Cross-site scripting (XSS).

n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter

• n8n
• Cross-site scripting (XSS)

FileRise: Unsanitized footerHtml in Public Site Config

• error311 FileRise
• Cross-site scripting (XSS)

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

• Palo Alto Networks Cloud NGFW
• Palo Alto Networks PAN-OS
• Cross-site scripting (XSS)

Markdown Preview Enhanced: Stored XSS via Unsanitized `.crossnote/head.html` Injection in Webview

• shd101wyy vscode-markdown-preview-enhanced
• Cross-site scripting (XSS)

DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting

• dataease
• Cross-site scripting (XSS)

DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting

• dataease
• Cross-site scripting (XSS)

lichess.org: Stored HTML Injection via PGN Annotator Tag in Studies

• lichess-org lila
• Cross-site scripting (XSS)

WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability

• WPManageNinja Best Payments Plugin for WP
• Cross-site scripting (XSS)

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability

• hippooo Hippoo Mobile App for WooCommerce
• Cross-site scripting (XSS)

WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

• SimplyRETS Real Estate IDX
• Cross-site scripting (XSS)

The Navigation module doesn't sufficiently sanitize certain attributes, which can lead to a cross-site scripting (XSS) vulnerability.

• Cross-site scripting (XSS)

>=10.3.0, <10.6.19 || >=11.0.0, <11.3.19 || >=11.4.0, <11.4.10 || >=12.0.0-alpha1, <12.0.0-beta2 · fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2

The Drupal core Link module provides a field type that can be used for internal and external URLs.

• Cross-site scripting (XSS)

>=8.9.0, <10.6.19 || >=11.0.0, <11.3.19 || >=11.4.0, <11.4.10 || >=12.0.0-alpha1, <12.0.0-beta2 · fixed in 10.6.19, 11.3.19, 11.4.10, 12.0.0-beta2

Discourse: Stored oEmbed HTML injection via allowed iframe

• discourse
• Cross-site scripting (XSS)

MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

• Progress MOVEit Transfer
• Cross-site scripting (XSS)

Gitea Jupyter notebook UI redress through CSS class injection

• Gitea
• Cross-site scripting (XSS)
• CWE-1021

ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter

• MacWarrior clipbucket-v5
• Cross-site scripting (XSS)

ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

• MacWarrior clipbucket-v5
• Cross-site scripting (XSS)

ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

• MacWarrior clipbucket-v5
• Cross-site scripting (XSS)

WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

• Crocoblock JetEngine
• Cross-site scripting (XSS)

WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

• Crocoblock JetProductTables
• Cross-site scripting (XSS)

WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

• axew3.com WP w3all phpBB
• Cross-site scripting (XSS)

WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

• Brainstorm Force SureCart
• Cross-site scripting (XSS)

Stored XSS Vulnerability in JTL-Shop

• JTL-Software GmbH JTL-Shop
• Cross-site scripting (XSS)

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

• VideoWhisper.com Paid Videochat Turnkey Site
• Cross-site scripting (XSS)

Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body

• tigroumeow Gallery Custom Links
• Cross-site scripting (XSS)

GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

• paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
• Cross-site scripting (XSS)

Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter

• davidevalerio Record of Consent Extension for Complianz
• Cross-site scripting (XSS)

Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

• kitae-park Mang Board
• Cross-site scripting (XSS)

Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

• tigroumeow Meow Lightbox
• Cross-site scripting (XSS)

Mang Board <= 2.4.3 - Authenticated (Custom+) Stored Cross-Site Scripting via 'content' Parameter

• kitae-park Mang Board
• Cross-site scripting (XSS)

PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

• PeproDev Branches Map (Mapify)
• Cross-site scripting (XSS)

GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Image Title

• paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
• Cross-site scripting (XSS)

Tenant name tooltips can be used for XSS

• Cross-site scripting (XSS)

Published by the maintainers · not yet reviewed by GitHub

>=3.0.0, <3.3.57 || >=4.0.0, <4.15.2 || >=5.0.0, <5.10.2 · fixed in 3.3.57, 4.15.2, 5.10.2

