Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

hono npm

CVSS 2.3 Low

hono/jsx renders plain strings unescaped in boundary components, leading to XSS
- Cross-site scripting (XSS)
<4.13.7 · fixed in 4.13.7

GHSA-hxh3-vqpv-xpqv · CVE-2026-93981 Not analysed yet 30 Sept 2026
CVE-2026-103590 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via Length of Stay Fields
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103589 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via Room Type Editor
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103588 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via exceptions field
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103587 CVE record

CVSS 5.1 Medium

QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters
- Webkul QloApps
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103585 CVE record

CVSS 1.2 Low

attacker-controlled javascript license URL via XSS
- The Wikimedia Foundation MediaWiki MediaSearch extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103584 CVE record

CVSS 1.1 Low

attacker-controlled javascript license URL via XSS
- The Wikimedia Foundation MediaWiki CommonsMetadata extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-47096 CVE record

CVSS 5.3 Medium

AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter
- AJA Video Systems HELO Plus
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102126 CVE record

CVSS 8.1 High

Kiteworks Core Stored Cross-site Scripting (XSS)
- Kiteworks Core
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102100 CVE record

CVSS 8.7 High

Kiteworks Core stored XSS
- Kiteworks Core
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102147 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Kiteworks Core Administrative Account Takeover through Stored Cross-site Scripting (XSS)
- Kiteworks Core
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102092 CVE record

CVSS 8.7 High

Kiteworks Core stored XSS
- Kiteworks Core
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102391 CVE record

CVSS 7.1 High

WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability
- jetmonsters JetFormBuilder
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102376 CVE record

CVSS 7.1 High

WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability
- WPMU DEV Branda
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-100510 CVE record

CVSS 7.1 High

WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability
- Post and Page Builder by BoldGrid
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97290 CVE record

CVSS 7.1 High

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability
- Sayontan Sinha Photonic Gallery & Lightbox for Flickr, SmugMug & Others
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97265 CVE record

CVSS 6.5 Medium

WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetEngine
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-94171 CVE record

CVSS 7.1 High

WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability
- VillaTheme CURCY
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103439 CVE record

CVSS 0.3 Low

Various rawParams() and escaped() updates to prevent XSS in Wikibase extension
- The Wikimedia Foundation MediaWiki Wikbase extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103438 CVE record

CVSS 0.3 Low

Various rawParams() and escaped() updates to prevent XSS in Wikistories extension
- The Wikimedia Foundation MediaWiki Wikistories extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103437 CVE record

CVSS 1.1 Low

ReadingLists imported metadata permits JavaScript URL XSS
- The Wikimedia Foundation MediaWiki ReadingLists extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103445 CVE record

CVSS 1.2 Low

Stored XSS through PageForms #autoedit redirect links
- The Wikimedia Foundation MediaWiki Page_Forms extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103444 CVE record

CVSS 1.1 Low

Stored XSS through system messages in WikiForum
- The Wikimedia Foundation MediaWiki WikiForum extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103443 CVE record

CVSS 1.1 Low

API permits session-seeded javascript URL XSS
- The Wikimedia Foundation MediaWiki Collection (Book) extension
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
serialize-javascript npm

CVSS 2.3 Low

Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script> in serialized function bodies
- Cross-site scripting (XSS)
>=7.1.1, <7.1.2 · fixed in 7.1.2

GHSA-gfhx-hw2g-v5hg · CVE-2026-97711 Not analysed yet 30 Sept 2026
dompurify npm

CVSS 5.1 Medium

DOMPurify: IN_PLACE: node-removing afterSanitize hook leaves detached subtree event handlers armed, causing DOM XSS
- Cross-site scripting (XSS)
>=3.4.13, <3.4.16 · fixed in 3.4.16

GHSA-p98j-92pf-mc4p · CVE-2026-109344 Not analysed yet 30 Sept 2026
league/commonmark Packagist

CVSS 5.3 Medium

league/commonmark: DisallowedRawHtml bypassed when a disallowed tag name ends the raw-HTML literal
- Command injection
- Cross-site scripting (XSS)
>=1.3.0, <2.10.2 · fixed in 2.10.2

GHSA-97jj-33gv-5xf9 · CVE-2026-105829 Not analysed yet 30 Sept 2026
CVE-2026-100275 CVE record

