Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.21 - Cross Site Scripting (XSS) vulnerability
- CODEPRESS IT Solutions LLC Visitor Traffic Real Time Statistics Pro
- Cross-site scripting (XSS)
- CVSS 7.1 High
Realtyna Organic IDX plugin + WPL Real Estate < 5.4.2 - Reflected XSS via Location Selector Endpoint
- Realtyna Organic IDX plugin + WPL Real Estate
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
- EWWW Image Optimizer
- Cross-site scripting (XSS)
- CVSS 8.8 High
Dictionary <= 1.0 - Unauthenticated Stored XSS via Direct Dictionary Update
- Dictionary
- Cross-site scripting (XSS)
- CVSS 8.8 High
Dewa Kirim <= 1.0.0 - Unauthenticated Stored XSS via Checkout Coordinates
- Dewa Kirim
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag
- HT Mega Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 8.8 High
WPLP Cookie Consent < 4.4.4 - Unauthenticated Stored XSS via Consent Logs
- WPLP Cookie Consent
- Cross-site scripting (XSS)
- CVSS 7.1 High
Dictionary <= 1.0 - Reflected XSS via Multiple Parameters
- Dictionary
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.44 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cute Editor for ASP.NET 6.4 is vulnerable to reflected cross-site scripting caused by improper validation of the Theme GET parameter in colorpicker_more.aspx.
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Grav: Stored CSS injection via Markdown image resize() bypasses prior media style sanitizers in Grav
- Cross-site scripting (XSS)
>=2.0.0-rc.9, <2.0.0 · fixed in 2.0.0
GHSA-ffmg-hfvg-jhg9 · CVE-2026-58657 - CVSS 8.1 High
@nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the default configuration
- Cross-site scripting (XSS)
- CWE-184
<0.22.1 · fixed in 0.22.1
GHSA-mxm6-v9r6-r94c · CVE-2026-63671 - CVSS 5.1 Medium
Grav: XSS Blueprint Validation Bypass via Twig String Concatenation
- Cross-site scripting (XSS)
- Code injection
>=2.0.0, <2.0.1 · fixed in 2.0.1
GHSA-2c4f-86xc-cr74 · CVE-2026-61453 - CVSS 5.1 Medium
djust is vulnerable to stored/reflected XSS via javascript: URLs in built-in component template tags
- Cross-site scripting (XSS)
<1.0.7 · fixed in 1.0.7
GHSA-4mf4-73j6-mvrw · CVE-2026-61597 - CVSS 5.1 Medium
Craft CMS 5.7.0 before 5.10.13 Stored XSS via Generated Fields
- cms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 2.3 Low
changedetection.io through 0.60.6 Cross-Site Scripting via watch_title
- dgtlmoon changedetection.io
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cisco Identity Services Engine Cross-Site Scripting Vulnerability
- Cisco Identity Services Engine Software
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting
- ChangeWeDer crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Experience Manager as a Cloud Service
- Adobe Experience Manager 6.5 LTS
- Cross-site scripting (XSS)
- CVSS 7.3 High
Concrete CMS before 9.5.4 stored is vulneratble to cross-site scripting via unauthenticated XML/XSLT file upload in the Form Block
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 7.7 High
Concrete CMS below 9.5.4 is vulnerable to Stored XSS via User Timezone Field
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
SourceCodester Online Food Ordering System Category Update update_category.php cross site scripting
- SourceCodester Online Food Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
PbootCMS Template Rendering ContentController.php decode_string cross site scripting
- PbootCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.8 Medium
Cross-site scripting in Jenkins Project Jenkins Gitee Plugin
- Jenkins Project Jenkins Gitee Plugin
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in Jenkins Project Jenkins OWASP Dependency-Check Plugin
- Jenkins Project Jenkins OWASP Dependency-Check Plugin
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in Jenkins Project Jenkins Coverage Plugin
- Jenkins Project Jenkins Coverage Plugin
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in Jenkins Project Jenkins Warnings Plugin
- Jenkins Project Jenkins Warnings Plugin
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Cross-site scripting in Advantech EKI-1242IEIMS and others
- Advantech EKI-1242IEIMS
- Advantech EKI-1242EIMS
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
- CVSS 8.2 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Visualizer < 4.0.8 - Contributor+ Stored XSS via JSON Data Source
- Visualizer
- Cross-site scripting (XSS)
- CVSS 7.1 High
LearnPress < 4.4.7 - Reflected XSS via 'skin' Parameter
- LearnPress
- Cross-site scripting (XSS)
- CVSS 8.8 High
Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
- Optimole
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget
- Xpro Addons — 140+ Widgets for Elementor
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names
- WP Import Export Lite
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress <= 2.15.22 - Reflected Cross-Site Scripting via 'icn' Parameter
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Page Builder <= 5.9.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode_content' Parameter
- boldthemes Bold Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field
- codesupplyco Advanced Popups
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP-Lister Lite for eBay <= 3.8.9 - Unauthenticated Stored Cross-Site Scripting via AJAX Cron Handler Request
- wp-lab WP-Lister Lite for eBay
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
a2ui-project a2ui a2a-chat-canvas sanitizer-markdown-renderer-service.ts cross site scripting
- a2ui
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
kkFileView 5.0.0 through 5.0.2 allows reflected XSS via the /onlinePreview endpoint.
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Reflected Cross-Site Scripting
- Delinea Secret Server (On-Prem)
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in L7 Content Management via eval() Sinks
- Netcore NR255-V
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP and ARP Hostname Fields
- Netcore NR255-V
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DHCP/ACL Management Pages
- Netcore NR255-V
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting in Route/NAT Configuration CGI Handlers
- Netcore NR255-V
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via Unescaped QoS Rule Names
- Netcore NR255-V
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Netcore NR255-V 1.5.130703 Stored Cross-Site Scripting via DDNS eval() in ddns_wan_list_show.cgi
- Netcore NR255-V
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
QloApps through 1.7.0 Reflected XSS via Hotel Feature Validation Errors
- Webkul QloApps
- Cross-site scripting (XSS)
- CVSS 1.8 Low
Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 2.0 Low
Concrete CMS 9.4.0 through 9.5.2 is vulnerable to Cross-site scripting in the location panel duplicate-path confirmation dialog
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Concrete CMS below 9.5.3 is vulnerable to Reflected Cross-Site Scripting (XSS) via Conversation Custom Date Format
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in EdgeConnect SD-WAN Orchestrator Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) EdgeConnect SD-WAN Gateways
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Concrete CMS below 9.5.2 is vulnerable to Stored XSS via unescaped Express entry labels in association selectors
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 7.3 High
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS via group folder name on the Members > Groups dashboard
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 7.5 High
Concrete CMS 9.0 to 9.5.2 is vulnerable to Stored XSS in the Top Navigation Bar Block via Dropdown Child Page Names
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 7.5 High
Concrete CMS below version 9.5.3 is vulnerable to Stored XSS via country-less Address attribute in Express association views
- Concrete CMS
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- IBM Cloud Pak for Business Automation
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.
- IBM Cloud Pak for Business Automation
- Cross-site scripting (XSS)