Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.4 Medium
Stored XSS Fazile BACAK's DefterAsist Financial Advisor Platform
- Fazile BACAK DefterAsist Financial Advisor Platform
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Echo Knowledge Base <= 17.214.0 - Reflected Cross-Site Scripting via 'new_kb_config' Parameter
- echoplugins Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon.view' Block Attribute
- cozythemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Hustle <= 7.8.14.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'cta_label' Parameter
- wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Document Embedder <= 2.4.0 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via 'documentSource.doc' Block Attribute
- bplugins Document Embedder – let visitors read files without downloading
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title
- wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
Product Addons for Woocommerce <= 3.1.8 - Authenticated (Shop Manager+) Stored Cross-Site Scripting via 'type' Field Parameter
- acowebs Product Addons for Woocommerce – Product Options with Custom Fields
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
CMB2 <= 2.13.4 - Unauthenticated Stored Cross-Site Scripting via Grouped WYSIWYG Field via Front-End Form
- jtsternberg CMB2
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
easy.jobs <= 2.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon' Block Attribute
- wpdevteam easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute
- kitae-park Mang Board
- Cross-site scripting (XSS)
- CVSS 7.2 High
Prime Slider <= 4.7.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Content_Guard Regex Quote-Escape
- bdthemes Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
VikRentCar Car Rental Management System <= 1.4.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'className' Block Attribute
- e4jvikwp VikRentCar Car Rental Management System
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Webheadcoder Multi-Step Forms for Contact Form 7 <= 4.7 - Reflected Cross-Site Scripting via 'l10n_print_after' Parameter
- webheadllc Webheadcoder Multi-Step Forms for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes
- themefusion Avada (Fusion) Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'repeater' Parameter
- ifso If-So Dynamic Content – Elementor & All Page Builders Personalization
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Postie <= 1.9.87 - Unauthenticated Stored Cross-Site Scripting via Email Body URL Autolink
- wayneallen-1 Postie
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Waitlist Woocommerce ( Back in stock notifier ) <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'type' Shortcode Attribute
- xootix Waitlist Woocommerce ( Back in stock notifier )
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'conversion' Shortcode Attribute
- ifso If-So Dynamic Content – Elementor & All Page Builders Personalization
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Cozy Blocks <= 2.2.27 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'productRating.iconColor' Block Attribute
- cozythemes Cozy Blocks – Website Builder & Business Growth Toolkit | Popups, Lead Forms & Inbox
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
s2Member <= 261011 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'date_format' Shortcode Attribute
- clavaque s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute
- justinnealey DesignSetGo
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Travelly <= 2.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width', 'height', and 'zoom' Shortcode Attributes
- magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
UiChemy <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Slot Link URL
- posimyththemes UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
If-So Dynamic Content <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ifso-redirect Shortcode 'url' Attribute
- ifso If-So Dynamic Content – Elementor & All Page Builders Personalization
- Cross-site scripting (XSS)
- CVSS 7.2 High
MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating
- MxChat – AI Chatbot & Content Generation for WordPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Awesome Support <= 6.4.1 - Authenticated (Custom+) Stored Cross-Site Scripting via Ticket Attachment MIME Confusion
- awesomesupport Awesome Support – WordPress HelpDesk & Support Plugin
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'cta' Attribute
- GeoDirectory
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
GeoDirectory < 2.8.196 - Contributor+ Stored XSS via gd_post_badge 'link' Attribute
- GeoDirectory
