Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.8 Medium
Cross-site scripting in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Cross-site scripting (XSS)
- CVSS 9.0 CriticalCritical · CVSS 9+
Cross-site scripting in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Cross-site scripting (XSS)
- CVSS 8.8 High
Cross-site scripting in Dell Wyse Management Suite
- Dell Wyse Management Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Vembu BDRSuite < 7.6.0 XSS via restoreprogress.sgp
- Vembu Technologies BDRSuite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Vembu BDRSuite < 7.6.0 XSS via serverbackupprogress.sgp
- Vembu Technologies BDRSuite
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering
- AWS maplibre-gl-js-amplify
- Cross-site scripting (XSS)
- CVSS 7.3 High
traQ: XSS in the User Uploaded File Retrieval API
- traPtitech traQ
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Elo JavaScript emitter has sandbox escape to arbitrary Node.js / browser code execution via unfiltered `.constructor` member access
- Cross-site scripting (XSS)
- Code injection
<1.0.1 · fixed in 1.0.1
GHSA-33r5-xmm8-v6x5 · CVE-2026-44267 - CVSS 5.3 Medium
buku 5.0 through 5.1.1 Stored XSS via bukuserver Bookmark List URL
- jarun buku
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability
- WPVibes AnyWhere Elementor
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability
- Barn2 Plugins Posts Table with Search & Sort
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WordPress Forminator plugin <= 1.58.3 - Content Injection vulnerability
- WPMU DEV Forminator
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Paid Member Subscriptions plugin <= 3.1.3 - Cross Site Scripting (XSS) vulnerability
- Cozmoslabs Paid Member Subscriptions
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
TeXlyre from 0.11.0 before 0.13.5 Stored XSS via Recipe Icon Import
- texlyre
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
CVE-2026-121578
- Amidaware Tactical RMM
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description
- postfixadmin
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
svg-sanitizer before 1.1.0 XSS via animateTransform on Safari
- darylldoyle svg-sanitizer
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality.
- AM System ALO Suite
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
TYPO3-EXT-SA-2026-037: Cross-Site Scripting in extension "Mail" (mail)
- Cross-site scripting (XSS)
<3.12.5 || >=4.0.0, <4.2.0 · fixed in 3.12.5, 4.2.0
PKSA-t76y-hqn1-zzxw · CVE-2026-120332 - CVSS 6.1 Medium
Cross-site scripting in NAVER billboard.js
- NAVER billboard.js
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Reflected Cross-Site Scripting via Authentication Endpoint in Multiple WSO2 Products Allows Browser Redirection and UI Modification
- WSO2 API Control Plane
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Photo Engine (Media Organizer & Lightroom) <= 6.5.7 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Collection Name
- tigroumeow Photo Engine (Media Organizer & Lightroom)
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
News Kit Addons For Elementor <= 1.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via nekit_update_mega_menu_form AJAX Action
- blazethemes News Kit Addons For Elementor
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()
- tigroumeow SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting
- Welcart e-Commerce Plugin
- Cross-site scripting (XSS)
- Code injection
- CVSS 4.6 Medium
Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows
- AWS aidlc-traceability
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Munshi XSS via Purchase Inquiry Thread Rendering
- Petpooja Munshi
- Cross-site scripting (XSS)
- CVSS 8.4 High
FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
- FOSSBilling
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
An Otter Wiki before 2.26.2 Stored XSS via Math Code Block
- redimp otterwiki
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
XSS in wrensec-commons CREST framework HTTP binding via _mimeType parameter
- Wren Security wrensec-commons
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Wing FTP Server before 8.2.6 Stored XSS via nowpath in Legacy Activity Page
- Wing FTP Software Wing FTP Server
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
LaraDashboard before 1.4.9 Stored XSS via LaraBuilder design_json Block Content
- LaraDashboard
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
GoFound through 1.4.1 Stored XSS via Admin Dashboard Search Results
- sea-team GoFound
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
PandaWiki 3.65.0 through 3.87.5 Stored XSS via /static-file/ PDF Query-String Bypass
- Chaitin PandaWiki
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.
- joomshaper.com Helix Ultimate extension for Joomla
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5
- php-web-design.com StageIt extension for Joomla
- Cross-site scripting (XSS)
- CVSS 8.6 High
Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.11.
- joomshaper.com Helix Ultimate extension for Joomla
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Cross-site scripting in Dell OpenManage Enterprise
- Dell OpenManage Enterprise
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Stored Cross-Site Scripting in Multiple WSO2 Products
- WSO2 API Manager
- WSO2 Carbon API Manager Publisher REST API
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Reflected Cross-Site Scripting via User Search Function in Management Console of Multiple WSO2 Products
- WSO2 Enterprise Integrator
- WSO2 API Manager
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
mathurvishal CloudClassroom-PHP-Project manageassessment2.php cross site scripting
- mathurvishal CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 5.3 Medium
mathurvishal CloudClassroom-PHP-Project updatedetailsfromfaculty.php cross site scripting
- mathurvishal CloudClassroom-PHP-Project
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.6 High
Apache Wicket: XSS via a resource bundle text written unescaped into generated JavaScript and markup
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 7.6 High
Apache Wicket: XSS via a component id or markup id written unescaped into generated JavaScript and markup
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 7.4 High
Apache Wicket: XSS in ExternalLink via the model URL when the component is bound to a non-anchor tag
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 7.4 High
Apache Wicket: XSS in SmartLinkLabel and SmartLinkMultiLineLabel via a javascript: URL in the model data
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 7.6 High
Apache Wicket: XSS in AjaxNewWindowNotifyingBehavior via the client-supplied window name
- Apache Software Foundation Apache Wicket
- Cross-site scripting (XSS)
- CVSS 4.8 Medium
Ruijie RG-ES205GC Cloud Management set_cloud_serverUrl.cgi cross site scripting
- Ruijie RG-ES205GC
- Ruijie RG-ES206GC-P
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.1 High
WordPress WordPress File Upload plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
- Nickboss WordPress File Upload
- Cross-site scripting (XSS)
-
Gitea stored XSS through legacy Actions artifact Content-Encoding
- Gitea
- Cross-site scripting (XSS)