabric Composer
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Authenticated Stored Cross-Site Scripting Vulnerability (XSS) in HPE Networking Fabric Composer Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) Fabric Composer
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Appium: Reflected XSS / arbitrary JS in @appium/base-driver /test/guinea-pig* routes
- Cross-site scripting (XSS)
- CWE-489
<10.7.0 · fixed in 10.7.0
GHSA-3wgp-x9p5-c7cc · CVE-2026-58191 - CVSS 5.4 Medium
Pulpcore: python-pulpcore: stored cross-site scripting via inline rendering of uploaded html/svg content
- Red Hat Ansible Automation Platform 2
- Red Hat Satellite 6
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Rockwell Automation ArmorStart® LT Stored Cross-site scripting
- Rockwell Automation ArmorStart® LT
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker Premium <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode
- Bootstrapped Ventures WP Recipe Maker Premium
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP
- librenms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields
- librenms
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WPBakery Page Builder <= 8.7.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter
- WPBakery Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode
- livecomposer Live Composer – Free WordPress Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode
- livecomposer Live Composer – Free WordPress Website Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy/dynamic-data)
- creativethemeshq Blocksy Companion
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
BetterDocs <= 4.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content
- wpdevteam BetterDocs – AI Documentation, Knowledge Base, MCP Server, Docs, Wikis, FAQ & Chatbot
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
User Profile Builder <= 4.0.0 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
- shabti Frontend Admin by DynamiApps
- Cross-site scripting (XSS)
- CVSS 7.2 High
Affiliate Super Assistent <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via ‘doCommentShortcode’ function
- worschtebrot Affiliate Super Assistent
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute
- livecomposer Live Composer – Free WordPress Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_custom_field' Shortcode
- livecomposer Live Composer – Free WordPress Website Builder
- Cross-site scripting (XSS)