Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.2 High
Ninja Forms <= 3.15.4 - Unauthenticated Stored Cross-Site Scripting via Paragraph Text (RTE) Field Submission
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)
- wp-buy Visitor Traffic Real Time Statistics pro
- Cross-site scripting (XSS)
- CVSS 5.8 Medium
Cross-site scripting in CWE-79 - Cross-site Scripting CAPEC-63
- CWE-79 - Cross-site Scripting CAPEC-63
- Cross-site scripting (XSS)
- CVSS 8.7 High
GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php
- GetSimpleCMS-CE
- Cross-site scripting (XSS)
- CVSS 8.8 High
GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and content
- GetSimpleCMS-CE
- Cross-site scripting (XSS)
- CVSS 8.7 High
Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character
- givanz Vvveb
- Cross-site scripting (XSS)
- CVSS 8.1 High
JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboard
- Cross-site scripting (XSS)
- CWE-345
>=7.5.0, <7.6.3 · fixed in 7.6.3
GHSA-6966-vjj6-99xv · CVE-2026-102831 - CVSS 5.1 Medium
Prime Mover < 2.2.1 Stored XSS via Package Metadata
- Codexonics Prime Mover
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)
- Cross-site scripting (XSS)
- Code injection
>=3.0.0, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4
GHSA-3jqq-pw4j-pqcj · CVE-2026-102830 - CVSS 7.2 High
HCL BigFix Service Management is affected by multiple security vulnerabilities.
- HCL Software HCL BigFix Service Management
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Parallax Section block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- bPlugins Parallax Section block
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
- Premmerce Wishlist for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Premmerce Wishlist for WooCommerce plugin <= 1.1.13 - Cross Site Scripting (XSS) vulnerability
- Premmerce Wishlist for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress MaxGalleria plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
- maxfoundry MaxGalleria
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
rhukster dom-sanitizer URL Validation DOMSanitizer.php isDangerousUrl cross site scripting
- rhukster dom-sanitizer
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
WordPress Essential Addons for Elementor plugin <= 6.8.4 - Cross Site Scripting (XSS) vulnerability
- WPDeveloper Essential Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Metform plugin <= 4.3.0 - Cross Site Scripting (XSS) vulnerability
- Wpmet Metform
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
- Wpmet ElementsKit Elementor addons Lite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress ElementsKit Elementor addons Lite plugin <= 4.0.6 - Cross Site Scripting (XSS) vulnerability
- Wpmet ElementsKit Elementor addons Lite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress FluentForm plugin <= 6.2.14 - Cross Site Scripting (XSS) vulnerability
- WP ManageNinja LLC FluentForm
- Cross-site scripting (XSS)
- CVSS 8.6 High
Ghost 0.5.3 before 6.50.0 Cross-Site Scripting via ghost_head
- Ghost
- Cross-site scripting (XSS)
- CVSS 8.6 High
Ghost 2.5.0 before 6.34.0 Untrusted Script Execution via oEmbed
- Ghost
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
n8n before 1.123.80, 2.39.6, and 2.40.1 Stored DOM XSS via Resource Locator
- n8n
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in Entradium by Crocantickets
- Crocantickets Entradium
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in Entradium by Crocantickets
- Crocantickets Entradium
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in Entradium by Crocantickets
- Crocantickets Entradium
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in Entradium by Crocantickets
- Crocantickets Entradium
- Cross-site scripting (XSS)
- CVSS 8.4 High
Stored Cross-Site Scripting via Directory Name in File Manager Create Directory
- Pandora FMS
- Cross-site scripting (XSS)
- CVSS 7.2 High
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via 'postdata-1[post-custom]' Parameter
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Gutenberg Essential Blocks <= 6.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'marker' Attribute
- wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
- Cross-site scripting (XSS)
- CVSS 7.4 High
CSRF Bypass Leading to Stored Cross-Site Scripting via Unrestricted SVG Upload in File Manager
- Pandora FMS
- Cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
- CVSS 2.0 Low
Cross-site scripting in JetBrains YouTrack
- JetBrains YouTrack
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter
- MISP
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
MISP Reflected XSS in Taxonomy Tag Confirmation Forms
- MISP
- Cross-site scripting (XSS)
- CVSS 7.2 High
Business Essentials for Contact Form 7 <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting via 'gateway' Form Field
- scottpaterson Business Essentials for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Duplicate Post <= 1.5.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'noti_token' Parameter
- inisev Duplicate Post
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter
- spacetime Ad Inserter – Ad Manager & AdSense Ads
- Cross-site scripting (XSS)
- CVSS 7.2 High
Form Maker by 10Web <= 1.15.47 - Unauthenticated Stored Cross-Site Scripting via Mark on Map Longitude/Latitude Fields
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value
- codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gdpr_user_opt_out AJAX Action
- awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name
- robin-w bbp style pack
- Cross-site scripting (XSS)
- CVSS 7.2 High
Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer
- codepeople Appointment Hour Booking – Booking Calendar
- Cross-site scripting (XSS)
- CVSS 7.2 High
Forminator Forms <= 1.57.2 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
PDF Invoices & Packing Slips for WooCommerce <= 5.16.1 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company Fields
- wpovernight PDF Invoices & Packing Slips for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Redux Framework <= 4.5.14 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user-mediaurl' Media Field
- davidanderson Redux Framework
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()
- codepeople Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More
- Cross-site scripting (XSS)
- CVSS 7.2 High
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
- optimizingmatters Autoptimize
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)
- spacetime Ad Inserter – Ad Manager & AdSense Ads
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL
- inisev Social Media Share Buttons & Social Sharing Icons
- Cross-site scripting (XSS)
- CVSS 7.1 High
Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
- Five Star Restaurant Reviews
- Cross-site scripting (XSS)
- CVSS 3.1 Low
If-So Dynamic Content 1.9.9 - 1.10.1 - Editor+ Stored XSS via Conversion Name
- If-So Dynamic Content
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes
- If-So Dynamic Content
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager < 3.3.71 - Author+ Stored XSS via Package Icon
- Download Manager
- Cross-site scripting (XSS)
- CVSS 7.5 High
Paytm Payment Gateway < 2.8.9 - Unauthenticated Stored XSS via Payment Callback
- Paytm Payment Gateway
- Cross-site scripting (XSS)
- CVSS 7.2 High
Extendify <= 3.1.6 - Unauthenticated Stored Cross-Site Scripting via 'styles.blocks' Block Type Key
- Extendify
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
HCL Digital Experience is affected by improper input sanitation
- HCLSoftware Digital Experience
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Advanced Woo Labels – Product Labels & Badges for WooCommerce <= 2.51 - Improper Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting
- mihail-barinov Advanced Woo Labels – Product Labels & Badges for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advisor Indirect Prompt Injection
- tigroumeow AI Engine – The Chatbot, AI Framework & MCP for WordPress
- Cross-site scripting (XSS)