Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via confirmLivePassword.php
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WWBN AVideo Reflected XSS via Referer Header Comment Breakout
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 7.2 High
Kirki <= 6.2.0 - Unauthenticated Stored Cross-Site Scripting via 'comment' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via mla_link_attributes Parameter
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.35 - Authenticated (Author+) Stored Cross-Site Scripting via Bulk Edit Preset Export/Import
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Media Library Assistant <= 3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'mla_link_href' Shortcode Parameter
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text
- Featured Image with URL
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript
- AI Builder
- Cross-site scripting (XSS)
- CVSS 8.8 High
Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content
- Gutenverse News
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration
- advanced-customized-prompts
- Cross-site scripting (XSS)
- CVSS 3.5 Low
GTranslate < 3.0.10 - Admin+ Stored XSS
- Translate WordPress with GTranslate
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute
- CoolClock
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON
- CoolClock
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Themify – WooCommerce Product Filter <= 1.5.5 - Reflected Cross-Site Scripting
- themifyme Themify – WooCommerce Product Filter
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- boldthemes Bold Timeline Lite
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
HUSKY <= 1.4.3 - Reflected Cross-Site Scripting
- realmag777 HUSKY – Products Filter for WooCommerce Professional
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting
- comesio Relevanssi – A Better Search
- Cross-site scripting (XSS)
- CVSS 7.2 High
Vigilant <= 2.10.2 - Unauthenticated Stored Cross-Site Scripting
- fernandot Vigilant – 100% Free Security Suite: Firewall, 2FA, Login, Headers, Scanner…
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WP-Members Membership Plugin <= 3.5.6 - Reflected Cross-Site Scripting
- cbutlerjr WP-Members Membership Plugin
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button <= 3.5.9 - Reflected Cross-Site Scripting
- premio Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty
- Cross-site scripting (XSS)
- CVSS 7.2 High
Simple Ajax Chat <= 20260811 - Unauthenticated Stored Cross-Site Scripting
- specialk Simple Ajax Chat – Add a Fast, Secure Chat Box
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Unlimited Elements For Elementor <= 2.0.16 - Reflected Cross-Site Scripting
- unitecms Unlimited Elements For Elementor
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP Photo Album Plus <= 9.2.08.003 - Unauthenticated Stored Cross-Site Scripting
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
- CVSS 2.4 Low
Flextype CMS 0.9.9 through 1.0.0-alpha.3 Stored XSS via Plugin Directory
- flextype
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in the p.rfihub.com component of Zeta Marketing Platform (ZMP) v1.0 allows attackers to execute arbitrary Javascript in the context of the victim'…
- Cross-site scripting (XSS)
- CVSS 8.6 High
Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements
- Cross-site scripting (XSS)
- CWE-116
<=19.2.25 || >=20.0.0, <20.3.30 || >=21.0.0, <21.2.22 || >=22.0.0, <22.1.4 · fixed in 20.3.30, 21.2.22, 22.1.4
GHSA-v3p8-whq6-r5jg · CVE-2026-88060 - CVSS 5.3 Medium
Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler
- Cross-site scripting (XSS)
<=19.2.25 || >=20.0.0, <20.3.28 || >=21.0.0, <21.2.20 || >=22.0.0, <22.1.0 · fixed in 20.3.28, 21.2.20, 22.1.0
GHSA-hh8m-fm6v-7cvg · CVE-2026-88057 - CVSS 5.5 Medium
AnythingLLM: Stored XSS Due to Unescaped Server-Side HTML Concatenation in MetaGenerator
- Mintplex-Labs anything-llm
- Cross-site scripting (XSS)
- CVSS 8.7 High
Open WebUI: Same-origin XSS to account takeover via terminal port-preview iframe hardcoding allow-same-origin
- Cross-site scripting (XSS)
- CWE-1021
>=0.8.11, <0.11.1 · fixed in 0.11.1
GHSA-jmc6-2wr8-h3wj · CVE-2026-87995 - CVSS 8.1 High
@eigenpal/docx-editor-react: CSS injection and print-time XSS via unescaped embedded font-family name
- Cross-site scripting (XSS)
<1.8.3 · fixed in 1.8.3
GHSA-x7m8-jrm8-hpvx - CVSS 7.1 High
WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability
- Greg Winiarski WPAdverts
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
- RealMag777 WPCS
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Page Visits Counter – Lite plugin <= 1.2.3 - Cross Site Scripting (XSS) vulnerability
- Denis Botić Page Visits Counter – Lite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress EventON plugin <= 2.5.7 - Cross Site Scripting (XSS) vulnerability
- Ashan Perera EventON
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WP Docs plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability
- Fahad Mahmood WP Docs
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Stored XSS in Ankaref's LIBRID/LIBREF
- Ankaref Innovation and Technology Inc. LIBRID/LIBREF
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
MISP: Unescaped HTML Injection in PDF Report Element Rendering
- MISP
- Cross-site scripting (XSS)
- CWE-116
- CVSS 5.4 Medium
Stored XSS Yönetim panel in Ankaref's LIBRID/LIBREF
- Ankaref Innovation and Technology Inc. LIBRID/LIBREF
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo AD_Server Stored XSS via log.php label parameter
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
AVideo LiveLinks Stored XSS via title and description fields
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo Stored XSS via Category Name and Icon Class
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
WWBN AVideo LoginControl Stored XSS via User-Agent Header
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4
- joomshaper.com SP Property extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- arubadev Aruba HiSpeed Cache
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.13.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Slider Field Value
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in SHIRASAGI
- SHIRASAGI
- Cross-site scripting (XSS)
- CVSS 1.1 Low
PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface
- Palo Alto Networks Cloud NGFW
- Palo Alto Networks PAN-OS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder <= 1.15.46 - Reflected Cross-Site Scripting
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Sidebar Manager Light <= 1.18 - Unauthenticated Stored Cross-Site Scripting via 'sbm_description' Parameter
- otwthemes Sidebar Manager Light
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Easy Google Fonts <= 2.0.4 - Authenticated (Author+) Stored Cross-Site Scripting via control_selectors Meta Field
- sunny_johal Easy Google Fonts
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Photo Module 'attributes' Setting
- Builderall for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Builderall for WordPress <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'bg_video_service_url' Setting
- Builderall for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Parameters
- Saturday Drive Ninja Forms - Scheduled Exports
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
FairSketch Rise CRM Version 3.9.6 is vulnerable to Cross Site Scripting (XSS).
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Italtel NFV 11.1.2-20210318 allows Multiple Stored XSS under NP_BCCAS-RMCTRL-01/IMCSCIWebGui/configuration.jsp?opration=list&object=announcementAS via the name, username, or mrfAnnouncementNameparame…
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Rizwan17 inventory-management-system Login Page index.php cross site scripting
- Rizwan17 inventory-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
Rizwan17 inventory-management-system List DBOperation.php cross site scripting
- Rizwan17 inventory-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 9.6 CriticalCritical · CVSS 9+
NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover
- NationalSecurityAgency skills-service
- Cross-site scripting (XSS)
- CWE-20
- CVSS 4.8 Medium
decidim-elections: Election question titles allow stored script execution
- Cross-site scripting (XSS)
<0.32.0 · fixed in 0.32.0
GHSA-9mvp-w4rr-5c6x · CVE-2026-44282 - CVSS 3.7 Low
LF Edge eKuiper: Self-XSS in External Service Creation
- Cross-site scripting (XSS)
<2.4.0 · fixed in 2.4.0
GHSA-g8rh-fjm6-h2h9 · CVE-2025-24978