Donation Thermometer 2.2.9 - 2.2.11 - Contributor+ Stored XSS via Shortcode

• Donation Thermometer
• Cross-site scripting (XSS)

Forms < 3.0.2 - Unauthenticated Stored XSS via Form Submission

• Forms
• Cross-site scripting (XSS)

Pricing Table Block 1.0.7 - 2.1.4 - Contributor+ Stored XSS via Pricing Link

• Pricing Table
• Cross-site scripting (XSS)

Image Photo Gallery Final Tiles Grid < 3.6.16 - Contributor+ Stored XSS via 'lightboxOptions' Parameter

• Image Photo Gallery Final Tiles Grid
• Cross-site scripting (XSS)

WP Booking System < 2.1.0.1 - Unauthenticated Stored XSS via X-Forwarded-For Header

• WP Booking System
• Cross-site scripting (XSS)

Gutenverse Form < 3.0.11 - Contributor+ Stored XSS via SVG Icon

• Gutenverse Form
• Cross-site scripting (XSS)

PublishPress Future 4.10.1 - 4.10.5 - Contributor+ Stored XSS via 'wrapper' and 'dateformat' Shortcode Attributes

• Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories
• Cross-site scripting (XSS)

Image Photo Gallery Final Tiles Grid < 3.6.15 - Contributor+ Stored XSS via Gallery Configuration Update

• Image Photo Gallery Final Tiles Grid
• Cross-site scripting (XSS)

Social Share Buttons & Analytics Plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'response' Parameter via gs_update_with_values AJAX

• joaoromao Social Share Buttons & Analytics Plugin – GetSocial.io
• Cross-site scripting (XSS)

NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via 'urlrequested' Attribute via Query String

• ice00 NewStatPress
• Cross-site scripting (XSS)

NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)

• ice00 NewStatPress
• Cross-site scripting (XSS)

FV Flowplayer Video Player <= 7.5.54.7212 - Unauthenticated Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

• foliovision FV Flowplayer Video Player
• Cross-site scripting (XSS)

Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'phone' Listing Field

• wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads
• Cross-site scripting (XSS)

Contact Form DB for Enfold <= 2.0.2 - Unauthenticated Stored Cross-Site Scripting via Contact Form Field Values

• doctorwp Contact Form DB for Enfold
• Cross-site scripting (XSS)

Smart Forms <= 2.6.104 - Unauthenticated Stored Cross-Site Scripting via 'formString' Parameter

• edgarrojas Smart Forms – when you need more than just a contact form
• Cross-site scripting (XSS)

Verified Reviews (Avis Vérifiés) <= 2.4.6 - Unauthenticated Stored Cross-Site Scripting via 'moderation' Parameter (discussion.commentaire)

• avisverifies Verified Reviews (Avis Vérifiés)
• Cross-site scripting (XSS)

PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter

• dougwollison PO/MO Editor
• Cross-site scripting (XSS)

Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter

• blackworks1 Cryptocurrency Donation Box – Bitcoin & Crypto Donations
• Cross-site scripting (XSS)

Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting

• danrossiter Document Gallery
• Cross-site scripting (XSS)

Countdown Timer – Widget Countdown <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute

• wpdevart Countdown Timer – Widget Countdown
• Cross-site scripting (XSS)

Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter

• themeum Tutor LMS – eLearning and online course solution
• Cross-site scripting (XSS)

FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

• foliovision FV Player 8
• Cross-site scripting (XSS)

AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

• ateshabaev AnyComment
• Cross-site scripting (XSS)

Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

• masaakitanaka Booking Package
• Cross-site scripting (XSS)

Microsoft Security Advisory CVE-2026-96230 - ASP.NET Core Remote Code Execution Vulnerability

• Cross-site scripting (XSS)

>=8.0.0, <8.0.32 || >=9.0.0, <9.0.21 || >=10.0.0, <10.0.13 || >=11.0.0-preview.1, <11.0.0-rc.2 · fixed in 8.0.32, 9.0.21, 10.0.13, 11.0.0-rc.2

Omnispace Agora Project < 26.10.0 Stored XSS via Category Description

• Omnispace Agora Project
• Cross-site scripting (XSS)

Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe

• Omnispace Agora Project
• Cross-site scripting (XSS)