Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)
- CVSS 7.2 High
Themify Builder <= 7.8.1 - Unauthenticated Stored Cross-Site Scripting via 'css[fonts]' Parameter
- themifyme Themify Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Repeater Fields for Elementor Forms <= 2.2.7 - Unauthenticated Stored Cross-Site Scripting via Repeater Field Value
- addonsorg Repeater Fields for Elementor Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Maps <= 4.9.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via shapes_values Parameter
- flippercode WP Maps – Google Maps, OpenStreetMap, Mapbox, Store Locator with Search, Filters & Listings
- Cross-site scripting (XSS)
- CVSS 7.2 High
User Profile Builder <= 4.0.2 - Unauthenticated Stored Cross-Site Scripting via Avatar Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Restaurant Menu and Food Ordering <= 2.4.14 - Unauthenticated Stored Cross-Site Scripting via 'phone_number' Parameter
- jetmonsters Restaurant Menu and Food Ordering
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
User Profile Builder <= 4.0.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Avatar Field
- cozmoslabs User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter
- codename065 Premium Packages – Sell Digital Products Securely
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter
- sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
wpForo Forum <= 3.1.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'telegram' Profile Field
- tomdever wpForo Forum
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter
- smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
- Cross-site scripting (XSS)
- CVSS 7.2 High
Zero Spam for WordPress <= 5.7.10 - Unauthenticated Stored Cross-Site Scripting via Nested POST Array Keys via Contact Form 7 Integration
- bmarshall511 Zero Spam for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Better Messages <= 3.0.4 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via User Display Name
- wordplus Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenverse <= 4.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Comment Block 'suffixMain' Attribute
- jegstudio Gutenverse – WordPress Blocks, Page Builder & Site Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter
- bookingalgorithms BA Book Everything
- Cross-site scripting (XSS)
- CVSS 7.2 High
HT Contact Form <= 2.10.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'form_data' Rich Text Field via Draft Save/Resume
- htplugins HT Contact Form – Drag & Drop Form Builder for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GeoDirectory <= 2.8.183 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'business_hours' Parameter
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
- CVSS 7.2 High
Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'output_format' Parameter via Pro Export Print Job
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
- CVSS 7.2 High
Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via 'productTitle' in '_fpd_data' Order Item Meta
- radykal Fancy Product Designer
- Cross-site scripting (XSS)
- CVSS 7.2 High
AMP for WP <= 1.1.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content Regex Transformation
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field
- jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GeoDirectory <= 2.8.181 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Text-type Custom Field (e.g., 'phone')
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links
- Link Library
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in ITFlow
- ITFlow
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via cjtoolbox Shortcode
- wipeoutmedia CSS & JavaScript Toolbox
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
ningzichun student-management-system addLog.php echo cross site scripting
- ningzichun student-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Cross-site scripting in madpsy ka9q_ubersdr
- madpsy ka9q_ubersdr
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
A reflected cross-site scripting (XSS) vulnerability in the EntryAbstract.save() component of APSL puput v1.2.1 through v2.2.0 allows authenticated attackers with Wagtail Editor privileges to execute…
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in Netgate pfSense 26.03.1-RELEASE allows an attacker to execute arbitrary code via the pfBlockerNG package
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
- Cross-site scripting (XSS)
- CWE-116
<0.4.3 · fixed in 0.4.3
GHSA-j8r4-32c5-33rc · CVE-2026-61784 - CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Web Form Description
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Product Name Field
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Contact Name Field
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 8.2 High
phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission
- Cross-site scripting (XSS)
<4.2.0-alpha · fixed in 4.2.0-alpha
GHSA-pgwp-vc7q-cvj3 · CVE-2026-56736 - CVSS 5.1 Medium
Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title
- krayin laravel-crm
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
CyberChef: Prototype pollution in Series Chart operation
- Cross-site scripting (XSS)
- Prototype pollution
<11.2.0 · fixed in 11.2.0
GHSA-fx6f-382r-j72c · CVE-2026-57439 - CVSS 5.3 Medium
YunaiV/zhijiantianya ruoyi-vue-pro File Upload FileController.java cross site scripting
- YunaiV ruoyi-vue-pro
- zhijiantianya ruoyi-vue-pro
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API
- Cross-site scripting (XSS)
<8.7.0 · fixed in 8.7.0
GHSA-396x-xmvh-p563 · CVE-2026-63498 - CVSS 8.1 High
Snipe-IT: Stored XSS via Custom Field name in asset-list column headers
- Cross-site scripting (XSS)
<8.7.0 · fixed in 8.7.0
GHSA-p9h3-gvpq-5539 · CVE-2026-62368 - CVSS 6.1 Medium
Mailspring: Stored XSS in attachment quick preview (unsanitized Markdown/DOCX/XLSX conversion)
- Foundry376 Mailspring
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
volotat Anagnorisis Media Filename PlaylistManager.js html cross site scripting
- volotat Anagnorisis
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.4 Medium
Discourse: Encode action_code_who in mention URLs
- discourse
- Cross-site scripting (XSS)
- CVSS 5.0 Medium
Discourse: Chat upload filenames rendered as raw HTML in excerpts
- discourse
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Discourse: Stored HTML injection in video notification emails
- discourse
- Cross-site scripting (XSS)
- CVSS 8.7 High
Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users
- discourse
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Reflected XSS in CirrusSearch debug explain output
- The Wikimedia Foundation Mediawiki - CirrusSearch Extension
- Cross-site scripting (XSS)
- CVSS 10.0 CriticalCritical · CVSS 9+
SunEditor: Critical XSS vulnerability - sanitizer bypass
- Cross-site scripting (XSS)
<2.47.11 · fixed in 2.47.11
GHSA-6rf4-v2fh-m6p4 · CVE-2026-59167 - CVSS 5.3 Medium
Excalidraw Imported File restore.ts cross site scripting
- Excalidraw
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.3 High
Stored Cross-Site Scripting (XSS) in OpenText Vendor Invoice Management for SAP Solutions Capture Validation Application
- OpenText Vendor Invoice Management for SAP Solutions
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Aureus ERP 1.6.0 Stored XSS via SVG File Upload
- Webkul Aureus ERP
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected Cross-Site Scripting via URL Path in Paessler PRTG Network Monitor
- Paessler GmbH PRTG Network Monitor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- magazine3 WP Multilang – Translation and Multilingual Plugin
- Cross-site scripting (XSS)
- CVSS 3.8 Low
PaperCut Hive Embedded App for Ricoh: Javascript injection
- PaperCut Hive
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WPeMatico RSS Feed Fetcher < 2.8.26 - Contributor+ Stored XSS via Word to Category
- WPeMatico RSS Feed Fetcher
- Cross-site scripting (XSS)