Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-63355 CVE record

CVSS 5.3 Medium

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63354 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63353 CVE record

CVSS 9.4 CriticalCritical · CVSS 9+

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63352 CVE record

CVSS 5.3 Medium

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-63351 CVE record

CVSS 5.3 Medium

Cross-site scripting in Siemens SIMATIC Drive Controller CPU 1504D TF and others
- Siemens SIMATIC Drive Controller CPU 1504D TF
- Siemens SIMATIC Drive Controller CPU 1507D TF
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-108487 CVE record

CVSS 6.5 Medium

WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability
- Hossni Mubarak Books Gallery
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-105881 CVE record

CVSS 6.5 Medium

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability
- ThemeGrill User Registration
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109697 CVE record

CVSS 6.5 Medium

WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force SureCart
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-96535 CVE record

CVSS 5.1 Medium

Cross-Site Scripting in the YouMind web application
- YouMind web application
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-109691 CVE record

CVSS 6.5 Medium

WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability
- BdThemes Prime Slider – Addons For Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-108488 CVE record

CVSS 6.5 Medium

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability
- IdeaBox Creations PowerPack Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-108490 CVE record

CVSS 6.5 Medium

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability
- LeapWorx Premium Addons for Elementor
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-108495 CVE record

CVSS 6.5 Medium

WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force SureForms
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-102007 CVE record

CVSS 7.2 High

Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback
- bitpressadmin Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-102562 CVE record

CVSS 7.2 High

AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter
- acyba AcyMailing – An Ultimate Newsletter Plugin and Marketing Automation Solution for WordPress
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-67165 CVE record

CVSS 5.4 Medium

HCL Connections is vulnerable to cross-site scripting (XSS)
- HCLSoftware Connections
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-103418 CVE record

CVSS 8.8 High

Universal XSS via the HTML language attribute in Translation Services
- Mozilla Firefox for iOS
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-89269 CVE record

CVSS 6.8 Medium

WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode
- WP Testimonials
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-54867 CVE record

CVSS 6.5 Medium

WordPress Responsive Slider plugin <= 0.1.9 - Cross Site Scripting (XSS) vulnerability
- Griden Responsive Slider
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-54868 CVE record

CVSS 6.5 Medium

WordPress FV Simpler SEO plugin <= 1.9.7 - Cross Site Scripting (XSS) vulnerability
- FolioVision FV Simpler SEO
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-54869 CVE record

CVSS 6.5 Medium

WordPress IMPress for IDX Broker plugin <= 3.3.1 - Cross Site Scripting (XSS) vulnerability
- IMPress for IDX Broker
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-54870 CVE record

CVSS 6.5 Medium

WordPress Weaver Xtreme theme Support plugin <= 7.0.1 - Cross Site Scripting (XSS) vulnerability
- wpweaver Weaver Xtreme Theme Support
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-92883 CVE record

CVSS 8.7 High

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
- GitLab
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-89117 CVE record

CVSS 6.1 Medium

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- SAP_SE SAP NetWeaver Enterprise Portal
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-76976 CVE record

CVSS 5.4 Medium

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
- SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-76975 CVE record

CVSS 6.1 Medium

Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)
- SAP_SE SAPUI5 (Support Assistant Overlay)
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-76972 CVE record

CVSS 6.5 Medium

Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence
- SAP_SE SAP Manufacturing Integration and Intelligence
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-108942 CVE record

CVSS 5.1 Medium

philz1337x clarity-upscaler Extra Networks Card Rendering ui_extra_networks.py create_html_for_item cross site scripting
- philz1337x clarity-upscaler
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 13 Oct 2026
CVE-2026-104587 CVE record

CVSS 5.4 Medium

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2024-34326 CVE record

CVSS 6.1 Medium

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint.
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2024-34321 CVE record

CVSS 6.1 Medium

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.
- Cross-site scripting (XSS)
Not analysed yet 13 Oct 2026
CVE-2026-93886 CVE record

CVSS 8.3 High

IBM i is Affected By An Improper Neutralization of Input Vulnerability in HTTP Server Administration GUI
- i
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-18541 CVE record

