Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
react-admin before 5.15.5 Stored XSS via UrlField and FileField
- marmelab react-admin
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Brizy plugin 2.8.23 - Cross Site Scripting (XSS) vulnerability
- Brizy
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
TYPO3-EXT-SA-2026-033: Cross-Site Scripting in extension "TYPO3 Fluid-Form by coding.ms" (fluid_form)
- Cross-site scripting (XSS)
<5.0.10 || >=6.0.0, <6.0.6 · fixed in 5.0.10, 6.0.6
PKSA-s8v1-krjv-23c8 · CVE-2026-113442 - CVSS 6.9 Medium
Multiple vulnerabilities in FacturaScripts
- FacturaScripts
- Cross-site scripting (XSS)
- CVSS 6.9 Medium
Multiple vulnerabilities in FacturaScripts
- FacturaScripts
- Cross-site scripting (XSS)
- CVSS 6.6 Medium
Possible DOM XSS in SNS Web Administration Portal
- Stormshield Network Security
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
DiviGear Carousel <= 5.2.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via update_license AJAX Action
- DiviGear Carousel
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Cross-site scripting in LY Corporation LIFF SDK
- LY Corporation LIFF SDK
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
grandnode grandnode2 Product Description Product.Layout.Simple.cshtml Html.Raw cross site scripting
- grandnode2
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
IBM Cloud Pak System Cross-Site Scripting
- IBM Cloud Pak System
- Cross-site scripting (XSS)
- CVSS 7.4 High
IBM Cloud Pak System Cross-Site Scripting
- IBM Cloud Pak System
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
IBM Cloud Pak System HTML Injection
- IBM Cloud Pak System
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
IBM Concert Software Cross-Site Scripting
- IBM Concert
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Wuxi Wubang Security Software Five-in-One Safety Production Management Information System Upload Endpoint upload.aspx cross site scripting
- Wuxi Wubang Security Software Five-in-One Safety Production Management Information System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Mercury: Stored / DOM Cross-Site Scripting (XSS): mr.Markdown renders untrusted content as raw, unsanitized HTML
- Cross-site scripting (XSS)
- CWE-116
>=3.0.0, <3.2.11 · fixed in 3.2.11
GHSA-2658-85cv-9wwq · CVE-2026-111059 - CVSS 4.3 Medium
Stored Cross-Site Scripting via XML Input in Multiple WSO2 Products Allows UI Manipulation and Redirection
- WSO2 API Manager
- WSO2 Universal Gateway
- Cross-site scripting (XSS)
- CVSS 2.3 Low
MI6 @ukic/canary-web-components 3.0.0-canary.12 before 3.0.0-canary.48 DOM XSS via ic-tree-item
- MI6 Intelligence Community UI Kit canary web components
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Koalixcrm through 1.14.0 Stored XSS via Task Title in Django Admin
- KoalixSwitzerland koalixcrm
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetElements For Elementor plugin <= 2.9.2.4 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetElements For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress e2pdf plugin <= 1.32.57 - Cross Site Scripting (XSS) vulnerability
- e2pdf
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress YITH WooCommerce Wishlist plugin <= 4.18.1 - Cross Site Scripting (XSS) vulnerability
- YITH WooCommerce Wishlist
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Apache Answer: Stored XSS via unsanitized HTML in imported question content
- Apache Software Foundation Apache Answer
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
MISP Workflow Module: Reflected XSS via Unescaped misp-modules Parameter Names in Form Labels
- MISP
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability
- Themeum Tutor LMS
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability
- Ays Pro Quiz Maker
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting
- SourceCodester Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting
- SourceCodester Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
SourceCodester Inventory System Product Management products_handler.php save cross site scripting
- SourceCodester Inventory System
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
subhajitkhan online-clinic-management-system feedback.php cross site scripting
- subhajitkhan online-clinic-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
subhajitkhan online-clinic-management-system Doctor Registration doctorregistration.php echo cross site scripting
- subhajitkhan online-clinic-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.8 Medium
Document Gallery 4.0 - 5.1.1 - Contributor+ Stored XSS via Gallery Shortcode Attributes
- Document Gallery
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Blaze Demo Importer < 1.0.17 - Author+ Stored XSS via SVG Upload
- Blaze Demo Importer
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
diem-project diem dmWidget dmBaseLinkTag.php text cross site scripting
- diem
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
diem-project diem Administrative Console actions.class.php append cross site scripting
- diem
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
diem-project diem Version Check Service dmAdminCtrl.js html cross site scripting
- diem
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) 9.23 and prior (no fixed version available) allows a remote attacker to execute arbitr…
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Chamilo LMS Ticket TicketManager.php addProject cross site scripting
- Chamilo LMS
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Cross-site scripting in Bootstrap Shortcodes
- Bootstrap Shortcodes
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
AUTOMATIC1111 stable-diffusion-webui Extra-Networks Card Builder sd_models.py read_metadata_from_safetensors cross site scripting
- AUTOMATIC1111 stable-diffusion-webui
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting
- AUTOMATIC1111 stable-diffusion-webui
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.1 High
WordPress Booktics plugin <= 1.0.29 - Cross Site Scripting (XSS) vulnerability
- Arraytics Booktics
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress PowerPack Lite for Beaver Builder plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability
- IdeaBox Creations PowerPack Lite for Beaver Builder
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Cross Site Scripting (XSS) vulnerability
- NSquared Simply Schedule Appointments
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress eStore theme <= 1.6.13 - Cross Site Scripting (XSS) vulnerability
- ThemeGrill eStore
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting
- hrisikeshpal Blood_Bank_Management_System
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.1 High
WP Photo Album Plus < 9.2.11.002 - Reflected XSS via 'wppa-cat' Parameter
- WP Photo Album Plus
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Salon Booking System < 10.31.11 - Salon Staff+ Stored XSS and SSRF via Salon REST 'image_url'
- Salon Booking System
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
dext34-morgan Books4Cash search.php cross site scripting
- dext34-morgan Books4Cash
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Stored XSS via SVG DTD Entity Bypass
- thorsten phpMyFAQ
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI
- thorsten phpMyFAQ
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability
- PAYCOMET for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header
- davidanderson European VAT Compliance Assistant for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
- wssoffice21 YMC Filter
- Cross-site scripting (XSS)
- CVSS 7.2 High
Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter
- stiofansisland Payment forms, Buy now buttons, and Invoicing System | GetPaid
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability
- Heateor Support Fancy Comments WordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting via 'vat_number' Parameter
- daigo75 EU VAT Assistant for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via 'popup_width_unit' Parameter
- themifyme Themify Popup
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'visible' Shortcode Attribute
- themifyme Themify Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
User Registration & Membership <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting via Checkbox Field Value
- wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
- wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN
- Cross-site scripting (XSS)