Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.4 Medium
Cross-site scripting in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Synology DiskStation Manager (DSM)
- Synology DiskStation Manager (DSM)
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in KA Informatics' Bar Association Website
- KA Informatics Technologies Ltd. Co. Bar Association Website
- Cross-site scripting (XSS)
- CVSS 7.6 High
HCL BigFix Service Management is affected by multiple security vulnerabilities.
- HCL Software HCL BigFix Service Management
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Qi Addons For Elementor <= 1.11 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
- qodeinteractive Qi Addons For Elementor
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting
- ninjateam FileBird – WordPress Media Library Folders & File Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Kubio AI Page Builder <= 2.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via kubio/copyright Block Content
- extendthemes Kubio AI Page Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute
- wpchill Strong Testimonials
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter
- satollo Newsletter – Send awesome emails from WordPress
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
ShopLentor <= 3.5.1 - Reflected Cross-Site Scripting via Query-String Parameter Name
- devitemsllc ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
VK All in One Expansion Unit <= 9.118.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'vkExUnit_cta_img_position' Post Meta
- kurudrive VK All in One Expansion Unit
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
QcalAgent
- QNAP Systems Inc. QcalAgent
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Booking Calendar <= 11.8.2 - Reflected Cross-Site Scripting via 'options' Parameter
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
EmbedPress <= 4.6.5 - Reflected Cross-Site Scripting via 'hash' and 'unique' Parameters
- wpdevteam EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute
- smub Custom Twitter Feeds – A Tweets Widget or X Feed Widget
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Magazine Blocks <= 1.8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'clientId' Block Attribute
- wpblockart Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
All Bootstrap Blocks <= 1.3.31 - Contributor+ Stored XSS via areoi/button type Attribute
- All Bootstrap Blocks
- Cross-site scripting (XSS)
- CVSS 8.8 High
iGMS Direct Booking < 2.0 - Unauthenticated Stored XSS via Widget Settings
- iGMS Direct Booking
- Cross-site scripting (XSS)
- CVSS 8.8 High
VikBooking 1.8.8 - 1.8.14 - Unauthenticated Stored XSS via SVG Chat Attachment
- VikBooking Hotel Booking Engine & PMS
- Cross-site scripting (XSS)
- CVSS 8.8 High
Easy Form Builder 4.0.0 - 4.1.3 - Unauthenticated Stored XSS via Form Type Confusion
- Easy Form Builder by WhiteStudio
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
King Addons for Elementor < 51.1.81 - Contributor+ Stored XSS via Template Catalog Import
- King Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability
- Automattic WordPress
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API
- bdthemes Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator
- bdthemes Pixel Gallery Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action
- themewant RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute
- themewant RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in Moonshot AI Kimi version as of 2026-07-18 allows a remote attacker to execute arbitrary code via the HTML artifact Preview rendering; public Share view component
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter
- themefusecom Brizy – Page Builder
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Aureus ERP through 1.6.0 Stored XSS via Payment Term Note
- Webkul Aureus ERP
- Cross-site scripting (XSS)
- CVSS 8.2 High
Azure Portal Spoofing Vulnerability
- Microsoft Azure Portal
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
CubeCart: Stored XSS in Product Description Editor via Global Sanitizer Bypass
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System
- cubecart v6
- Cross-site scripting (XSS)
- CVSS 7.6 High
Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field
- givanz Vvveb
- Cross-site scripting (XSS)
- CWE-116
- CVSS 5.1 Medium
Stored XSS via SVG Upload
- dataease SQLBot
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate
- Cross-site scripting (XSS)
<2.0.14 · fixed in 2.0.14
GHSA-q2j8-x8hf-63ch · CVE-2026-75834 - CVSS 9.3 CriticalCritical · CVSS 9+
Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS
- Cross-site scripting (XSS)
<2.0.15 · fixed in 2.0.15
GHSA-vfmf-q6x9-cw96 · CVE-2026-75828 - CVSS 6.1 Medium
@platejs/core HTML deserialization can trigger browser behavior during parsing
- Cross-site scripting (XSS)
<53.3.11 || >=54.0.0-beta.0, <=54.0.0-beta.1 · fixed in 53.3.11
GHSA-qrfj-mgw8-j9c6 · CVE-2026-88976 - CVSS 2.3 Low
djust: A template binding inherits a context safety grant it never earned (XSS)
- Cross-site scripting (XSS)
- CWE-116
<1.0.10 || >=1.1.0, <1.1.2 · fixed in 1.0.10, 1.1.2
GHSA-xjw9-38cr-6372 · CVE-2026-125112 -
djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)
- Cross-site scripting (XSS)
- CWE-116
<1.1.1 · fixed in 1.1.1
GHSA-9395-2g46-rj3f - CVSS 5.3 Medium
MapServer: Reflected XSS in OpenLayers HTML Output via `HTTP_X_FORWARDED_HOST`
- MapServer
- Cross-site scripting (XSS)
- CVSS 7.3 High
CVE-2026-76154 CVE Record
- Grafana OSS
- Grafana Enterprise
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
FairEmail: Cross-site scripting (XSS) in AMP message rendering (ActivityAMP)
- M66B FairEmail
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Chamilo LMS: Student-to-admin stored XSS in private messages via v-html
- chamilo-lms
- Cross-site scripting (XSS)
- CVSS 8.2 High
TS3 Manager: Reflected XSS via /api/download port parameter steals operator session
- joni1802 ts3-manager
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Grav: Stored XSS via Markdown audio/video media <source> URL
- Cross-site scripting (XSS)
<2.0.15 · fixed in 2.0.15
GHSA-6qw9-4vv5-jr97 · CVE-2026-75831 - CVSS 5.1 Medium
Grav: Stored XSS via quoted-attribute bypass in detectXss
- Cross-site scripting (XSS)
>=1.5.2, <2.0.13 · fixed in 2.0.13
GHSA-269c-h76q-8cxw · CVE-2026-72832 - CVSS 8.5 High
MISP Overmind: Stored Cross-Site Scripting via Unescaped Object Names in Statistics Legends
- misp
- Cross-site scripting (XSS)
- CVSS 8.7 High
Vendure has stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions
- Cross-site scripting (XSS)
<3.6.5 · fixed in 3.6.5
GHSA-xhq9-whgq-49j5 · CVE-2026-63459 - CVSS 8.6 High
SiYuan before 3.8.4 Cross-Site Scripting via Document Title
- siyuan
- Cross-site scripting (XSS)
- CVSS 8.6 High
SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels
- siyuan
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8
- pycontribs ansi2html
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
- WP Inventory Manager
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
- Dylan Kuhn Geo Mashup
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress PublishPress Series plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- PublishPress Series
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetElements For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress PropertyHive plugin <= 2.2.6 - Cross Site Scripting (XSS) vulnerability
- Property Hive PropertyHive
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetSearch plugin <= 3.6.3 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetSearch
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetBlocks For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability
- bdthemes Element Pack Elementor Addons
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetTabs
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetBlog
- Cross-site scripting (XSS)