Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 3.5 Low
CookieCuttr - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-181
- Drupal CookieCuttr
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Diba carousel slider - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2026-191
- Drupal Diba carousel slider
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL.
- Cross-site scripting (XSS)
- CVSS 9.6 CriticalCritical · CVSS 9+
An issue was discovered in localstack 4.9.2 allowing attackers to execute arbitrary code via crafted content hosted on a web-accessable URL and when passed said URL in the the templateURL to the _loc…
- Cross-site scripting (XSS)
- CVSS 5.7 Medium
Stored Cross-Site Scripting (XSS) through App Documentation in Splunk SOAR
- Splunk SOAR
- Cross-site scripting (XSS)
- CVSS 8.4 High
Multiple Vulnerabilities in the Highcharts Library Bundled with Vaadin Charts
- vaadin
- vaadin-charts-flow
- Cross-site scripting (XSS)
- Prototype pollution
- CVSS 6.5 Medium
Sector is a distribution targeted towards Drupal site builders and site owners who are looking for a fully configured Drupal project out of the box.
- Cross-site scripting (XSS)
<10.3.3 || >=10.4.0, <10.4.2 · fixed in 10.3.3, 10.4.2
DRUPAL-CONTRIB-2026-229 · CVE-2026-107260 - CVSS 5.4 Medium
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
- Cross-site scripting (XSS)
<4.34.0 · fixed in 4.34.0
GHSA-7jg5-frgc-c67w · CVE-2026-112958 - CVSS 5.4 Medium
ApostropheCMS: Color field validation bypass allows stored XSS via HTML appended after rgb()/hsl() prefix
- Cross-site scripting (XSS)
<4.34.0 · fixed in 4.34.0
GHSA-vmgj-9cwm-cf3h · CVE-2026-112951 - CVSS 2.1 Low
Vite: Cross origin script execution through Vite custom middleware
- Cross-site scripting (XSS)
<6.4.4 || >=7.0.0, <7.3.7 || >=8.0.0, <8.1.6 || >=8.2.0, <8.2.4 || >=8.3.0, <8.3.3 · fixed in 6.4.4, 7.3.7, 8.1.6, 8.2.4, 8.3.3
GHSA-9jrq-w75r-8gcw · CVE-2026-112945 - CVSS 9.3 CriticalCritical · CVSS 9+
Cisco Unified Communications Products Hardening Release: October 2026 - Cross-site Scripting Vulnerabilities
- Cisco Emergency Responder
- Cisco Unified Communications Manager
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Geo Mashup plugin <= 1.13.22 - Cross Site Scripting (XSS) vulnerability
- Dylan Kuhn Geo Mashup
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force SureCart
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Contest Gallery plugin <= 34.0.1 - Cross Site Scripting (XSS) vulnerability
- Wasiliy Strecker Contest Gallery
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress ThemeHunk Customizer plugin <= 2.8.7 - Cross Site Scripting (XSS) vulnerability
- ThemeHunk Customizer
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Paid Videochat Turnkey Site plugin <= 7.5.14 - Cross Site Scripting (XSS) vulnerability
- VideoWhisper.com Paid Videochat Turnkey Site
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Enables UI Manipulation and Redirection
- WSO2 Enterprise Integrator
- WSO2 Identity Server
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
PHPPresentation 1.2.0 XSS via Writer\HTML Text Runs, Hyperlinks and Descriptions
- PHPOffice PHPPresentation
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
- e107
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Live Summary for Gravity Forms plugin <= 1.2.10 - Cross Site Scripting (XSS) vulnerability
- geekontheroad Live Summary for Gravity Forms
- Cross-site scripting (XSS)
- CVSS 8.8 High
Jane Menu < 1.5.1 - Unauthenticated Stored XSS via Store Config Proxy URL
- Jane Menu
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Ninja Forms plugin <= 3.15.5 - Cross Site Scripting (XSS) vulnerability
- Kevin Stover Ninja Forms
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Strong Testimonials plugin <= 3.3.12 - Cross Site Scripting (XSS) vulnerability
- WP Chill Strong Testimonials
- Cross-site scripting (XSS)
- CVSS 7.5 High
Weglot < 6.4.3 - Unauthenticated Stored XSS via Translated Page Link Rewriting
- Translate WordPress with Weglot 2.0
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Elementor < 4.3.5 - Contributor+ Stored XSS via SVG CDATA Sanitizer Bypass
- Elementor Website Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Elementor < 4.3.5 - Author+ Stored XSS via SVG Upload
- Elementor Website Builder
- Cross-site scripting (XSS)
- CVSS 7.1 High
