Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.8 Medium
Kirki 6.0.0 - 6.3.0 - Author+ Stored XSS via Unsanitized SVG Upload
- Kirki
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Master Slider <= 3.11.2 - Contributor+ Stored XSS via ms_slider Shortcode Attributes
- Master Slider
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
olivier-ls PHP-FTS Search SearchEngine.php buildHighlights cross site scripting
- olivier-ls PHP-FTS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.7 Medium
Duplicate Advisory: hono/jsx renders plain strings unescaped in boundary components, leading to XSS
- Cross-site scripting (XSS)
* · no fixed version yet
GHSA-6623-4q32-82v8 - CVSS 4.7 Medium
LiteSpeed Cache <= 7.9 - Reflected Cross-Site Scripting via ESI 'esi' Parameter
- litespeedtech LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
YS LeadGen – Popups, Opt-ins & Lead Capture <= 2.1.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting via User Input
- ysinnovations YS LeadGen – Popup Builder, Popup Maker & Form Builder for WordPress | Lead Generation, Email Marketing, Sales, Conversions, Opt-Ins & Subscribers
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gum Addon for Elementor <= 1.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pop_tag' Widget Setting
- celomitan Gum Addon for Elementor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Spinner Field Input
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Real 3D Flipbook <= 5.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightboxtext' Shortcode Attribute
- creativeinteractivemedia Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
- dvankooten MC4WP: Mailchimp for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.13 - Authenticated (Subscriber+) Cross-Site Scripting via User Input
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
OTP Login & Register Woocommerce <= 2.7.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'fb-config' Setting
- xootix OTP Login & Register Woocommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Composer <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pbwp_raw_shortcode' Shortcode
- ghozylab WP Composer – The Easiest Page Builder
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' and 'host' Parameters
- sslzen SSL Zen — SSL Certificate Installer & HTTPS Redirects
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler
- AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)
- Cross-site scripting (XSS)
- CVSS 7.2 High
Quill Forms | Conversational Multi Step Forms, Surveys & quizzes <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting via Multiple Choice 'Other' Value
- mdmag Quill Forms | Conversational Multi Step Forms, Surveys & quizzes
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WP Customer Reviews <= 3.7.8 - Reflected Cross-Site Scripting via 'wpcr3_fname' Parameter
- bompus WP Customer Reviews
- Cross-site scripting (XSS)
- CVSS 8.8 High
Master Blocks 1.4.1 - 1.4.1.4 - Unauthenticated Stored XSS via White Label Settings
- Master Blocks
- Cross-site scripting (XSS)
- CVSS 8.8 High
Ultimate Member < 2.13.1 - Unauthenticated Stored XSS via Profile Page Title
- Ultimate Member
- Cross-site scripting (XSS)
- CVSS 7.1 High
Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter
- Estatik Real Estate Plugin
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Business Name Generator <= 1.3 - Admin+ Stored XSS via Button Color Setting
- Business Name Generator
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
WP2Social Auto Publish <= 2.4.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'pages' Parameter
- f1logic WP2Social Auto Publish
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Pochipp <= 1.20.2 - Reflected Cross-Site Scripting via 'keyword' Parameter
- Pochipp
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Tutor LMS <= 4.0.8 - Reflected Cross-Site Scripting via 'back_url' and 'search' Parameters
- themeum Tutor LMS – eLearning and online course solution
- Cross-site scripting (XSS)
- CVSS 7.2 High
Asset CleanUp: Page Speed Booster <= 1.4.0.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- gabelivan Asset CleanUp: Page Speed Booster
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WPComplete <= 2.9.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'empty' Shortcode Attribute
- stellarwp WPComplete
- Cross-site scripting (XSS)
- CVSS 8.6 High
SiYuan through 3.8.4 Stored XSS via Heading Style Attribute
- siyuan
- Cross-site scripting (XSS)
- CVSS 8.6 High
SiYuan through 3.8.4 Stored XSS via notebook names
- siyuan
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Open edX Platform: Stored CSS Injection in Email Digest Notifications via Unsanitized Thread Title (incomplete patch of CVE-2026-42857)
- openedx-platform
- Cross-site scripting (XSS)
- CVSS 8.1 High
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 8.9 High
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 8.9 High
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 8.9 High
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
IBM Guardium Data Protection is affected by multiple vulnerabilities.