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute
- MP3 Audio Player
- Cross-site scripting (XSS)
- CVSS 7.1 High
Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter
- افزونه پیامک ووکامرس | Persian WooCommerce SMS
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute
- Copy Anything to Clipboard for WordPress
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Page Builder by SiteOrigin < 2.38.0 - Contributor+ Stored XSS via panels_info.class
- Page Builder by SiteOrigin
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Royal Elementor Addons 1.7.1037 - 1.7.1069 - Contributor+ Stored XSS via Google Maps Widget Height Setting
- Royal Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 7.5 High
WooCommerce Menu Cart < 3.2.1 - Unauthenticated Stored XSS via Cart Item Variation Attribute
- Menu Cart for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Appointment Booking Calendar <= 1.4.05 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'vs_text_submitbtn' Parameter
- codepeople Appointment Booking Calendar
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
All-in-One Video Gallery <= 4.9.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'embedcode' Post Meta via XML-RPC
- plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
- Cross-site scripting (XSS)
- CVSS 7.2 High
affiliate-toolkit <= 3.9.2 - Unauthenticated Stored Cross-Site Scripting via 'atkp_product_producturl' Parameter
- cservit affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display
- Cross-site scripting (XSS)
- CVSS 7.2 High
AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute
- mohammed_kaludi AMP for WP – Accelerated Mobile Pages
- Cross-site scripting (XSS)
- CVSS 7.2 High
AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter
- nalam-1 AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
All-in-One Video Gallery <= 4.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'more_link' Shortcode Attribute
- plugins360 All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field
- ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter
- Linksys WAG200G
- Cross-site scripting (XSS)
- CVSS 5.7 Medium
WebSub: Reflected script execution through intent-verification challenges
- w3c websub
- Cross-site scripting (XSS)
- CVSS 8.1 High
GRR has a Reflected XSS issue
- JeromeDevome GRR
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Check all ancestor namespace transitions when rendering raw text in html in golang.org/x/net
- Cross-site scripting (XSS)
<0.62.0 · fixed in 0.62.0
GO-2026-6866 · CVE-2026-97045 - CVSS 8.5 High
TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
- Cross-site scripting (XSS)
>=7.9.3, <7.9.4 || >=8.5.1, <8.9.3 · fixed in 7.9.4, 8.9.3
GHSA-mf2p-h6hf-fcwm · CVE-2026-116675 - CVSS 3.1 Low
CKEditor: Cross-site scripting (XSS) in the engine package
- Cross-site scripting (XSS)
>=29.0.0, <47.7.4 || >=48.0.0, <48.5.1 · fixed in 47.7.4, 48.5.1
GHSA-v6mg-96c6-gmpq · CVE-2026-116687 - CVSS 8.1 High
CKEditor: Cross-site scripting (XSS) in the engine package
- Cross-site scripting (XSS)
>=45.0.0, <47.7.4 || >=48.0.0, <48.5.1 · fixed in 47.7.4, 48.5.1
GHSA-rh54-vffm-5fvp · CVE-2026-116688 - CVSS 6.1 Medium
CVE-2026-118132
- NextChat
- Cross-site scripting (XSS)
- CVSS 9.3 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Cross-site Scripting (Reflected XSS) (CWE-79)
- Adobe Campaign Classic
- Cross-site scripting (XSS)
- CVSS 6.2 Medium
GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
- GFI USA, LLC GFI KerioConnect
- Cross-site scripting (XSS)
- CVSS 7.1 High
Electronic Library Description Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- Autodesk Fusion
- Cross-site scripting (XSS)
- CVSS 7.1 High
Fusion Protocol URL Reflected Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- Autodesk Fusion
- Cross-site scripting (XSS)
- CVSS 7.1 High
Design Name Stored Cross-Site Scripting (XSS) in Autodesk Fusion Desktop
- Autodesk Fusion
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
LiteLLM vulnerable to reflected XSS in /sso/debug/callback
- Cross-site scripting (XSS)
>=1.65.5, <1.85.0 · fixed in 1.85.0
GHSA-hhww-mrg2-969h - CVSS 5.1 Medium
Stored XSS in KGS Software tia Viewer
- KGS Software tia Viewer
- Cross-site scripting (XSS)
- CVSS 8.7 High
Cross-site scripting in Devolutions PowerShell Universal
- Devolutions PowerShell Universal
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected XSS in Kulga Software's Kulga News Software
- Kulga Software and Telecommunications Limited Company Kulga News Software
- Cross-site scripting (XSS)
- CVSS 7.2 High
Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- wplakeorg Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode
- Cross-site scripting (XSS)