Advanced File Manager 5.4.13 - 5.4.14 - Authenticated Stored XSS via SVG Sanitiser Content-Sniff Bypass
- Advanced File Manager
- Cross-site scripting (XSS)
- CVSS 7.1 High
Profile Builder < 4.0.1 - Reflected XSS via Unconfirmed Emails Row Actions
- User Profile Builder
- Cross-site scripting (XSS)
- CVSS 7.5 High
Redirection for Contact Form 7 2.2.7 - 3.2.11 - Unauthenticated Stored XSS via Lead Debug Metabox
- Redirection for Contact Form 7
- Cross-site scripting (XSS)
- CVSS 7.1 High
WP Booking System < 2.1.0.3 - Reflected XSS via 'booking_id' Parameter
- WP Booking System
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
WP Job Openings < 4.1.1 - Author+ Stored XSS via Job Title
- HireZoot
- Cross-site scripting (XSS)
- CVSS 8.0 High
Falang multilanguage for WordPress < 1.4.6 - Subscriber+ Stored XSS via Term Translation
- Falang multilanguage for WordPress
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Duplicate Advisory: SvelteKit before 3.0.0 XSS via Cache-Control Header in Prerendered Pages
- Cross-site scripting (XSS)
* · no fixed version yet
GHSA-85pr-xr59-r75h - CVSS 5.3 Medium
itsourcecode Online Cake Ordering System 404.php cross site scripting
- itsourcecode Online Cake Ordering System
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.1 Medium
IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
- IBM @carbon/charts
- IBM @carbon/charts-react
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Cachet has Stored XSS in Incident Component
- Cross-site scripting (XSS)
<=2.4.1 · no fixed version yet
GHSA-x397-5hrv-j9m9 · CVE-2026-113712 - CVSS 8.8 High
Cross-site scripting in Google Chrome
- Google Chrome
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
JavaMelody < 1.60.0 Reflected XSS via monitoring graph parameter
- JavaMelody
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php
- Jason Newman Blogroll Fun
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php
- DedeCMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
SocialFit WordPress Plugin 1.2.2 Reflected XSS via popup.php msg Parameter
- Łukasz Więcek SocialFit
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
K-news WordPress Plugin < 1.1.1 Reflected XSS via fontpicker index.php ff Parameter
- Carles Reverter K-news
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
- Web Updates KMU Custom Tables
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Stored XSS in the VPN logs monitor
- Stormshield Network Security
- Cross-site scripting (XSS)
- CVSS 7.0 High
Stored XSS on SNS Enrollment Portal
- Stormshield Network Security
- Cross-site scripting (XSS)
- CVSS 3.7 Low
ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
- Cross-site scripting (XSS)
>=2.17.7, <2.18.0 · fixed in 2.18.0
GHSA-374f-7chj-9948 · CVE-2026-113657 - CVSS 6.1 Medium
ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
- Cross-site scripting (XSS)
- Prototype pollution
<4.33.0 · fixed in 4.33.0
GHSA-m2m5-rw3w-cwmj · CVE-2026-113659 - CVSS 7.1 High
Stored XSS on SNS Enrollment Portal
- Stormshield Network Security
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
- Cross-site scripting (XSS)
<2.18.0 · fixed in 2.18.0
GHSA-cv27-6wvh-8x7j · CVE-2026-113661 - CVSS 5.3 Medium
ApostropheCMS sanitize-html: nonTextTags discard region ends early on an implied close, letting <noscript> content render
- Cross-site scripting (XSS)
<2.18.0 · fixed in 2.18.0
GHSA-x3q4-9hxx-gx8m · CVE-2026-113654 - CVSS 4.6 Medium
SolarWinds Observability Self-Hosted Cross-Site Scripting Vulnerability
- SolarWinds Observability Self-Hosted
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename
- jcrodriguez-dis moodle-mod_vpl
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
- CozyThemes Rootblox
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force SureCart
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability
- Castos Seriously Simple Podcasting
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
- cypht
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
XSS in Ticimax Informatics' Ticimax E-Commerce Platform
- Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform
- Cross-site scripting (XSS)
- CVSS 8.6 High
Unblu Spark Cross-Site Scripting in Embedded Co-Browsing
- Unblu inc. Unblu Spark
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Optimal IdM OptimalCloud Login cross site scripting
- Optimal IdM OptimalCloud
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links
- chatwoot
- Cross-site scripting (XSS)