Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 8.8 High
Download Manager Pro < 7.5.6 - Unauthenticated Stored XSS via Email Lock Subscription
- Download Manager
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
EmbedPress < 4.6.7 - Contributor+ Stored XSS via Instagram Carousel Block Attributes
- EmbedPress
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Froxlor before 2.3.12 Stored XSS via SSL certificate issuer
- froxlor
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Adminer before 6.0.2 XSS via CONNECTION_ID escalating to RCE
- vrana adminer
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Hugo before 0.166.0 Cross-Site Scripting via text/org
- hugo
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Hugo before 0.166.0 Stored XSS via lineAnchors code block option
- hugo
- Cross-site scripting (XSS)
- CVSS 8.4 High
Grav Data Manager before 1.4.5 Stored XSS via item-detail view
- getgrav grav-plugin-datamanager
- Cross-site scripting (XSS)
- CVSS 8.6 High
SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban
- siyuan
- Cross-site scripting (XSS)
- CVSS 8.5 High
SiYuan before v3.8.4 Stored XSS via Attribute View textarea
- siyuan
- Cross-site scripting (XSS)
- CVSS 8.6 High
SiYuan before v3.8.4 Stored XSS via Unescaped Flashcard Content
- siyuan
- Cross-site scripting (XSS)
- CVSS 8.6 High
SiYuan before v3.8.4 Cross-Site Scripting via Kramdown IAL
- siyuan
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
AVideo before 29.1.0 Stored XSS via HTML Entity Bypass in trailer1 Field
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting
- mathurvishal CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
mathurvishal CloudClassroom-PHP-Project Faculty Video Management managevideos2.php cross site scripting
- mathurvishal CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.8 Medium
Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block
- Optimole
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
- WP Delicious
- Cross-site scripting (XSS)
- CVSS 7.5 High
Multiple elFinder Plugins - DOM-based XSS via postMessage Origin Bypass
- File Manager
- FileOrganizer
- Cross-site scripting (XSS)
- CVSS 8.0 High
WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Form Fields
- wp-review-slider-pro
- Cross-site scripting (XSS)
- CVSS 8.0 High
WP Review Slider Pro < 12.7.12 - Subscriber+ Stored XSS via Review Import
- wp-review-slider-pro
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP Directory Kit < 1.5.8 - Listing Admin+ Stored XSS via Category and Location Title and Icon Fields
- WP Directory Kit
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Automatic.css 4.0.0 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI
- Automatic.css
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cotonti through 1.0.0 Reflected XSS via message.php lng parameter
- Cotonti
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cotonti through 1.0.0 Reflected XSS via search highlight parameter
- Cotonti
- Cross-site scripting (XSS)
- CVSS 8.5 High
Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View
- horilla-hr
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored i18n XSS in WikiLambda's VisualEditor integration
- Wikimedia Foundation Mediawiki - WikiLambda Extension
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
UploadWizard Flickr collection and set titles allow DOM XSS
- Wikimedia Foundation Mediawiki - UploadWizard Extension
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Reflected XSS in Wikibase Special:SetLabel language validation
- Wikimedia Foundation Mediawiki - Wikibase Extension
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
TemplateSandbox can be abused for XSS by asking another user to preview a page with a certain sandbox prefix
- Wikimedia Foundation Mediawiki - TemplateSandbox Extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Cargo Exhibit field alias allows stored XSS
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Reflected XSS through Cargo Drilldown full-text search
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Anonymous reflected XSS in CargoExport invalid-alias errors
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Reflected XSS in Cargo Drilldown hierarchy filters
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Krayin laravel-crm TinyMCE Media Upload Sanitizer.php cross site scripting
- Krayin laravel-crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.5 High
GLPI: Reflected XSS in dashboards
- glpi
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
krayin laravel-crm Upload Functionality ConfigurationForm.php rules cross site scripting
- krayin laravel-crm
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.3 Medium
Zammad: Stored HTML injection in Knowledge Base video widget enables forced session switching via unescaped iframe attribute
- zammad
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
Zammad: Stored XSS via unescaped option labels in the object attribute options context UI
- zammad
- Cross-site scripting (XSS)
- CVSS 8.4 High
Zammad: Cross-Site Scripting in Ticket Notifications
- zammad
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Stored i18n XSS in the Flow integration of Thanks
- The Wikimedia Foundation Mediawiki - Thanks Extension
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
CVE-2026-18311
- Readwise Reader
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
CVE-2026-18320
- Readwise Reader
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
CVE-2026-18312
- Readwise Reader
- Cross-site scripting (XSS)
- CVSS 7.6 High
RabbitMQ: Stored XSS via TLS peer-certificate DN in stream-management UI
- rabbitmq-server
- Cross-site scripting (XSS)
- CVSS 7.5 High
RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint
- rabbitmq-server
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms
- InvoicePlane
- Cross-site scripting (XSS)
- CVSS 7.5 High
Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled
- Cross-site scripting (XSS)
<4.1.0 · fixed in 4.1.0
GHSA-v65j-hff3-753c · CVE-2026-57440 - CVSS 7.3 High
code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute
- Cross-site scripting (XSS)
<9.22.5 · fixed in 9.22.5
GHSA-qxg3-46rw-79j8 · CVE-2026-61823 - CVSS 8.7 High
code16/sharp has a stored XSS via data-html-content Sanitizer Bypass
- Cross-site scripting (XSS)
<9.22.5 · fixed in 9.22.5
GHSA-vj3q-vp3g-j9c8 · CVE-2026-61825 - CVSS 5.1 Medium
sheshbabu zen Note Editor NotesEditor.jsx dangerouslySetInnerHTML cross site scripting
- sheshbabu zen
- Cross-site scripting (XSS)
- Code injection
- CVSS 2.3 Low
Stored XSS in Cargo Drilldown tab names
- The Wikimedia Foundation Mediawiki - Cargo extension
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Crafted Calendar COUNTER Message From Address
- Zimbra Collaboration Suite (ZCS)
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite Modern Web Client Stored Cross-Site Scripting via Forged Share Invitation
- Zimbra Collaboration Suite (ZCS)
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Zimbra Collaboration Suite Classic Web Client Stored Cross-Site Scripting via Forged Share Invitation
- Zimbra Collaboration Suite (ZCS)
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page
- ail project ail framework
- Cross-site scripting (XSS)
- CVSS 8.5 High
Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip
- ail project ail framework
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names
- ail project ail framework
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.5 High
Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attributes
- ail project ail framework
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
CROSS-SITE SCRIPTING (XSS) VIA THE CMDCOOKIE PARAMETER REGESTA SMART HD-PLC OF TELDAT
- Teldat Regesta Smart HD-PLC - TLDPH16D2
- Cross-site scripting (XSS)
- CVSS 2.3 Low
lazy_html serializes SVG and MathML style and script text unescaped, allowing mutation XSS
- Cross-site scripting (XSS)
>=0.1.0, <0.1.13 · fixed in 0.1.13
GHSA-8rqp-v692-v82q · CVE-2026-92106 - CVSS 5.1 Medium
Stored Cross-Site Scripting in StockAgile by Novadigits technologies
- Novadigits technologies StockAgile
- Cross-site scripting (XSS)