Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.5 High
Otter Blocks < 3.2.8 - Unauthenticated Stored XSS via Dynamic Content Render Filter
- Otter Blocks
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Otter Blocks < 3.2.8 - Contributor+ Stored XSS via Block Style Attributes
- Otter Blocks
- Cross-site scripting (XSS)
- CVSS 7.2 High
Anti-Spam by CleanTalk <= 6.89.1 - Unauthenticated Stored Cross-Site Scripting via 'user_email' Registration Parameter
- CleanTalk Anti-Spam – Complete Spam Protection
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer
- Part-DB-server
- Cross-site scripting (XSS)
- Unrestricted file upload
- CVSS 5.7 Medium
Part-DB: Stored HTML injection in BOM validation results via unescaped Part name
- Part-DB-server
- Cross-site scripting (XSS)
- CVSS 6.0 Medium
Part-DB: Stored XSS / HTML injection in activity-log Extra column via unsanitized CollectionElementDeleted element name (sibling-sanitizer gap)
- Part-DB-server
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
gedelumbung HospitalManagement Admin Routing routing_pages.php simpan cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.8 Medium
gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting
- gedelumbung HospitalManagement
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
- vikunja
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Mistune before 3.3.0 Stored XSS via Include Directive HTML Files
- lepture mistune
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
Authenticated Stored Cross-Site Scripting (XSS) Vulnerability in AOS Web-Based Management Interface
- Hewlett Packard Enterprise (HPE) ArubaOS (AOS)
- Cross-site scripting (XSS)
- CVSS 8.6 High
Agent Zero Web UI XSS
- Agent Zero
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Nuxt server islands render `useHeadSafe` input without sanitisation
- Cross-site scripting (XSS)
>=3.13.0, <4.6.2 · fixed in 4.6.2
GHSA-xfq5-w38q-pc2x · CVE-2026-114133 - CVSS 6.3 Medium
OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel
- OpenCATS
- Cross-site scripting (XSS)
- CVSS 2.3 Low
Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
- Cross-site scripting (XSS)
<4.6.0 · fixed in 4.6.0
GHSA-jjm6-p2m9-9w4x · CVE-2026-114130 - CVSS 6.5 Medium
Astro: Reflected/Stored XSS via unescaped <script>/<style> tag content in JSX/MDX rendering
- Cross-site scripting (XSS)
<7.3.2 · fixed in 7.3.2
GHSA-98hj-9722-w3j8 · CVE-2026-114128 - CVSS 2.3 Low
Astro: Arbitrary CSS injection in Astro View Transitions
- Cross-site scripting (XSS)
>=7.1.0, <7.3.3 · fixed in 7.3.3
GHSA-mpr7-6m5w-76rw · CVE-2026-114127 - CVSS 5.1 Medium
DOMPurify SAFE_FOR_TEMPLATES bypass: split template expressions survive in attached shadow root content on DOM output modes
- Cross-site scripting (XSS)
>=3.4.4, <3.4.17 · fixed in 3.4.17
GHSA-cg2g-xh64-v4q7 · CVE-2026-116804 - CVSS 5.1 Medium
DOMPurify IN_PLACE: hook that removes a parent or sibling leaves the detached subtree's event handlers armed (incomplete fix for GHSA-p98j-92pf-mc4p)
- Cross-site scripting (XSS)
- CWE-693
<3.4.17 · fixed in 3.4.17
GHSA-mrv2-3pqr-j5jr · CVE-2026-116803 - CVSS 5.1 Medium
DOMPurify: SMIL attributeName=href guard is skipped when PARSER_MEDIA_TYPE is application/xhtml+xml
- Cross-site scripting (XSS)
<3.4.17 · fixed in 3.4.17
GHSA-c6gr-qvv4-5v3f · CVE-2026-116802 - CVSS 7.4 High
OCO-Server: Stored XSS through agent hostnames in command buttons
- schorschii OCO-Server
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
ammonia: mXSS via MathML `annotation-xml` encoding strip
- Cross-site scripting (XSS)
<3.3.2 || >=4.0.0, <4.0.2 || >=4.1.0, <4.1.3 · fixed in 3.3.2, 4.0.2, 4.1.3
GHSA-9jh8-v38h-cvhr · CVE-2026-63430 - CVSS 5.1 Medium
subhajitkhan online-clinic-management-system patdocmsg.php cross site scripting
- subhajitkhan online-clinic-management-system
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.1 Medium
Retool < 3.88.0 XSS via /api/imageProxy SVG Proxying
- Retool
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang
- OnTheGoSystems WPML Multilingual CMS
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Sickbeard build-507 Reflected XSS via testNaming pattern Parameter
- midgetspy Sickbeard
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed
- Discourse
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
QCubed 3.1.1 Reflected XSS via installer step_2.php
