Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.1 High
WordPress OceanWP theme <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
- OceanWP
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.7 - Cross Site Scripting (XSS) vulnerability
- WP Swings Upsell Order Bump Offer for WooCommerce
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink
- devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter
- Mapster WP Maps
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
LiteSpeed Cache <= 7.9.1 - Unauthenticated Stored Cross-Site Scripting via HTML Minifier Predictable Placeholder (md5(REQUEST_TIME) + two-pass str_replace)
- litespeedtech LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Sequential Order Numbers for WooCommerce <= 3.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'condition' Post Meta Array Keys
- berocket Sequential Order Numbers for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
LiteSpeed Cache <= 7.9.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via VPI Image Attribute Re-Serialization
- litespeedtech LiteSpeed Cache
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Everest Forms <= 3.6.2 - Reflected Cross-Site Scripting via 'evf_toast_type' Parameter
- wpeverest Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block
- wpsoul Greenshift – animation and page builder blocks
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText
- wpsoul Greenshift – animation and page builder blocks
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
RSS Aggregator by Feedzy <= 5.2.12 - Unauthenticated Stored Cross-Site Scripting via YouTube media:description Feed Element
- themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Media Library Assistant <= 3.42 - Reflected Cross-Site Scripting via 'search-string' Parameter via {+request:...+} in Pagination Links
- dglingren Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Extensions for Leaflet Map <= 5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via External GeoJSON Property
- hupe13 Extensions for Leaflet Map
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Reflected Cross-Site Scripting in ICT Innovations’ PHP-CGI/PHP-FPM configuration
- ICT Innovations’ PHP-CGI/PHP-FPM configuration
- Cross-site scripting (XSS)
- CVSS 8.8 High
Community Events 1.4.9 - 1.5.9 - Unauthenticated Stored XSS via Event Submission Form
- Community Events
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Enable SVG, WebP, and ICO Upload < 1.1.6 - Author+ Stored XSS via SMIL Animation Bypass
- Enable SVG, WebP, and ICO Upload
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Enable SVG, WebP, and ICO Upload 1.1.3 - 1.1.5 - Author+ Stored XSS via SVG Sanitization Bypass
- Enable SVG, WebP, and ICO Upload
- Cross-site scripting (XSS)
- CVSS 3.5 Low
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
- Appointment Booking Plugin
- Cross-site scripting (XSS)
- CVSS 3.5 Low
LetterPress < 2.4.0 - Admin+ Stored XSS
- LetterPress
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Password Protected <= 2.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Freemius purchase_completed Handler
- saadiqbal Password Protected – Protect Your Site Content With a Password
- Cross-site scripting (XSS)
- CVSS 7.2 High
Schema App Structured Data <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via 'Remove Microdata' Output Filter
- vberkel Schema App Structured Data
- Cross-site scripting (XSS)
- CVSS 7.2 High
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
- wpscripts Food Store – Online Food Delivery & Pickup
- Cross-site scripting (XSS)
- CVSS 7.2 High
DSGVO All in one for WP <= 5.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Output Buffer Regex Corruption
- mlfactory DSGVO All in one for WP
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cross-site scripting in canva ortto
- canva ortto
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored XSS in pre-login notice via reachable legacy logon route
- Apereo Foundation openEQUELLA
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
configuroweb inventariobasico Add Product addlist.php cross site scripting
- configuroweb inventariobasico
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.7 Medium
AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles
- WWBN AVideo-Encoder
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
AVideo-Encoder: reflected cross-site scripting in the login interface
- WWBN AVideo-Encoder
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Seroval: Code injection through a typed array's own constructor property
- Cross-site scripting (XSS)
- Code injection
>=1.6.0, <1.6.11 · fixed in 1.6.11
GHSA-f86p-h4j2-7qgj · CVE-2026-116583 - CVSS 4.7 Medium
Seroval: Script injection through RegExp sources in serialized output
- Cross-site scripting (XSS)
- CWE-116
<1.0.0 || >=1.5.5, <1.6.10 · fixed in 1.0.0, 1.6.10
GHSA-9wx9-5pv9-3349 · CVE-2026-116582 - CVSS 2.1 Low
Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
- Cross-site scripting (XSS)
- CWE-116
>=9.0.0-beta.10, <11.4.14 || >=12.0.0-alpha.1, <12.0.0-alpha.5 · fixed in 11.4.14, 12.0.0-alpha.5
GHSA-8rc2-428q-7ww3 · CVE-2026-118256 - CVSS 7.2 High
Vue I18n: escapeParameter does not prevent XSS through srcdoc in translation messages
- Cross-site scripting (XSS)
- CWE-116
>=11.1.10, <11.4.14 || >=12.0.0-alpha.4, <12.0.0-alpha.5 · fixed in 11.4.14, 12.0.0-alpha.5
GHSA-83rm-6c8r-g728 · CVE-2026-118257 - CVSS 8.4 High
Highcharts Grid: `javascript:` URL in credits.href runs script on click
- Cross-site scripting (XSS)
>=3.2.0, <4.0.0 · fixed in 4.0.0
GHSA-6hgp-fmhr-mrg4 · CVE-2026-118255 - CVSS 8.6 High
Highcharts Grid parses pagination language options as HTML
- Cross-site scripting (XSS)
>=2.0.0, <3.2.0 · fixed in 3.2.0
GHSA-r5wg-q8fc-p6w2 · CVE-2026-118254 - CVSS 8.4 High
Highcharts Dashboards parses fullscreen labels as HTML
- Cross-site scripting (XSS)
>=1.0.0, <4.2.3 · fixed in 4.2.3
GHSA-58g7-7f52-h92c · CVE-2026-118253 - CVSS 8.4 High
Highcharts Dashboards parses sidebar component labels as HTML
- Cross-site scripting (XSS)
>=1.0.0, <4.2.3 · fixed in 4.2.3
GHSA-rcqf-f6h2-ccg9 · CVE-2026-118252 - CVSS 8.4 High
Highcharts: `javascript:` URL in credits.href runs script on click
- Cross-site scripting (XSS)
<11.4.9 || >=12.0.0, <12.6.1 || >=13.0.0, <13.1.0 · fixed in 11.4.9, 12.6.1, 13.1.0
GHSA-5793-x2q3-c3q7 · CVE-2026-118251 - CVSS 8.4 High
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
- Cross-site scripting (XSS)
>=10.0.0, <11.4.9 || >=12.0.0, <12.6.1 || >=13.0.0, <13.1.0 · fixed in 11.4.9, 12.6.1, 13.1.0
GHSA-35rr-xwfh-x789 · CVE-2026-118246 - CVSS 8.5 High
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
- Cross-site scripting (XSS)
>=3.6.0, <4.0.0 · fixed in 4.0.0
GHSA-5ghw-9mgr-jvx2 · CVE-2026-116797 - CVSS 8.5 High
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
- Cross-site scripting (XSS)
>=2.3.0, <3.2.0 · fixed in 3.2.0
GHSA-6g3c-p4fg-xv47 · CVE-2026-118242 - CVSS 8.6 High
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
- Cross-site scripting (XSS)
>=1.0.0, <4.2.2 · fixed in 4.2.2
GHSA-grj7-r4jv-pw9j · CVE-2026-118245 - CVSS 7.2 High
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing
- Cross-site scripting (XSS)
>=12.0.0, <12.6.1 || >=13.0.0, <13.1.0 · fixed in 12.6.1, 13.1.0
GHSA-65hg-cf3f-5m39 · CVE-2026-118244 - CVSS 7.2 High
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
- Cross-site scripting (XSS)
>=10.3.2, <11.4.9 || >=12.0.0, <12.6.2 || >=13.0.0, <13.1.1 · fixed in 11.4.9, 12.6.2, 13.1.1
GHSA-mw4f-gj5x-6xr4 · CVE-2026-116796 - CVSS 6.1 Medium
Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob
- Cross-site scripting (XSS)
<4.16.0 · fixed in 4.16.0
GHSA-h9g5-28mm-hx3g · CVE-2026-118652 - CVSS 9.4 CriticalCritical · CVSS 9+
FearlessCMS: Unauthenticated debug scripts expose filesystem operations and XSS
- fearlessgeekmedia FearlessCMS
- Path traversal
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-Site Scripting via Authentication Endpoint Error Message in Multiple WSO2 Products
- WSO2 API Manager
- WSO2 API Control Plane
- Cross-site scripting (XSS)
- CVSS 8.4 High
n8n before 1.123.85, 2.43.5, and 2.44.1 Stored XSS via Webhook Responses Missing Sandbox Policy
- n8n
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Cross-site scripting in Jenkins
- Jenkins
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Jenkins
- Jenkins
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-site scripting in Jenkins
- Jenkins
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
- GFI USA, LLC GFI KerioConnect
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress SliceWP plugin <= 1.2.13 - Cross Site Scripting (XSS) vulnerability
- iova.mihai SliceWP
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.24 - Cross Site Scripting (XSS) vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress eCommerce Product Catalog plugin <= 3.6.4 - Cross Site Scripting (XSS) vulnerability
- impleCode eCommerce Product Catalog
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WP Discussion Board plugin <= 2.6.0 - Cross Site Scripting (XSS) vulnerability
- WP Discussion Board
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress DXP ToolKit plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability
- Crowd Favorite DXP ToolKit
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress GetPaid plugin <= 2.8.62 - Cross Site Scripting (XSS) vulnerability
- Stiofan GetPaid
- Cross-site scripting (XSS)
- CVSS 8.6 High
HCL BigFix AEX is affected by multiple security vulnerabilities.
- HCL Software BigFix AEX
- Cross-site scripting (XSS)
- Broken access control
- CVSS 8.6 High
Joomla Extension - icagenda.com - Authenticated Stored XSS in iCagenda 4.0.8 to 4.0.12
- icagenda.com iCagenda extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.7 Medium
Cross-site scripting in Acronis Cyber Protect 17
- Acronis Cyber Protect 17
- Cross-site scripting (XSS)