Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
IDURAR ERP CRM through 4.1.1 Stored XSS via SVG Upload
- idurar-erp-crm
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
@a2ui/web_core: `openUrl` permits `javascript:` URI execution via agent-supplied button actions
- Cross-site scripting (XSS)
>=0.9.0, <0.10.2 · fixed in 0.10.2
GHSA-72qq-p3r5-f7wq · CVE-2026-10032 - CVSS 7.2 High
LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute
- LimeSurvey
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
MISP: JavaScript Injection via Remote Tag ID in Event Preview Inline Handler
- MISP
- Cross-site scripting (XSS)
- CWE-116
- CVSS 6.2 Medium
MISP TAXII Object Viewer Stored XSS via Unescaped JSON Output
- MISP
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
MISP ID Translator: Unescaped Remote Event ID Enables Cross-Site Scripting via Linked Server
- MISP
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
MISP Stored XSS via Unescaped Count Field Value in Remote Event Preview Index
- MISP
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
Reflected XSS in MRV Technology's TurkHotspot
- MRV Technology Foreign Trade Ltd. Co. TurkHotspot
- Cross-site scripting (XSS)
- CVSS 7.2 High
JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter
- Crocoblock JetAppointment
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SourceCodester Student Result Management System Announcement new_announcement.php cross site scripting
- SourceCodester Student Result Management System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
WordPress ThemeREX Addons plugin <= 2.46.0 - Cross Site Scripting (XSS) vulnerability
- ThemeREX Group ThemeREX Addons
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
YesWiki before 4.6.7 Stored XSS via Wakka Markdown Image src Attribute
- yeswiki
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler
- yeswiki
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField
- yeswiki
- Cross-site scripting (XSS)
- CVSS 8.2 High
YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action
- yeswiki
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WP Statistics <= 14.16.14 - Reflected Cross-Site Scripting via REQUEST_URI Query-Parameter Key
- veronalabs WP Statistics – Simple, privacy-friendly Google Analytics alternative
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname
- smub All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights)
- Cross-site scripting (XSS)
- CVSS 7.2 High
W3 Total Cache <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Multiple vulnerabilities in the Repasat application
- Repasat application
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.70 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Display Name
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Listdom: AI-powered Business Directory with Classifieds Ads Listings <= 6.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lsd[remark]' Parameter
- webilia Listdom: AI-powered Business Directory with Classifieds Ads Listings
- Cross-site scripting (XSS)
- CVSS 7.2 High
No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect
- mihdan No External Links
- Cross-site scripting (XSS)
- CVSS 7.2 High
Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in Admin Builder Preview
- smub Smash Balloon Social Post Feed – Simple Social Feeds for WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)
- extendthemes Kubio AI Page Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Mang Board <= 2.4.2 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
- kitae-park Mang Board
- Cross-site scripting (XSS)
- CVSS 7.2 High
JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action
- jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
- Relevanssi Premium
- Cross-site scripting (XSS)
- CVSS 7.2 High
Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter
- satollo Newsletter – Send awesome emails from WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor
- wpchill Download Monitor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- comesio Relevanssi – A Better Search
- Cross-site scripting (XSS)
- CVSS 7.2 High
CMB2 <= 2.13.1 - Unauthenticated Stored Cross-Site Scripting via 'textarea_code' Field
- jtsternberg CMB2
- Cross-site scripting (XSS)
- CVSS 7.2 High
DoFollow Case by Case <= 3.6.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- apasionados DoFollow Case by Case
- Cross-site scripting (XSS)
- CVSS 7.2 High
CMB2 <= 2.13.0 - Unauthenticated Stored Cross-Site Scripting via 'file_list' Field Type
- jtsternberg CMB2
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Greenshift <= 13.2.0 - Reflected Cross-Site Scripting via '{{GET:}}' Dynamic Placeholder
- wpsoul Greenshift – animation and page builder blocks
- Cross-site scripting (XSS)
- CVSS 7.2 High
MW WP Form <= 5.1.7 - Unauthenticated Stored Cross-Site Scripting via 'post_id' Parameter (via stored form-submitted post meta)
- websoudan MW WP Form
- Cross-site scripting (XSS)
- CVSS 7.2 High
GSpeech TTS <= 3.22.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- creative-solutions-1 GSpeech TTS – WordPress Text To Speech Plugin
- Cross-site scripting (XSS)
- CVSS 7.2 High
Customer Reviews for WooCommerce <= 5.122.0 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- ivole Customer Reviews for WooCommerce
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WP Mail Logging < 1.17.0 - Unauthenticated HTML Injection
- WP Mail Logging
- Cross-site scripting (XSS)
- CVSS 7.2 High
BA Book Everything <= 1.8.28 - Unauthenticated Stored Cross-Site Scripting via 'booking_service_qty' Parameter
- bookingalgorithms BA Book Everything
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Cross-site scripting in Webpros cPanel and others
- Webpros cPanel
- Webpros WP Squared
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Cross-site scripting in Webpros cPanel and others
- Webpros cPanel
- Webpros WP Squared
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Motors < 1.4.124 - Listing Manager+ Stored XSS via Badge Color
- Motors
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Unlimited Elements For Elementor < 2.0.21 - Contributor+ Stored XSS via Icon Library Parameter
- Unlimited Elements for Elementor
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Tabs Responsive <= 2.5 - Shop Manager+ Stored XSS via WooCommerce Product Tab Content
- Tabs Responsive
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- optimizingmatters Autoptimize
- Cross-site scripting (XSS)