CVSS 6.9 Medium

Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-100263 CVE record

CVSS 4.7 Medium

Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-103389 CVE record

CVSS 6.2 Medium

MISP Stored Cross-Site Scripting via Unvalidated Galaxy Icon Field in Correlation Graph
- MISP
- Cross-site scripting (XSS)
- CWE-20
Not analysed yet 30 Sept 2026
CVE-2026-103388 CVE record

CVSS 6.2 Medium

MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field
- MISP
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-62084 CVE record

CVSS 6.5 Medium

WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability
- Jeff Starr User Submitted Posts
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102398 CVE record

CVSS 7.1 High

WordPress Popup by Supsystic plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
- Popup by Supsystic
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102396 CVE record

CVSS 7.1 High

WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
- Ultimate Maps by Supsystic
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102395 CVE record

CVSS 7.1 High

WordPress Easy Google Maps plugin <= 1.14.6 - Cross Site Scripting (XSS) vulnerability
- supsystic Easy Google Maps
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102386 CVE record

CVSS 6.5 Medium

WordPress WP Photo Album Plus plugin <= 9.3.02.003 - Cross Site Scripting (XSS) vulnerability
- Jacob N. Breetvelt WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102385 CVE record

CVSS 7.1 High

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability
- Kevin Stover Ninja Forms
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-102384 CVE record

CVSS 5.9 Medium

WordPress Supreme Modules Lite plugin <= 2.5.63 - Cross Site Scripting (XSS) vulnerability
- Supreme Modules Lite
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-100513 CVE record

CVSS 6.5 Medium

WordPress CF7 Views – Complete Entry Management for Contact Form 7 plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability
- Aman CF7 Views – Complete Entry Management for Contact Form 7
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-100507 CVE record

CVSS 7.1 High

WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
- If-So Dynamic Content Personalization
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97301 CVE record

CVSS 6.5 Medium

WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability
- Cool Plugins Cool Formkit Lite
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97298 CVE record

CVSS 6.5 Medium

WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability
- KingAddons King Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97292 CVE record

CVSS 6.5 Medium

WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability
- YITHEMES YITH WooCommerce Tab Manager
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97289 CVE record

CVSS 7.1 High

WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability
- ExpressTech Quiz And Survey Master
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97288 CVE record

CVSS 6.5 Medium

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability
- Jayson T Cote OAuth Server
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97286 CVE record

CVSS 6.5 Medium

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability
- WP Chill Strong Testimonials
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97279 CVE record

CVSS 6.5 Medium

WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability
- Chouby Polylang
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97272 CVE record

CVSS 7.1 High

WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability
- Premmerce Permalink Manager for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97271 CVE record

CVSS 7.1 High

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97270 CVE record

CVSS 6.5 Medium

WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability
- Justin Sternberg CMB2
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97266 CVE record

CVSS 6.5 Medium

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability
- Nexcess Virtue/Ascend/Pinnacle Toolkit
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97262 CVE record

CVSS 6.5 Medium

WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability
- Visual Composer Website Builder
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97253 CVE record

CVSS 7.1 High

WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
- Kreatura LayerSlider
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97250 CVE record

CVSS 7.1 High

WordPress Geo Mashup plugin <= 1.13.21 - Cross Site Scripting (XSS) vulnerability
- Dylan Kuhn Geo Mashup
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97238 CVE record

CVSS 5.5 Medium

WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
- Crocoblock. Jetimpex Inc. JetEngine
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97237 CVE record

CVSS 7.1 High

WordPress JetEngine plugin <= 3.8.14.3 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetEngine
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97236 CVE record

CVSS 6.5 Medium

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
- ThemeREX Addons
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97235 CVE record

CVSS 7.1 High

WordPress ThemeREX Addons plugin < 2.45.0 - Cross Site Scripting (XSS) vulnerability
- ThemeREX Addons
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97077 CVE record

CVSS 7.1 High

WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- Spacetime Ad Inserter
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026
CVE-2026-97067 CVE record

CVSS 6.5 Medium

WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability
- Shane Bishop EWWW Image Optimizer
- Cross-site scripting (XSS)
Not analysed yet 30 Sept 2026