Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.1 Medium
DB2 Recovery Expert for Linux, UNIX and Windows Cross-Site Scripting
- IBM DB2 Recovery Expert for Linux, UNIX and Windows
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting
- IBM DB2 Recovery Expert for Linux, UNIX and Windows
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
IBM Db2 Recovery Expert for Linux, Unix and Windows Cross-Site Scripting
- IBM DB2 Recovery Expert for Linux, UNIX and Windows
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting
- SourceCodester Drug Recommendation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
SourceCodester Drug Recommendation System Student Registration add_student.php cross site scripting
- SourceCodester Drug Recommendation System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
- LeapWorx Premium Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Quiz And Survey Master plugin <= 11.2.7 - Cross Site Scripting (XSS) vulnerability
- ExpressTech Quiz And Survey Master
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Element Pack Elementor Addons plugin <= 8.8.8 - Cross Site Scripting (XSS) vulnerability
- BdThemes Element Pack Elementor Addons
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Progress MarkLogic Server
- Progress Software Corporation MarkLogic Server
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting
- Netcore NR268
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
LibreNMS before 26.9.0 Stored XSS via Tools Oxidized Node List
- librenms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
LibreNMS before 26.9.0 Stored XSS via wireless sensor description
- librenms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name
- admidio
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php
- admidio
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Grav Guestbook before 0.5.2 Stored XSS via AJAX Pagination and Admin Views
- getgrav grav-plugin-guestbook
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Craft CMS 5.0.0 before 5.10.14 DOM XSS via returnUrl in 2FA Verification
- cms
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds
- open-webui
- Cross-site scripting (XSS)
- CVSS 8.5 High
Open WebUI 0.6.33 before 0.11.4 Stored XSS via Citation embed_url
- open-webui
- Cross-site scripting (XSS)
- CVSS 8.4 High
Open WebUI 0.11.1 before 0.11.4 Stored XSS via DOCX Preview
- open-webui
- Cross-site scripting (XSS)
- CWE-1021
- CVSS 7.2 High
Open WebUI before 0.11.4 Stored XSS via javascript: URLs in Markdown Links
- open-webui
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 XML Injection via CIP Encoder
- ImageMagick
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Pimcore through 2026.3.1 Stored XSS via ExternalImage Field Version Preview
- Pimcore
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Netis WF2409E Wireless Settings cross site scripting
- Netis WF2409E
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
CVE-2026-103527
- Thelia
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
CVE-2026-103524
- Thelia
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Cairo-dock Glx-Dock Query Parameter ww_page.php cross site scripting
- Cairo-dock Glx-Dock
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.7 High
Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
- Dassault Systèmes Tuleap Enterprise Edition
- Cross-site scripting (XSS)
- CVSS 8.7 High
Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
- Dassault Systèmes Tuleap Enterprise Edition
- Cross-site scripting (XSS)
- CVSS 8.7 High
Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5
- Dassault Systèmes Tuleap Enterprise Edition
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- Igor Funa Ad Inserter
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetMenu
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetElements For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability
- DLX Plugins Custom Query Blocks
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
idcCMS member_deal.php cross site scripting
- idcCMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Stored XSS in external pages
- OTRS
- Cross-site scripting (XSS)
- CVSS 3.5 Low
WP Job Openings < 4.0.0 - Admin+ Stored XSS
- HireZoot
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
y_project RuoYi Dictionary Data Drawer Preview add renderDrawer cross site scripting
- y_project RuoYi
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Cohesity - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- Cohesity NetBackup Administration Console web interface
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Deep Chat through 2.5.1 XSS via Markdown Link Validation Bypass
- OvidijusParsiunas Deep Chat
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cheshire Cat AI core through 2.0.23 Stored XSS via uploads plugin
- cheshire-cat-ai core
- Cross-site scripting (XSS)
- CVSS 2.3 Low
open-computer-use through commit 610bac8 Stored XSS via log.html Session Log
- e2b-dev open-computer-use
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
InstantSoft icms2 Private Message index.tpl.php index cross site scripting
- InstantSoft icms2
- Cross-site scripting (XSS)
- Code injection
- CVSS 8.8 High
Piotnet Forms <= 1.0.30 - Unauthenticated Stored XSS via File Upload
- Piotnet Forms
- Cross-site scripting (XSS)
- CVSS 7.1 High
Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter
- Subscribe to Comments
- Cross-site scripting (XSS)
- CVSS 8.8 High
KeyWord Collector <= 1.4 - Unauthenticated Stored XSS and Settings Update via WPKeyWordSettings
- KeyWord Collector
- Cross-site scripting (XSS)
- CVSS 8.8 High
Topcontent <= 1.2.1 - Unauthenticated Stored XSS via Content Webhook
- Topcontent
- Cross-site scripting (XSS)
- CVSS 8.8 High
SmugMug Embed <= 3.13 - Unauthenticated Stored XSS via saveSelectedAlbums
- SmugMug Embed
- Cross-site scripting (XSS)
- CVSS 8.8 High
BuddyPress Instant Chat <= 1.6 - Unauthenticated Stored XSS via Chat Message
- BuddyPress Instant Chat
- Cross-site scripting (XSS)
- CVSS 8.8 High
Adwised Web Push Notification <= 2.5.7 - Unauthenticated Stored XSS via Secret Key Type Juggling
- Adwised Web Push Notification
- Cross-site scripting (XSS)
- CVSS 8.0 High
Adwised Web Push Notification <= 2.5.7 - Subscriber+ Stored XSS via Pop-up Settings
- Adwised Web Push Notification
- Cross-site scripting (XSS)
- CVSS 8.8 High
Web Vitals Tracking <= 5.4.2 - Unauthenticated Stored XSS via Tracking Beacon Metric Name
- Web Vitals Tracking
- Cross-site scripting (XSS)
- CVSS 8.8 High
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
- HootBoard
- Cross-site scripting (XSS)
- CVSS 8.8 High
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
- click5 CRM add-on to Contact Form 7
- Cross-site scripting (XSS)
- CVSS 8.8 High
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
- click5 CRM add-on to Gravity Forms
- Cross-site scripting (XSS)
- CVSS 8.8 High
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
- click5 CRM add-on to WPForms
- Cross-site scripting (XSS)
- CVSS 8.8 High
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
- click5 CRM add-on to Ninja Forms
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
- Robo Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label
- Robo Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text
- Robo Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
- Robo Gallery
- Cross-site scripting (XSS)