Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.3 High
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
- Cross-site scripting (XSS)
- Unrestricted file upload
>=4.22.0, <6.65.0 · fixed in 6.65.0
GHSA-8575-cr6v-7jh4 · CVE-2026-105649 - CVSS 8.7 High
Payload: Bypassed sanitization of user uploaded SVGs
- Cross-site scripting (XSS)
- Unrestricted file upload
<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-2pwp-2369-8fg3 · CVE-2026-105862 - CVSS 8.6 High
Ghost: Stored XSS via oEmbed Photo Responses
- Cross-site scripting (XSS)
- CWE-184
>=2.5.0, <6.64.0 · fixed in 6.64.0
GHSA-v3xr-g6p2-fvgv · CVE-2026-104414 - CVSS 8.5 High
Ghost: Stored XSS via Bookmark Card Images
- Cross-site scripting (XSS)
- Unrestricted file upload
>=5.94.0, <6.64.0 · fixed in 6.64.0
GHSA-347q-26qq-h2p6 · CVE-2026-104413 - CVSS 8.5 High
Ghost: Stored XSS via File Uploads on Local Storage
- Cross-site scripting (XSS)
- Unrestricted file upload
>=6.22.1, <6.64.0 · fixed in 6.64.0
GHSA-gfjp-2p8f-94qv · CVE-2026-104411 - CVSS 7.1 High
WordPress Disable and Remove Google Fonts | GDPR & DSGVO friendly plugin <= 2.0.2 - Cross Site Scripting (XSS) vulnerability
- Fontsplugin Disable and Remove Google Fonts | GDPR & DSGVO friendly
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
- Everest Forms
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Unlimited Elements For Elementor plugin <= 2.0.19 - Cross Site Scripting (XSS) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Cross-site scripting (XSS)
- CVSS 7.1 High
Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable
- Cross-site scripting (XSS)
- Information disclosure
<3.3.0 · fixed in 3.3.0
GHSA-r5mf-4r5x-q78f · CVE-2026-106106 - CVSS 8.3 High
Quasar Framework: App Vite SSR and SSG nonce attributes are not safely constrained
- Cross-site scripting (XSS)
- CWE-116
<3.3.0 · fixed in 3.3.0
GHSA-5m6h-8g35-p3m7 · CVE-2026-106107 - CVSS 10.0 CriticalCritical · CVSS 9+
Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead()
- Cross-site scripting (XSS)
- CWE-116
<2.22.0 · fixed in 2.22.0
GHSA-pq96-jpmf-w254 · CVE-2026-106102 - CVSS 2.3 Low
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
- gophish
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in SonicWall SMA1000
- SonicWall SMA1000
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Happy Addons for Elementor plugin <= 3.50.0 - Cross Site Scripting (XSS) vulnerability
- weDevs Happy Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Prime Slider – Addons For Elementor plugin <= 4.6.2 - Cross Site Scripting (XSS) vulnerability
- BdThemes Prime Slider – Addons For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
- ExpressTech Quiz And Survey Master
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
- WP Media Rocket Lazy Load
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability
- BdThemes Element Pack Elementor Addons
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
- David Lingren Media LIbrary Assistant
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Element Pack Elementor Addons plugin <= 8.8.6 - Cross Site Scripting (XSS) vulnerability
- BdThemes Element Pack Elementor Addons
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in Veeam Backup Enterprise Manager
- Veeam Backup Enterprise Manager
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Apache Impala: Stored XSS in Impala query plans
- Apache Software Foundation Apache Impala
- Cross-site scripting (XSS)
- CVSS 7.2 High
OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' Search Parameter in comments-atom Feed
- daanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.
- Cross-site scripting (XSS)
- CVSS 7.1 High
If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter
- If-So Dynamic Content
- Cross-site scripting (XSS)
- CVSS 7.1 High
Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions
- Magee Shortcodes
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Crop Dimensions
- Envira Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Envira Gallery < 1.16.1 - Author+ Stored XSS via Gallery Image ID
- Envira Gallery
- Cross-site scripting (XSS)
- CVSS 7.2 High
Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Unauthenticated Stored Cross-Site Scripting via Registration Metadata
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Cross-site scripting in ASUS Router
- ASUS Router
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Gitea repository media API stored XSS
- Gitea
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Apache Commons BCEL: Class2HTML emits unescaped class strings, enabling stored XSS
- Apache Software Foundation Apache Commons BCEL
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Security Advisory 0192
- Arista Networks CloudVision CUE
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
Security Advisory 0192
- Arista Networks CloudVision CUE
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Security Advisory 0185
- Arista Networks CloudVision Portal
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Gitea container registry stored XSS through blob media type
- Gitea
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Unauthenticated DOM-Based Cross-Site Scripting (XSS) Vulnerability in the ClearPass Policy Manager Client Interface
- Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
- Cross-site scripting (XSS)
- CVSS 8.8 High
Unauthenticated Stored Cross-Site Scripting (XSS) Vulnerability in ClearPass Policy Manager Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM)
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
NetBox 2.9.5 < 4.7.0 Session Hijacking via Custom Links
- netbox
- Cross-site scripting (XSS)
- Information disclosure
- CVSS 8.4 High
MISP sachertortephp - CakeResponse::download() HTTP Response Splitting via Unsanitized Filename Enables Stored XSS
- MISP sachertortephp
- Cross-site scripting (XSS)
- Other injection
- CVSS 5.4 Medium
Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter
- Red Hat Ansible Automation Platform 2
- Red Hat Hardened Images
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
getformwork URI Sanitizer DomSanitizer.php sanitizeNodeAttribute cross site scripting
- formwork
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
SimpleChat: Stored XSS via group document filename in inline onclick handler
- microsoft simplechat
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Cross-Site Scripting (XSS) vulnerability identified in OpenText™ Content Management
- OpenText Content Management
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in Akıllı Ticaret's E-Commerce Pack
- Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability
- Bởi brandtoss WP Mailster
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
- epiphyt Form Block
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
- Nexcess GiveWP
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
- ThimPress LearnPress
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability
- picu
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
- Syed Balkhi Charitable
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Cross Site Scripting (XSS) vulnerability
- Fluent Forms Free vs Pro Fluent Forms Pro Add On Pack
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.4.6 - Cross Site Scripting (XSS) vulnerability
- WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WooCommerce Simple Auctions plugin <= 3.0.10 - Cross Site Scripting (XSS) vulnerability
- wpgenie WooCommerce Simple Auctions
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Video Background Block – Use video as background in the section. plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability
- bPlugins Video Background Block – Use video as background in the section.
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Social Rocket plugin <= 1.3.5 - Cross Site Scripting (XSS) vulnerability
- Socialrocket Social Rocket
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.6 - Cross Site Scripting (XSS) vulnerability
- Aman CF7 Views – Complete Entry Management for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability
- Plugin Devs Blog, Posts and Category Filter for Elementor
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VikRentCar plugin <= 1.4.7 - Cross Site Scripting (XSS) vulnerability
- e4jvikwp VikRentCar
- Cross-site scripting (XSS)