Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.1 Medium
unstructured: Stored XSS via unescaped HTML generation
- Cross-site scripting (XSS)
- CWE-116
<0.24.1 · fixed in 0.24.1
GHSA-v5mq-3xhg-98m9 · CVE-2026-104250 - CVSS 5.1 Medium
LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter
- abhinavxd libredesk
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Aureus ERP through 1.6.0 Stored XSS via Inventory Rule Action Information
- aureuserp
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Netgate pfSense CE 2.7.1 through 2.9.0 Reflected XSS via firewall_rules.php
- Netgate pfSense CE
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color
- Netgate pfSense CE
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Ansible-ui: ansible-ui: stored xss via unsafe javascript url scheme in hub collection module documentation (formatparturl)
- Red Hat Ansible Automation Platform 2
- Cross-site scripting (XSS)
- CVSS 7.2 High
HtmlUnit Neko: Mutation XSS (mXSS) in HTMLWriterFilter - TEXTAREA/TITLE entity decode without re-encode
- htmlunit-neko
- Cross-site scripting (XSS)
- CVSS 8.7 High
GYM One admin user list is vulnerable to stored cross-site scripting
- mayerbalintdev GYM-One
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force Presto Player
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability
- WP Chill Download Monitor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability
- YITH WooCommerce Compare
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability
- PluginUs.Net MDTF
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetSmartFilters plugin <= 3.8.6 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetSmartFilters
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts
- HeliumEdu platform
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability
- 8theme.com XStore
- Cross-site scripting (XSS)
- CVSS 5.7 Medium
Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)
- Lychee
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Nexus Repository 3 - Stored Cross-Site Scripting in Browse UI
- Sonatype Nexus Repository 3
- Cross-site scripting (XSS)
- CVSS 6.7 Medium
Cross-site scripting in JetBrains TeamCity
- JetBrains TeamCity
- Cross-site scripting (XSS)
- CVSS 8.0 High
Cross-site scripting in JetBrains TeamCity
- JetBrains TeamCity
- Cross-site scripting (XSS)
- CVSS 8.0 High
OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views
- opnsense core
- Cross-site scripting (XSS)
- CVSS 5.2 Medium
OPNsense: Stored XSS in Administration Settings via Certificate Description
- opnsense core
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
OPNsense: Stored XSS in Services: NTP GPS
- opnsense core
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout
- opnsense core
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
EspoCRM: Pre-authentication stored HTML injection in stream notification emails about email received
- espocrm
- Cross-site scripting (XSS)
- CVSS 3.5 Low
EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled
- espocrm
- Cross-site scripting (XSS)
- CVSS 2.7 Low
EspoCRM: Persistent XSS via CSP nonce injection in applicationName setting by admin user
- espocrm
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
- Progress Software Kendo UI for jQuery
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
- Link Whisper INC Link Whisper Free
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
- ThemeGrill User Registration
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability
- maxfoundry Social Share Buttons
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability
- Everest Forms
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability
- bannersky BSK PDF Manager
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
Privilege Escalation via QuFTP Log-based XSS
- QNAP Systems Inc. QuFTP Service
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) in Note Station file upload functionality
- QNAP Systems Inc. Notes Station 3
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
Stored XSS via Interface Name in Network & Virtual Switch App
- QNAP Systems Inc. Network & Virtual Switch
- Cross-site scripting (XSS)
- CVSS 7.1 High
Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute
- Document Gallery
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
VK Blocks <= 1.126.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Group Block 'linkToPost' Feature
- vektor-inc VK Blocks
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'
- data443 Tracking Code Manager
- Cross-site scripting (XSS)
- CVSS 7.2 High
Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter
- kitae-park Mang Board
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Photo Gallery by 10Web <= 1.8.42 - Reflected Cross-Site Scripting via 'title' Parameter
- Photo Gallery by 10Web – Mobile-Friendly Image Gallery
- Cross-site scripting (XSS)
- CVSS 7.2 High
Groundhogg <= 4.5.14 - Unauthenticated Stored Cross-Site Scripting via 'ref' Parameter
- trainingbusinesspros Groundhogg — CRM, Newsletters, and Marketing Automation
- Cross-site scripting (XSS)
- CVSS 7.2 High
Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'
- codename065 Premium Packages – Sell Digital Products Securely
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Import and export users and customers <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting via User Meta Profile Fields
- carazo Import and export users and customers
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute
- Post and Page Builder by BoldGrid – Visual Drag and Drop Editor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Kirki <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting via Page Builder Text Content
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog).
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting (XSS) in the GLUE code editor.
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
ELADMIN v2.7 and before is vulnerable to Cross Site Scripting (XSS) via the component WebSocketServer, SpringSecurityConfig, deploy.vue.
- Cross-site scripting (XSS)
- CVSS 7.2 High
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview
- n8n
- Cross-site scripting (XSS)