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Io.quarkus.qute:quarkus-core: cross-site scripting (xss) and json injection via qute {#eval} section in quarkus
- Red Hat Build of Apache Camel 3.33.4.redhat
- Red Hat build of Quarkus 3.27.6.redhat
- Cross-site scripting (XSS)
- CVSS 8.2 High
File Viewer: DOM XSS via unsafe hyperlink schemes in the legacy DOC renderer
- Cross-site scripting (XSS)
<2.3.1 · fixed in 2.3.1
GHSA-3753-m2x2-q623 · CVE-2026-91127 - CVSS 6.1 Medium
md-editor-v3: XSS via fenced-code language rendering bypass
- Cross-site scripting (XSS)
<6.5.4 · fixed in 6.5.4
GHSA-3rm2-h79c-8qw6 · CVE-2026-84992 - CVSS 5.1 Medium
Semantic MediaWiki's Special:FacetedSearch cstate hidden inputs enable reflected XSS (residual of CVE-2025-10354)
- Cross-site scripting (XSS)
>=4.2.0, <7.2.1 · fixed in 7.2.1
GHSA-9rcc-pmj8-ffhr · CVE-2026-116891 - CVSS 6.1 Medium
Semantic MediaWiki affected by reflected XSS in `Special:Ask` via a forged cursor pagination token
- Cross-site scripting (XSS)
>=7.0.0, <7.2.0 · fixed in 7.2.0
GHSA-cx86-7xwp-w9wf · CVE-2026-77616 - CVSS 6.1 Medium
Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)
- Cross-site scripting (XSS)
<7.2.0 · fixed in 7.2.0
GHSA-q5fm-9mx6-44f4 · CVE-2026-77610 - CVSS 6.1 Medium
Semantic MediaWiki affected by Special:Ask table `sep` parameter reflected XSS
- Cross-site scripting (XSS)
<7.2.0 · fixed in 7.2.0
GHSA-7xv3-gf2g-498h · CVE-2026-77607 - CVSS 6.1 Medium
Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)
- Cross-site scripting (XSS)
<7.2.0 · fixed in 7.2.0
GHSA-59xw-qv23-j3rc · CVE-2026-77608 - CVSS 6.1 Medium
Semantic MediaWiki has reflected XSS in Special:Ask plain table headers
- Cross-site scripting (XSS)
<7.2.0 · fixed in 7.2.0
GHSA-3jp5-3h47-28qf · CVE-2026-77606 - CVSS 8.6 High
Semantic MediaWiki vulnerable to stored XSS through wikitext via improper use of non-reserved data attributes
- Cross-site scripting (XSS)
>=3.1.0, <7.0.0 · fixed in 7.0.0
GHSA-hg8h-557g-q8pp · CVE-2025-61682 - CVSS 6.1 Medium
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
- IBM Common Licensing
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
- IBM Common Licensing
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
- IBM Common Licensing
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Multiple vulnerabilities affect IBM License Key Server Administration and Reporting Tool and IBM LKS Administration Agent
- IBM Common Licensing
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
IBM Financial Transaction Manager for SWIFT Services for Multiplatforms is vulnerable to cross-site scripting.
- IBM Financial Transaction Manager for SWIFT Services for Multiplatforms
- Cross-site scripting (XSS)
- CVSS 8.6 High
Concrete CMS Community Store before 2.7.8 Stored XSS
- concretecms-community-store community_store
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
SveltyCMS SVG Media Upload media-service.server.ts cross site scripting
- SveltyCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
Opencast: Stored XSS in Paella player via WebVTT/DFXP caption cue text
- Cross-site scripting (XSS)
<19.7 || >=20.0, <20.2 · fixed in 19.7, 20.2
GHSA-m6c8-jcw2-5r25 · CVE-2026-77615 - CVSS 7.2 High
Popup Maker <= 1.24.0 - Unauthenticated Stored Cross-Site Scripting via values[Name] Parameter
- danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Popup Maker <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via post_title
- danieliser Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 7.2 High
Jeg Kit for Elementor <= 3.2.16 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.4 - Unauthenticated Stored Cross-Site Scripting via Elementor Cookie Blocker Regex
- Complianz GDPR/CCPA Cookie Consent Banner
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
CSS & JavaScript Toolbox <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting via Assignment Engine Fields
- wipeoutmedia CSS & JavaScript Toolbox
- Cross-site scripting (XSS)