CVSS 6.4 Medium

IBM Planning Analytics Local is affected by security vulnerabilities
- IBM Planning Analytics
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-75063 CVE record

CVSS 5.4 Medium

IBM Planning Analytics Local is affected by security vulnerabilities
- IBM Planning Analytics
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-108936 CVE record

CVSS 4.8 Medium

Edimax BR-6208AC QoS Page formQoS cross site scripting
- Edimax BR-6208AC
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-109673 CVE record

CVSS 8.5 High

Frappe ERPNext before 16.12.0 Stored XSS via Crafted Record Names
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109671 CVE record

CVSS 8.5 High

Frappe ERPNext before 15.113.0 Stored XSS via Profile Field in Portal Pages
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109670 CVE record

CVSS 5.1 Medium

Frappe ERPNext before 15.110.0 Stored XSS via Item Record Name
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109662 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.112.0 Stored XSS via Public Portal Form
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109657 CVE record

CVSS 5.1 Medium

Frappe ERPNext 16.x before 16.27.0 Stored XSS via Unescaped Record Name
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109653 CVE record

CVSS 8.5 High

Frappe ERPNext before 15.119.0 Stored XSS Leading to Account Takeover
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109633 CVE record

CVSS 8.6 High

Frappe ERPNext before 15.119.1 Stored XSS via Public Booking Page
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109612 CVE record

CVSS 8.5 High

Frappe ERPNext before 15.120.0 Stored XSS via Report View
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109604 CVE record

CVSS 8.5 High

ERPNext before 15.112.0 Stored XSS via Tool View Record Names
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109602 CVE record

CVSS 5.1 Medium

Frappe before v16.31.0 Stored XSS via Dashboard Chart Filters
- frappe
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109597 CVE record

CVSS 5.1 Medium

Hugo v0.60.0 before v0.167.0 Stored XSS via Table of Contents Heading IDs
- hugo
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2025-71432 CVE record

CVSS 8.6 High

Frappe ERPNext before 15.83.0 Reflected XSS Leading to Account Takeover
- frappe erpnext
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2025-71430 CVE record

CVSS 5.1 Medium

Frappe before 15.91.1 Stored XSS via Leaderboard User Names
- frappe
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2024-58391 CVE record

CVSS 5.3 Medium

Frappe before 15.4.0 XSS via Printview Parameters
- frappe
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2023-54409 CVE record

CVSS 5.9 Medium

Frappe before 13.46.1 XSS via html2text Weak Sanitization
- frappe
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2023-54408 CVE record

CVSS 5.1 Medium

Frappe before 14.31.0 HTML Injection via Weak Escaping
- frappe
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-108935 CVE record

CVSS 4.8 Medium

Edimax BR-6208AC Port Forwarding formPortFw cross site scripting
- Edimax BR-6208AC
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-108934 CVE record

CVSS 4.8 Medium

Edimax BR-6208AC HTTP Blocking formUrlb cross site scripting
- Edimax BR-6208AC
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-104140 CVE record

CVSS 6.1 Medium

QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values
- QGIS
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-108933 CVE record

CVSS 4.8 Medium

Edimax BR-6208AC formFilter cross site scripting
- Edimax BR-6208AC
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-108932 CVE record

CVSS 5.3 Medium

Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting
- Netcore NR268
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-108931 CVE record

CVSS 5.3 Medium

Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting
- Netcore NR268
- Cross-site scripting (XSS)
- Code injection
Not analysed yet 12 Oct 2026
CVE-2026-109565 CVE record

CVSS 5.3 Medium

Rapyd Admin 9.4.0 before 9.20.0 Stored XSS via select-list Component
- zofe rapyd-admin
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109558 CVE record

CVSS 8.5 High

EdgeEver 1.6.0 through 1.112.0 Stored XSS via TemplatesPane Template Preview
- tianma-if EdgeEver
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026
CVE-2026-109557 CVE record

CVSS 8.4 High

EdgeEver through 1.112.0 Stored XSS via setMemoDragPreview Drag Preview
- tianma-if EdgeEver
- Cross-site scripting (XSS)
Not analysed yet 12 Oct 2026