Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.5 Medium
WordPress Image Gallery block – Create and display photo gallery/photo album. plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
- bPlugins Image Gallery block – Create and display photo gallery/photo album.
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio
- Zuinq Studio IsMyGym
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha
- Video library of the Regional Parliament of Castile-La Mancha
- Cross-site scripting (XSS)
- CVSS 5.6 Medium
Multiple cross-site scripting (XSS) in OPNsense
- OPNsense firewall
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
ffxiv-teamcraft FFXIV Teamcraft Renderer-Process IPC Bridge preload.ts clipboard.readText cross site scripting
- ffxiv-teamcraft FFXIV Teamcraft
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Edimax BR-6208AC Virtual Server cross site scripting
- Edimax BR-6208AC
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
gougucms User Level Level.php add cross site scripting
- gougucms
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
CloudClassroom-PHP-Project addnewstudent.php cross site scripting
- CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
YesWiki 4.2.0 before 4.7.0 Stored XSS via Comment Raw-HTML Syntax
- yeswiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters
- yeswiki
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload
- yeswiki
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks
- siyuan
- Cross-site scripting (XSS)
- CVSS 7.6 High
SiYuan 2.9.0 before 3.8.7 XSS via check-auth to Parameter
- siyuan
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Code Injection via MVG Encoder Drawing Options
- ImageMagick
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
WWBN AVideo 26.0 through 29.3.0 Stored XSS via Comment Markdown Rendering
- WWBN AVideo
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Privoce Vocechat Query Parameter widget.html cross site scripting
- Privoce Vocechat
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.8 Medium
GiveWP < 4.19.0.1 - Give Worker+ Stored XSS via Form Template Primary Color
- GiveWP
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Contact Form by Supsystic < 1.8.0 - Admin+ Stored XSS
- Contact Form by Supsystic
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
onyx-dot-app Onyx PreviewTab.tsx cross site scripting
- Onyx
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting
- phpIPAM
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
phpIPAM index.php cross site scripting
- phpIPAM
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.5 Medium
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- Igor Funa Ad Inserter
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Stored XSS in the “Notes” field of project checklists
- cervantes
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VOD Infomaniak plugin <= 1.5.14 - Cross Site Scripting (XSS) vulnerability
- Infomaniak Network VOD Infomaniak
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Events Manager plugin <= 7.4.8 - Cross Site Scripting (XSS) vulnerability
- Pixelite Events Manager
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress All-in-One Video Gallery plugin <= 4.9.7 - Cross Site Scripting (XSS) vulnerability
- Plugins360 Labs All-in-One Video Gallery
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress QA Analytics plugin <= 5.3.0.1 - Cross Site Scripting (XSS) vulnerability
- QuarkA QA Analytics
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress W3 Total Cache plugin <= 2.10.7 - Cross Site Scripting (XSS) vulnerability
- Bold Grid W3 Total Cache
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress We’re Open! plugin <= 2.6 - Cross Site Scripting (XSS) vulnerability
- Noah Hearle We’re Open!
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Event Solution plugin <= 4.1.26 - Cross Site Scripting (XSS) vulnerability
- Arraytics WP Event Solution
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress BP Better Messages plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- wordplus BP Better Messages
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WP VR 8.5.49 - 9.0.2 - Contributor+ Stored XSS via Hotspot Content
- WPVR
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
GeoDirectory < 2.8.194 - Contributor+ Stored XSS via gd_map Shortcode width Attribute
- GeoDirectory
- Cross-site scripting (XSS)
- CVSS 7.1 High
Download Monitor < 5.3.4 - Reflected XSS via Cross-Origin Download Link
- Download Monitor
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Pixel Tag Manager for WooCommerce < 2.2.3 - Contributor+ Stored XSS via Google Tag Manager Container ID
- Pixel Tag Manager for WooCommerce
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
- Cross-site scripting (XSS)
<7.1.3 · fixed in 7.1.3
GHSA-m5mm-p8h7-m29v · CVE-2026-115754 - CVSS 6.1 Medium
odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
- Cross-site scripting (XSS)
>=0.9.8, <0.14.2 · fixed in 0.14.2
GHSA-2rqm-h6hv-g79v - CVSS 2.3 Low
SvelteKit : XSS via untrusted cache-control header in prerendered page
- Cross-site scripting (XSS)
<3.0.0 · fixed in 3.0.0
GHSA-27mw-82g8-phjj · CVE-2026-114061 - CVSS 8.3 High
Cross-site scripting in phpBB
- phpBB
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5
- phoca.cz Phoca Gallery extension for Joomla
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS
- intranda goobi-viewer-core
- Cross-site scripting (XSS)
- Other injection
- CVSS 5.1 Medium
GFI Archiver < 15.14 Stored XSS via MailInsights.aspx
- GFI Software GFI Archiver
- Cross-site scripting (XSS)
- CVSS 7.1 High
baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments
- baserproject basercms
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Zimbra Collaboration Suite Pre-Authentication Reflected Cross-Site Scripting via Login Page zrememberme Parameter
- Zimbra Collaboration Suite
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Zimbra Collaboration Suite Briefcase CSS Sanitization Bypass via Non-ASCII Stylesheet Characters
- Zimbra Collaboration Suite
- Cross-site scripting (XSS)
- CVSS 8.7 High
Zimbra Collaboration Suite Classic Web Client Reflected Cross-Site Scripting via Document Editor Packages Parameter
- Zimbra Collaboration Suite
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Hostme v2 theme <= 7.0 - Cross Site Scripting (XSS) vulnerability
- AivahThemes Hostme v2
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress KALLYAS theme <= 4.25.0 - Cross Site Scripting (XSS) vulnerability
- Hogash KALLYAS
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
conda-forge.org: Stored DOM XSS via unsanitized dangerouslySetInnerHTML in the status dashboard
- conda-forge.github.io
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected Cross-Site Scripting (XSS) in CGM CLININET
- CGM CLININET
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- e4jvikwp VikRentCar
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VikRentCar plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability
- e4jvikwp VikRentCar
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in OrderAdministration Portal (AuftragsManager) via Business Reference in VertiGIS WebOrderSystem
- VertiGIS Ltd. WebOrderSystem (AuftragsManager)
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected Cross-Site Scripting in CustomerAdministration Portal (KundenManager)in VertiGIS WebOrderSystem
- VertiGIS Ltd. WebOrderSystem (KundenManager)
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting in CustomerAdministration Portal (KundenManager) in VertiGIS WebOrderSystem
- VertiGIS Ltd. WebOrderSystem (KundenManager)
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Advanced Custom Fields: Extended 0.8.9.4 - 0.9.2.7 - Contributor+ XSS via Form Shortcode Attributes
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Cross-site scripting (XSS)
- CVSS 7.5 High
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via Font Display Optimization
- LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 7.5 High
LiteSpeed Cache < 7.9.2 - Unauthenticated Stored XSS via CDN Inline CSS Rewriting
- LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Profile Builder < 4.0.5 - Contributor+ Stored XSS via redirect_url Shortcode Attribute
- User Profile Builder
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
- Speed Optimizer
- Cross-site scripting (XSS)