Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.4 Medium
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- IBM Cloud Pak for Business Automation
- Cross-site scripting (XSS)
- CVSS 7.7 High
Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via Express form Text control save_control
- Concrete CMS
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- CVSS 8.4 High
Concrete CMS below version 9.5.3 is vulnerable to Stored XSS in Concrete CMS Form Submissions Report via Unescaped Question Label
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
code-projects Record Management System reg.php cross site scripting
- code-projects Record Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Reflected XSS in WordPress theme design-scuole-wordpress-theme
- Developers Italia design-scuole-wordpress-theme
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
crawl4ai before 0.9.3 DOM-based XSS via Playground UI
- unclecode crawl4ai
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
crawl4ai before 0.9.3 Cross-Site Scripting via innerHTML
- unclecode crawl4ai
- Cross-site scripting (XSS)
- CVSS 7.2 High
MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
- jetmonsters MotoPress Hotel Booking
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bridge - Creative Multipurpose WordPress Theme <= 30.8.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'circle_line' Shortcode Attribute
- QODE Bridge - Creative Multipurpose WordPress Theme
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render
- steedos-platform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Job Postings <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position_button' Parameter
- blueglassch Job Postings
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Eventin <= 4.1.23 - Authenticated (Custom+) Stored Cross-Site Scripting via 'etn_shedule_objective' schedule_slot Parameter
- arraytics Eventin – Event Calendar, Tickets, Registration, Booking & WooCommerce
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
PHPGurukul Hostel Management System manage-students.php cross site scripting
- PHPGurukul Hostel Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Governikus AusweisApp Desktop StartPAOSResponse cross site scripting
- Governikus AusweisApp Desktop
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix'…
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'sh…
- roxnor ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting
- PHPGurukul Daily Expense Tracker System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Bacularis 4.7.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in director tags.
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Bacularis 1.0.0 - 6.5.0 is vulnerable to Stored cross-site scripting (XSS) in the client address field.
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
1024-lab SmartAdmin v3.30.0 contains a stored cross-site scripting vulnerability in its file upload functionality.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in za-internet GmbH C-MOR Video Surveillance <= V6.0104 allows a remote attacker to execute arbitrary code via the size parameter in ptzpreset.pml component and the…
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
BharatMLStack up to and including 1.3.0 is vulnerable to Cross Site Scripting (XSS) via the component Trufflebox UI (trufflebox-ui) in ExpressionViewModal.jsx.
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
In BharatMLStack up to and including v1.3.0, Trufflebox UI stores the JWT authentication token, full user object, and session ID in the browser's localStorage, which is fully accessible to any JavaSc…
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
BharatMLStack up to and including v1.3.0 is vulnerable to Cross Site Scripting (XSS) in the component Trufflebox UI (trufflebox-ui) in GenericNumerixTable.jsx.
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting
- michaelliao itranswarp
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.3 High
Concrete CMS before 9.5.3 is vulnerable to Stored XSS in the YouTube block (vWidth/vHeight)
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 7.3 High
Concrete CMS 8.3.0 to 9.5.2 is vulnerable to Stored XSS in Calendar Event Name via Workflow Approval Notifications
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Takahe through 0.11.0 Cross-Site Scripting via javascript: URL Scheme
- takahe
- Cross-site scripting (XSS)
- CVSS 7.3 High
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS in Custom Page Alias Name
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
IBM Sterling Secure Proxy is vulnerable to multiple issues
- IBM Sterling Secure Proxy
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
IBM Cognos Analytics versions 12.0.4 and 12.1.3 is affected by security vulnerabilities
- IBM Cognos Analytics
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site scripting in Apple Safari and others
- Apple Safari
- Apple iOS and iPadOS
- Cross-site scripting (XSS)
- CVSS 7.0 High
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Stored XSS via Page Container icon
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access
- IBM Verify Identity Access
- IBM Security Verify Access
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities
- IBM WebSphere Application Server
- Cross-site scripting (XSS)
- CVSS 7.0 High
Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
CVE-2026-91021
- Trilium Trillium Notes
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution
- WSO2 API Control Plane
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
itsourcecode Loan Management System navbar.php cross site scripting
- itsourcecode Loan Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.3 CriticalCritical · CVSS 9+
parallax filament-comments through 3.0.0 Stored XSS via Comment Body
- parallax filament-comments
- Cross-site scripting (XSS)
- CVSS 2.3 Low
TripleLift video-bundle.js DOM-based XSS via postMessage
- TripleLift video-bundle.js
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
MISP: Stored XSS via Inline-Served SVG Organisation Logos and Report Pictures
- MISP
- Cross-site scripting (XSS)
- CWE-693
- CVSS 5.1 Medium
LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload
- laradashboard
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Syncope: Unauthenticated reflected XSS in Console and Enduser
- Apache Software Foundation Apache Syncope
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
SourceCodester Inventory Management System Product Management products_handler.php cross site scripting
- SourceCodester Inventory Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting
- SourceCodester Inventory Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting
- SourceCodester Inventory Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Cross-site scripting in Contec Co., Ltd. SV-CPT-MC310 and others
- Contec Co., Ltd. SV-CPT-MC310
- Contec Co., Ltd. SV-CPT-MC310F
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in Contec Co., Ltd. SV-CPT-MC310 and others
- Contec Co., Ltd. SV-CPT-MC310
- Contec Co., Ltd. SV-CPT-MC310F
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Contec Co., Ltd. CAN-2-WF and others
- Contec Co., Ltd. CAN-2-WF
- Contec Co., Ltd. CAN-2-USB
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF and others
- Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF
- Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF-US
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Contec Co., Ltd. FXA5000 and others
- Contec Co., Ltd. FXA5000
- Contec Co., Ltd. FXA5020
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in Contec Co., Ltd. CPSL-08P1EN
- Contec Co., Ltd. CPSL-08P1EN
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-* and others
- Contec Co., Ltd. Remote I/O Coupler Unit (Server Type) CPSN-MCB271-*
- Contec Co., Ltd. Remote I/O Coupler Unit (EtherNet/IP Adapter) CPSN-EOB471EI-[]1
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in Contec Co., Ltd. Integrated Type CPS-PC341[][]-*-9201 and others
- Contec Co., Ltd. Integrated Type CPS-PC341[][]-*-9201
- Contec Co., Ltd. Configurable type CPS-PCS341[][]-DS1-1201
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in Contec Co., Ltd. M2M Gateway Integrated Type CPS-MG341* and others
- Contec Co., Ltd. M2M Gateway Integrated Type CPS-MG341*
- Contec Co., Ltd. M2M Gateway Configurable type CPS-MGS341*
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Contec Co., Ltd. ECE1000 and others
- Contec Co., Ltd. ECE1000
- Contec Co., Ltd. ECE1020
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Contec Co., Ltd. RP-WAH-SR1 and others
- Contec Co., Ltd. RP-WAH-SR1
- Contec Co., Ltd. RP-WAH-SR2
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Contec Co., Ltd. SGA1000
- Contec Co., Ltd. SGA1000
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - regularlabs.com - Reflected XSS in Articles Anywhere extension for Joomla < 20.0.0, Users Anywhere extension for Joomla < 2.1.0
- regularlabs.com Articles Anywhere (Pro) extension for Joomla
- regularlabs.com Users Anywhere (Pro) extension for Joomla
- Cross-site scripting (XSS)