Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
WordPress Salon booking system plugin <= 10.31.5 - Cross Site Scripting (XSS) vulnerability
- Dimitri Grassi Salon booking system
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetReviews
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability
- Mamunur Rashid Classified Listing
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetBlog
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress UsersWP plugin <= 1.2.73 - Cross Site Scripting (XSS) vulnerability
- Stiofan UsersWP
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress BlockStrap Page Builder - Bootstrap Blocks plugin <= 0.1.58 - Cross Site Scripting (XSS) vulnerability
- Stiofan BlockStrap Page Builder - Bootstrap Blocks
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Betheme theme <= 28.5.8 - Cross Site Scripting (XSS) vulnerability
- Muffingroup Betheme
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress UpSolution Core plugin < 9.4.1 - Cross Site Scripting (XSS) vulnerability
- UpSolution Core
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Welcart e-Commerce plugin <= 2.12.3 - Cross Site Scripting (XSS) vulnerability
- Welcart e-Commerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
- David Lingren Media LIbrary Assistant
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
- codepeople Search in Place
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability
- Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VikBooking Hotel Booking Engine & PMS plugin <= 1.8.14 - Cross Site Scripting (XSS) vulnerability
- e4jvikwp VikBooking Hotel Booking Engine & PMS
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress HUSKY plugin <= 1.4.3.2 - Cross Site Scripting (XSS) vulnerability
- PluginUs.Net HUSKY
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability
- Damian Góra FiboSearch
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetBlocks For Elementor plugin <= 1.5.2.1 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetBlocks For Elementor
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected Cross-Site Scripting in BeeTienda eCommerce platform
- BeeTienda eCommerce Platform
- Cross-site scripting (XSS)
- CVSS 8.9 High
Stored Cross-site Scripting (XSS) in Telerik Report Server Web Report Viewers
- Progress Software Telerik Report Server
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ocean Pro Demos <= 1.5.4 and Ocean eComm Treasure Box <= 1.8.0 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter
- OceanWP Ocean Pro Demos
- OceanWP Ocean eComm Treasure Box
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Keycloak-services: keycloak-services: stored xss on login page via kcsanitize bypass
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Cross-site scripting (XSS)
- CVSS 5.9 Medium
Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Recognize yield as regexp preceder keyword in html/template
- Cross-site scripting (XSS)
<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2
GO-2026-6600 · CVE-2026-97030 - CVSS 6.1 Medium
Reset context tracking on consecutive template expressions in html/template
- Cross-site scripting (XSS)
<1.26.9 || >=1.27.0-0, <1.27.2 · fixed in 1.26.9, 1.27.2
GO-2026-6599 · CVE-2026-94448 - CVSS 4.4 Medium
Indico: Cross-Site-Scripting in minutes editor
- Cross-site scripting (XSS)
<3.3.13 · fixed in 3.3.13
GHSA-cw24-x4mj-fw3q · CVE-2026-107397 - CVSS 5.1 Medium
Jivejdon through 5.0 Stored XSS via Attachment Upload Content-Type
- banq jivejdon
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Jivejdon through 5.0 Stored XSS via Private Short Messages
- banq jivejdon
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering
- banq jivejdon
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Jivejdon through commit ee67a65e Stored XSS via Markdown Links in TextStyle Rendering Filter
- banq jivejdon
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters
- banq jivejdon
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Jivejdon through commit ee67a65e Reflected XSS via taggedThreadList.jsp tagID and count Parameters
- banq jivejdon
- Cross-site scripting (XSS)
- CVSS 8.5 High
Satel Netco Design Cross-site Scripting
- Satel Netco Design
- Cross-site scripting (XSS)
- CVSS 8.2 High
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header
- freescout
- Cross-site scripting (XSS)
- CWE-116
- CVSS 5.4 Medium
enshrined/svg-sanitize: Stored XSS via DTD Entity / HTML5 Named Character Reference Collision
- Cross-site scripting (XSS)
<1.0.0 · fixed in 1.0.0
GHSA-9rjx-3jch-6vjf · CVE-2026-107380 - CVSS 9.3 CriticalCritical · CVSS 9+
IBM Guardium Data Protection Cross-Site Scripting
- IBM Guardium Data Protection
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress aBlocks plugin <= 2.16.0 - Cross Site Scripting (XSS) vulnerability
- Kodezen LLC aBlocks
- Cross-site scripting (XSS)
- CVSS 7.6 High
JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob
- Cross-site scripting (XSS)
<9.4.0 · fixed in 9.4.0
GHSA-9ffp-22j7-56r2 · CVE-2026-107303 - CVSS 8.4 High
Obsidian Desktop < 1.14.0 RCE via MathJax Safe Filter Bypass
- Obsidian Desktop
- Cross-site scripting (XSS)
- CWE-1188
- CVSS 8.5 High
Obsidian Desktop < 1.14.0 RCE via Slides Plugin Markdown
- Obsidian Desktop
- Cross-site scripting (XSS)
- CWE-1188
- CVSS 5.3 Medium
EspoCRM before 10.0.6 Unauthenticated Stored HTML Injection via Lead Capture Form
- espocrm
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
IBM DataPower Gateway Cross-Site Scripting
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
IBM DataPower Gateway affected by cross-site scripting
- IBM DataPower Gateway 10.6.0
- Cross-site scripting (XSS)
- CVSS 3.5 Low
HTML Injection in İzometri Informatics' eimzamip
- İzometri IT Services Domestic and Foreign Trade Co. Ltd. eimzamip
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (XSS) vulnerability
- Katie Seaborn Zotpress
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site Scripting (XSS) vulnerability
- MediaRon LLC WP Plugin Info Card
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scripting (XSS) vulnerability
- StylemixThemes MasterStudy LMS
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.12 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
- WP Store Locator
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Robo Gallery plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability
- Robosoft Robo Gallery
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability
- ShortPixel Image Optimizer
- Cross-site scripting (XSS)
- CVSS 8.0 High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer
- Progressive Robot Ltd hMailServer
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Stored Cross-Site Scripting in SQLView KRIS
- SQLView KRIS
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Stored XSS via Gallery Shortcode Attributes
- Image Photo Gallery Final Tiles Grid
- Cross-site scripting (XSS)
- CVSS 7.5 High
GPTranslate < 2.34.14 - Unauthenticated Stored XSS via REST API Translation Storage
- GPTranslate
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Cross-site scripting in Brocade Active Support Connectivity Gateway
- Brocade Active Support Connectivity Gateway
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Aurora Heatmap <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting via 'url' Parameter
- r3098 Aurora Heatmap
- Cross-site scripting (XSS)
- CVSS 7.3 High
Ghost: Stored XSS via Embed Card Previews
- Cross-site scripting (XSS)
- CWE-653
>=6.34.0, <6.67.0 · fixed in 6.67.0
GHSA-69qc-f5m6-889c · CVE-2026-105643 - CVSS 6.8 Medium
Ghost : Stored XSS via SVG Files in Content Imports
- Cross-site scripting (XSS)
- Unrestricted file upload
>=4.0.0, <6.67.0 · fixed in 6.67.0
GHSA-hqq2-xqr2-fmx2 · CVE-2026-105644