Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.3 CriticalCritical · CVSS 9+
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Connect
- Adobe Connect Android Mobile App
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Adobe Connect | Cross-site Scripting (Stored XSS) (CWE-79)
- Adobe Connect
- Adobe Connect Android Mobile App
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
dgtlmoon Changedetection.io Visual Selector visual-selector.js setCurrentSelectedText cross site scripting
- dgtlmoon Changedetection.io
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
MISP Stored Cross-Site Scripting via Unescaped Organization Name in Admin Email View
- MISP
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
MISP Reflected Cross-Site Scripting in Event Export Confirmation Form via Unescaped JSON
- MISP
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
sfturing hosp_order Public Search Handlers HospitalController.java cross site scripting
- sfturing hosp_order
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
MISP Reflected Cross-Site Scripting in Attribute Histogram via Unescaped URL-Supplied Type List
- MISP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
MISP Reflected XSS via Unvalidated Object Type in AnalystData Overmind Thread
- MISP
- Cross-site scripting (XSS)
- CWE-20
- CVSS 7.2 High
WPC Product Bundles for WooCommerce <= 8.6.6 - Unauthenticated Stored Cross-Site Scripting via 'qty' Parameter
- wpclever WPC Product Bundles for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP Yelp Review Slider <= 9.2 - Unauthenticated Stored Cross-Site Scripting via Yelp Review Text (imported via wpyelp_download_source)
- jgwhite33 WP Yelp Review Slider
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Hostel <= 1.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'custom_currency' Parameter and Localization file URL Setting
- prasunsen Hostel
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Live Composer <= 2.1.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dslc_module_downloads_output' Shortcode Content
- livecomposer Live Composer – Free WordPress Website Builder
- Cross-site scripting (XSS)
- CVSS 8.8 High
Ninja Forms 3.15.3 - Unauthenticated Stored XSS via Paragraph Text Field in Submissions Admin
- Ninja Forms
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ninja Forms – The Contact Form Builder That Grows With You <= 3.15.3 - Stored Cross-Site Scripting
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel
- cozmoslabs TranslatePress – Translate Multilingual sites with AI Translation
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Text Styler <= 1.1.1 - Contributor+ Stored XSS
- Text Styler
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Booking Calendar <= 11.8.3 - Reflected Cross-Site Scripting via 'wpbc_auto_fill' Parameter
- wpdevelop Booking Calendar
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Contextual Related Posts <= 4.4.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'other_attributes' Block Parameter
- ajay Contextual Related Posts
- Cross-site scripting (XSS)
- CVSS 8.7 High
MCMS 6.1.1 through 6.2.1 is vulnerable to stored Cross-Site Scripting (XSS).
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
A reflected cross-site scripting vulnerability exists in x-ui 0.3.2.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
webpy web.py 0.76 is vulnerable to Cross Site Scripting (XSS) via render_jinja.__init__().
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
xuxueli xxl-job insert cross site scripting
- xuxueli xxl-job
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.4 Medium
Discourse: Stored XSS via unescaped actor name in post actions
- discourse
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Joplin: Stored XSS in public share viewer via javascript: URL bypass in isAcceptedUrl
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 7.6 High
Joplin: Stored XSS via inline-served note attachment on published shares
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 7.7 High
Joplin: Fountain embeds allow arbitrary script execution in published notes and the note viewer
- laurent22 joplin
- Cross-site scripting (XSS)
- CVSS 7.4 High
Envoy: Stored XSS in Admin Stats Interface (/stats?format=html)
- envoy
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Tautulli: Reflected XSS in `/search` endpoint
- Tautulli
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter
- Tautulli
- Cross-site scripting (XSS)
- CVSS 2.4 Low
Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values
- warp-tech warpgate
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter
- warp-tech warpgate
- Cross-site scripting (XSS)
- CVSS 8.3 High
Cross-site scripting in Telegram Desktop
- Telegram Desktop
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
draw.io: Stored XSS on file open via editable=0 sibling cell — patch bypass of CVE-2026-46642
- jgraph drawio
- Cross-site scripting (XSS)
- CWE-116
- CVSS 7.5 High
GoCD has stored XSS possible via tracking tool link highlighting on Compare Pipeline pages
- gocd
- Cross-site scripting (XSS)
- CVSS 7.0 High
GoCD has stored XSS possible via forged package material comments on Stage/Job/VSM pages
- gocd
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Ditty < 3.1.70 Stored XSS via Layout Tag Wrapper Attribute
- Metaphor Creations Ditty
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Aureus ERP before 1.6.0 Stored XSS via Chatter Field-Change Log
- Webkul Aureus ERP
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
UVdesk core-framework before 1.1.7 Stored XSS via SwiftMailer
- uvdesk core-framework
- uvdesk community-skeleton
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu
- MISP
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Stored Cross-Site Scripting via Unescaped Galaxy Cluster Tag Names in MISP Default Theme Galaxies Index
- MISP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Hyve5 Leantime Project Dashboard show.blade.php cross site scripting
- Hyve5 Leantime
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Hyve5 Leantime Kanban Board Tickets.php getAllGrouped cross site scripting
- Hyve5 Leantime
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Cross-Site Scripting (XSS) in 1millionbot’s AI chatbot platform
- AI Chatbot Platform (SaaS) de 1millionbot.
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Stored Cross-Site Scripting in MISP Galaxy Matrix Statistics via Unescaped Galaxy Name
- MISP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Omega Solution HRM OS SVG File Upload view cross site scripting
- Omega Solution HRM OS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
xuxueli xxl-job Task Management JobInfoController.java cross site scripting
- xuxueli xxl-job
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.1 High
idccms V1.70 is vulnerable to Cross Site Scripting (XSS) in /admin/makeDiy_deal.php.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
EMLOG-Pro 2.6.29 contains a XSS vulnerability that enables attackers to upload a malicious shell.
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 6.1 Medium
Stencil core 4.43.5 contains a DOM-based cross-site scripting (XSS) vulnerability in the component runtime.
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS).
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
CuteNews v.2.1.2 is vulnerable to Cross Site Scripting (XSS) in index.php.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 allows remote unauthenticated attackers to supply an arbitrarily named URL parameter key, with part of its name containing any URL-encoded…
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
newbee-ltd newbee-mall Goods Save Endpoint UploadController.java cross site scripting
- newbee-ltd newbee-mall
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Drug Recommendation System index.php cross site scripting
- SourceCodester Drug Recommendation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Drug Recommendation System Password Change change_password cross site scripting
- SourceCodester Drug Recommendation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Drug Recommendation System User Management add_user cross site scripting
- SourceCodester Drug Recommendation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
SourceCodester Drug Recommendation System add_symptom cross site scripting
- SourceCodester Drug Recommendation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
code-projects Assessment Management add-single-mark.php cross site scripting
- code-projects Assessment Management
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Assessment Management add-user.php cross site scripting
- code-projects Assessment Management
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
code-projects Assessment Management User Editing edit-user.php cross site scripting
- code-projects Assessment Management
- Cross-site scripting (XSS)
- Code injection