Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.5 Medium
AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-267
- Drupal AI (Artificial Intelligence)
- Cross-site scripting (XSS)
- CVSS 7.1 High
AI (Artificial Intelligence) - Critical - Cross-site scripting - SA-CONTRIB-2026-269
- Drupal AI (Artificial Intelligence)
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-272
- Drupal AI (Artificial Intelligence)
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
AI (Artificial Intelligence) - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-273
- Drupal AI (Artificial Intelligence)
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Signature pad widget - Critical - Cross-site scripting - SA-CONTRIB-2026-285
- Drupal Signature pad widget
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
Stage File Proxy - Critical - Cross-site scripting - SA-CONTRIB-2026-286
- Drupal Stage File Proxy
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary code via the Profile editing functionality, chat messaging component.
- Cross-site scripting (XSS)
- CVSS 8.9 High
WeGIA: Stored Cross-Site Scripting (XSS) in "historico_prontuarios.php" via "textoProntuario" Field
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 6.3 Medium
WeGIA: Stored DOM XSS in listar_despachos.php Allows Account Takeover
- LabRedesCefetRJ WeGIA
- Cross-site scripting (XSS)
- CVSS 7.3 High
Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass
- Cross-site scripting (XSS)
<26.6.4 · fixed in 26.6.4
GHSA-v3f7-2p4r-mwfw · CVE-2026-9086 - CVSS 7.1 High
WordPress Chained Quiz plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability
- Bob Chained Quiz
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress YouTube Showcase plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
- emarket-design YouTube Showcase
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Blockonomics plugin 3.11.0 - Cross Site Scripting (XSS) vulnerability
- Blockonomics
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Easy Property Listings plugin <= 3.5.25 - Cross Site Scripting (XSS) vulnerability
- Merv Barrett Easy Property Listings
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Auction Nudge – Your eBay on Your Site plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
- morehawes Auction Nudge – Your eBay on Your Site
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Razorpay Payment Button Elementor Plugin plugin <= 1.2.8 - Cross Site Scripting (XSS) vulnerability
- Razorpay Payment Button Elementor Plugin
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Podamibe Custom User Gravatar plugin <= 1.0.8 - Cross Site Scripting (XSS) vulnerability
- Podamibe Nepal Podamibe Custom User Gravatar
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Post Video Players plugin <= 1.165 - Cross Site Scripting (XSS) vulnerability
- nicashmu Post Video Players
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Crowdfunding plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- Themeum WP Crowdfunding
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Eventer plugin <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability
- Jyothis Joy Eventer
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress GlobalPayments WooCommerce plugin <= 1.23.3 - Cross Site Scripting (XSS) vulnerability
- Global Payments GlobalPayments WooCommerce
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Stored Cross-Site Scripting in Zimbra
- Synacor Zimbra Collaboration
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Stored Cross-Site Scripting in Zimbra
- Synacor Zimbra Collaboration
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WordPress Kirki plugin <= 6.4.0 - Content Injection vulnerability
- Themeum Kirki
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Plus Addons for Elementor Page Builder Lite plugin <= 6.5.3 - Cross Site Scripting (XSS) vulnerability
- POSIMYTH Innovations The Plus Addons for Elementor Page Builder Lite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability
- bPlugins Flash & HTML5 Video
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability
- WP Chill Strong Testimonials
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability
- David Lingren Media LIbrary Assistant
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Happy Addons for Elementor plugin <= 3.50.1 - Cross Site Scripting (XSS) vulnerability
- weDevs Happy Addons for Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
- bPlugins StreamCast
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress SureDash plugin <= 1.12.3 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force SureDash
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetElements For Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.8.0.2 - Cross Site Scripting (XSS) vulnerability
- Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress PublishPress Authors plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
- PublishPress Authors
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress SureForms plugin <= 2.12.9 - Content Injection vulnerability
- Brainstorm Force SureForms
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress Brave plugin <= 0.8.8 - Content Injection vulnerability
- Brave
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress User Registration plugin <= 5.3.0 - Content Injection vulnerability
- ThemeGrill User Registration
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress JetSmartFilters plugin <= 3.8.6.2 - Cross Site Scripting (XSS) vulnerability
- Crocoblock JetSmartFilters
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Reflected Cross-Site Scripting in BMC Helix Operations Management
- BMC Helix Operations Management
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Reflected Cross-Site Scripting in BMC ITSM SmartIT
- BMC IT Service Management Suite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Import and export users and customers plugin <= 2.5.9 - Cross Site Scripting (XSS) vulnerability
- Codection Import and export users and customers
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url
- Multiple Pages Generator by Themeisle
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress PDF Poster plugin <= 2.6.1 - Cross Site Scripting (XSS) vulnerability
- bPlugins PDF Poster
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in BMC ITSM Knowledge Articles
- BMC IT Service Management Suite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Kali Forms plugin <= 2.4.27 - Cross Site Scripting (XSS) vulnerability
- Kaliforms Kali Forms
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Video Gallery Block plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
- bPlugins Video Gallery Block
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting in BMC ITSM Attachments
- BMC IT Service Management Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting in BMC ITSM Work Notes
- BMC IT Service Management Suite
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Cozy Blocks plugin <= 2.2.27 - Cross Site Scripting (XSS) vulnerability
- CozyThemes Cozy Blocks
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Site Reviews plugin <= 8.3.5 - Cross Site Scripting (XSS) vulnerability
- Gemini Labs Site Reviews
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability
- Igor Funa Ad Inserter
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress The Post Grid plugin <= 7.9.7 - Cross Site Scripting (XSS) vulnerability
- Mamunur Rashid The Post Grid
- Cross-site scripting (XSS)
- CVSS 7.2 High
NewsmanApp <= 3.7.29 - Unauthenticated Stored Cross-Site Scripting via 'billing_first_name' and 'billing_last_name' Parameters
- NewsmanApp
- Cross-site scripting (XSS)
- CVSS 4.9 Medium
Meta Box <= 5.15.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Background Field Array Keys
- metabox Meta Box – A Framework for Dynamic Websites
- Cross-site scripting (XSS)
- CVSS 7.2 High
NEX-Forms <= 9.3.2 - Unauthenticated Stored Cross-Site Scripting via Content-Type Header
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
- SABBATIC app
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
- SABBATIC app
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
- SABBATIC app
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
- SABBATIC app
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress TableOn plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability
- PluginUs.Net TableOn
- Cross-site scripting (XSS)