- QCubed
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress ACF Extended plugin <= 0.9.2.7 - Cross Site Scripting (XSS) vulnerability
- ACF Extended
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Extensions for Leaflet Map plugin <= 6.0 - Cross Site Scripting (XSS) vulnerability
- hupe13 Extensions for Leaflet Map
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress ND Shortcodes For Visual Composer plugin <= 7.8 - Cross Site Scripting (XSS) vulnerability
- nicdark ND Shortcodes For Visual Composer
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Waitlist Woocommerce ( Back in stock notifier ) plugin <= 2.9.1 - Cross Site Scripting (XSS) vulnerability
- xootix Waitlist Woocommerce ( Back in stock notifier )
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin <= 2.4.4 - Cross Site Scripting (XSS) vulnerability
- Gloriafood Restaurant Menu – Food Ordering System – Table Reservation
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Mailster plugin <= 1.9.1.0 - Cross Site Scripting (XSS) vulnerability
- WP Mailster
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Off-Canvas Sidebars & Menus (Slidebars) plugin <= 0.5.9 - Cross Site Scripting (XSS) vulnerability
- Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars)
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability
- Codepeople Contact Form Email
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress H5P plugin <= 1.17.9 - Cross Site Scripting (XSS) vulnerability
- H5P
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Elementor Addon Elements plugin <= 1.14.4 - Cross Site Scripting (XSS) vulnerability
- WPVibes Elementor Addon Elements
- Cross-site scripting (XSS)
- CVSS 7.5 High
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
- WebP Express
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter
- Link Library
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name
- Photo Engine (Media Organizer & Lightroom)
- Cross-site scripting (XSS)
- CVSS 7.2 High
PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie
- PixelYourSite
- PixelYourSite Pro
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
WordPress Core <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Quick Edit
- WordPress
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Cross-site scripting in Roundcube Webmail
- Roundcube Webmail
- Cross-site scripting (XSS)
- CVSS 3.1 Low
AI (Artificial Intelligence) - Moderately critical - Cross site scripting - SA-CONTRIB-2026-119
- Drupal AI (Artificial Intelligence)
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Component blocks - Moderately critical - Cross site scripting - SA-CONTRIB-2026-123
- Drupal Component blocks
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Email Verification / SMS Verification / OTP Verification - Critical - Cross Site Scripting - SA-CONTRIB-2026-125
- Drupal Email Verification / SMS Verification / OTP Verification
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
PhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-131
- Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery
- Cross-site scripting (XSS)
- CVSS 4.2 Medium
Feed Block - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-137
- Drupal Feed Block
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
SafeDelete - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-140
- Drupal SafeDelete
- Cross-site scripting (XSS)
- CVSS 3.5 Low
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-146
- Drupal SAML SSO - Service Provider
- Cross-site scripting (XSS)
- CVSS 3.3 Low
SAML SSO - Service Provider - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-147
- Drupal SAML SSO - Service Provider
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-154
- Drupal Webform
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-155
- Drupal Webform
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-158
- Drupal Webform
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-159
- Drupal Webform
- Cross-site scripting (XSS)
- CVSS 4.2 Medium
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-160
- Drupal Webform
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-163
- Drupal Webform
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Webform - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-172
- Drupal Webform
- Cross-site scripting (XSS)