Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.8 Medium
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Campaign Item Preview
- WPeMatico RSS Feed Fetcher
- Cross-site scripting (XSS)
- CVSS 3.5 Low
The Post Grid < 7.9.5 - Contributor+ Stored HTML/iframe Injection via wp_kses_post Allow-List Widening
- The Post Grid
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
huanzi-qch base-admin Add User CommonController.java save cross site scripting
- huanzi-qch base-admin
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SEMCMS KindEditor Upload upload_json.php cross site scripting
- SEMCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.6 High
OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget
- Cross-site scripting (XSS)
>=5.0.6, <7.3.0 · fixed in 7.3.0
GHSA-gvf2-2rh5-mpgf · CVE-2026-77394 - CVSS 7.3 High
RabbitMQ: Stored XSS via TLS peer-certificate DN in management UI
- rabbitmq-server
- Cross-site scripting (XSS)
- CVSS 8.7 High
Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job stdout html view via ansi osc 8 hyperlink sequences (javascript: anchor) enabling…
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ultimate Addons for Contact Form 7 plugin <= 3.5.50 - Cross Site Scripting (XSS) vulnerability
- Themefic Ultimate Addons for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability
- PixelYourSite – Your smart PIXEL (TAG) Manager
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
- codepeople Calculated Fields Form
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability
- Mohammed Kaludi Core Web Vitals & PageSpeed Booster
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- Kevin Stover Ninja Forms
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Podcast Importer SecondLine plugin <= 1.5.6 - Cross Site Scripting (XSS) vulnerability
- SecondLineThemes Podcast Importer SecondLine
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
- RadiusTheme The Post Grid
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Post Grid plugin <= 7.9.5 - Cross Site Scripting (XSS) vulnerability
- RadiusTheme The Post Grid
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress ElementsKit Elementor addons Lite plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- Roxnor ElementsKit Elementor addons Lite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability
- metaphorcreations Ditty
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability
- Rustaurius Ultimate FAQ
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability
- Razorpay Payment Button
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
- Kitae Park Mang Board WP
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability
- Leap13 Premium Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability
- Leap13 Premium Blocks – Gutenberg Blocks for WordPress
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability
- Jacob N. Breetvelt WP Photo Album Plus
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability
- Tomdever wpForo Forum
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability
- NicolasKulka WPS Limit Login
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetTricks
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability
- Nexcess Event Tickets
- Cross-site scripting (XSS)
- CVSS 7.4 High
LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 7.4 High
LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 7.2 High
HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover
- Humhub
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
- Cross-site scripting (XSS)
<5.21.2 · fixed in 5.21.2
GHSA-w998-qmw9-mf4m · CVE-2026-63002 - CVSS 4.8 Medium
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
- Cross-site scripting (XSS)
<5.21.2 · fixed in 5.21.2
GHSA-mf2p-wjp4-99pq · CVE-2026-63001 - CVSS 5.9 Medium
Multiple vulnerabilities in the Microweber administration panel
- Microweber Administration panel
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms
- Apache Software Foundation Apache Sling XSS
- Cross-site scripting (XSS)
- CVSS 8.3 High
Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains
- tauri
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl
- Apache Software Foundation Apache Sling XSS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Sling XSS: Improper escaping in the XSS Webconsole plugin
- Apache Software Foundation Apache Sling XSS
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Apache Sling XSS: XSS possible through XSSAPI.getValidHref()
- Apache Software Foundation Apache Sling XSS
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
- jetmonsters Getwid – Gutenberg Blocks
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Subscribe Forms 1.4.1 - 1.6.2 - Author+ Stored XSS via Attention Effect Form Setting
- Subscribe Forms
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
JSM Show Post Metadata < 4.9.1 - Contributor+ Stored XSS via Custom Field Meta Key
- JSM Show Post Metadata
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Happy Addons for Elementor < 3.50.0 - Contributor+ Stored XSS via Creative Button Widget
- HappyAddons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Real3D Flipbook Lite < 5.4 - Author+ Stored XSS
- Real3D Flipbook
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
onSite internet GmbH Auktion NG Auktionssoftware Public Password Reset Endpoint forgotpasswd.html cross site scripting
- onSite internet GmbH Auktion NG Auktionssoftware
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Smart Attendance System with QR Code Scanner Self-Registration student_signup.php prepend cross site scripting
- SourceCodester Smart Attendance System with QR Code Scanner
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.2 High
IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities
- IBM Financial Transaction Manager (FTM) for RedHat OpenShift
- Cross-site scripting (XSS)
- CVSS 7.4 High
Stored cross-site scripting vulnerability in GitHub Enterprise Server allowed HTML attribute injection via the Markdown rendering pipeline
- GitHub Enterprise Server
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Home Assistant: XSS in Statistics Graph Card
- Cross-site scripting (XSS)
<2026.7.0 · fixed in 2026.7.0
GHSA-wx4m-69m9-gx3m · CVE-2026-91130 - CVSS 6.1 Medium
lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested content
- Cross-site scripting (XSS)
<1.5.5 · fixed in 1.5.5
GHSA-xpjq-3w4w-w5wr · CVE-2026-86062 - CVSS 5.3 Medium
Improper Neutralization of Input During Web Page Generation in OpenPLC Runtime v3
- Autonomy Logic OpenPLC Runtime
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text
- Cross-site scripting (XSS)
<2.4.37 || >=3.0.0, <3.1.8 · fixed in 2.4.37, 3.1.8
GHSA-56v6-2fhr-wxgq · CVE-2026-83801 - CVSS 5.4 Medium
MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler
- Cross-site scripting (XSS)
<0.22.0 · fixed in 0.22.0
GHSA-g2r2-3j32-j27x · CVE-2026-77272 - CVSS 2.1 Low
Unleash: CR-approval email renders user-controlled raw HTML
- Cross-site scripting (XSS)
<8.0.3 · fixed in 8.0.3
GHSA-7hvx-28gp-mf6j · CVE-2026-76909 - CVSS 5.1 Medium
Novu: Stored XSS in In-App Inbox via notification redirect.url javascript: scheme
- Cross-site scripting (XSS)
<3.18.0 · fixed in 3.18.0
GHSA-8gr3-5j6f-25gp · CVE-2026-75510 - CVSS 5.3 Medium
ClipBucket v5 before 5.5.3-#182 Reflected XSS via Query Parameters
- MacWarrior clipbucket-v5
- Cross-site scripting (XSS)
- CVSS 8.1 High
Adobe Experience Manager Forms JEE | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe AEM 6.5 Forms JEE
- Adobe AEM 6.5 LTS Forms JEE
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Connect
- Adobe Connect Android Mobile App
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Connect
- Adobe Connect Android Mobile App
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Adobe Connect | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Connect
- Adobe Connect Android Mobile App
- Cross-site scripting (XSS)