Cross-site scripting in Showdown through 2.1.0 allows an attacker to break out of the href and src attributes of rendered markdown links and images by placing a double quote in the destination URL followed by an event handler such as onerror or onmouseover. The makehtml.link and makehtml.image subparsers concatenate the unescaped URL directly into quoted attributes, so the injected handler executes in the victim's browser when the rendered HTML is displayed. The flaw is unauthenticated from the attacker's side (CVSS 4.0 vector PR:N) but requires the victim to view the rendered output (UI:P); it is only exploitable when the host application renders attacker-influenced markdown without a secondary output sanitizer, and per the upstream patch comments the CommonMark-spec (cmSpec) flavors percent-encode URLs and are not affected. No KEV, EPSS, or active-exploitation telemetry was supplied with this report, and no public exploit identified at time of analysis, although the upstream fix commit includes regression test cases containing the exact injection payloads.
Reflected cross-site scripting in OpenIdentityPlatform OpenAM before 16.1.3 allows unauthenticated attackers to run JavaScript in the OpenAM origin by luring a victim to a crafted /oauth2/authorize link whose repeated query parameters are echoed without encoding on the OAuth2 authorization error page. Exploitation requires user interaction (UI:P) and is most damaging when the victim already holds an active OpenAM session, because the injected script can then ride that session or redirect the user to a phishing page; deployments exposing the OAuth2 endpoint with default settings are in scope. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, making this a moderate-severity (CVSS 5.3) issue rather than an emergency patch-and-pray event.
OpenAM versions before 16.1.3 allow unauthenticated attackers to inject arbitrary content into notification emails sent by the forgotPassword and register self-service endpoints (/json/{realm}/users). By supplying subject and message fields, an attacker can craft phishing messages that appear to originate from the organization's configured From address, or misuse the register action to relay email to arbitrary recipients. No public exploit code has been identified at the time of analysis, and the vendor has released version 16.1.3 to address the improper input validation (CWE-20).
Stored cross-site scripting in Formbricks allows an authenticated workspace member holding only the lower-privileged readWrite role to inject arbitrary JavaScript into a survey through the survey-level Custom Head Scripts feature, which failed to enforce the documented Manage permission boundary. Because the injected scripts run inside the authenticated browser session of any user who opens the affected survey, a low-privileged member can execute code in the session of higher-privileged users such as Manage-role holders or administrators. Exploitation requires a valid in-workspace account (CVSS PR:L) and a separate victim who actually opens the survey (UI:P), and the issue is remediated in Formbricks 5.4.4 and 6.0.1, which re-enforce the Manage requirement for modifying survey Custom Head Scripts; no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting in IDURAR ERP CRM through version 4.1.1 lets any authenticated user with upload privileges plant JavaScript-bearing SVG files through the profile-update or settings upload endpoints; the scripts then execute in a victim's browser when the file is loaded from the application's /public route. Because the upload middleware (backend/src/middlewares/uploadMiddleware/utils/fileFilterMiddleware.js) does not sanitize SVG content, the injected script inherits the application's origin and can read or alter data the victim is authorized to see. The attack requires a valid account (PR:L) and a victim who views the malicious file (UI:P), so it is an interaction-dependent, client-side issue rather than a direct server compromise; no public exploit code was identified at time of analysis, and the vendor has not published a fixed release.
Stored cross-site scripting in Shopclass versions before 6.2.0 lets a self-registered, non-administrative user with listing-posting rights embed persistent JavaScript in an item description, which then executes in the site origin for every visitor who views that listing - including the listing author. The flaw only exists on sites where an administrator has explicitly enabled the non-default "use TinyMCE on the frontend" option, because the rich-editor path in ItemActions.php::prepareData() disables Params' tag-stripping XSS check and, prior to the fix, stored the description verbatim with no replacement sanitization. Authentication is required (low-privileged account) and a victim must view the crafted listing, and no public exploit code has been identified at time of analysis; the vendor shipped an HTMLPurifier-based allow-list fix in 6.2.0 (commit c196f709) and the advisory is credited to VulnCheck.
Reflected cross-site scripting in the SAML load-balancer cookie bounce auto-submit page of OpenIdentityPlatform OpenAM allows crafted SAML message, RelayState, or target URL values to execute attacker-controlled script in the OpenAM origin for any user who loads the resulting page (CVSS 4.0 base 5.1; independently assessed as CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). Two prerequisites sharply limit real-world exposure: the page is only reachable when the non-default cookieHashRedirectEnabled load-balancer setting is enabled, and in all released versions of OpenAM before 16.1.3 an unrelated HTTP 500 failure aborts the request before the injected payload can run, making the defect latent in shipped builds. No public exploit identified at time of analysis, and the issue requires unauthenticated remote delivery of crafted input plus a victim actively loading the page. Fixed in OpenAM 16.1.3.
Decoding an attacker-crafted APV bitstream with the Academy Software Foundation's OpenAPV reference implementation before version 1.1.1.0 can overflow a heap buffer in the read_bitstream/decoder path, because integer wraparound in the frame buffer-size calculation lets a too-small allocation pass the internal size check. The affected component is the oapvd decoder and the oapv_app_dec sample application; no authentication or non-default configuration is required, but the attack vector is local (AV:L), so exploitation requires the victim to open or process a malicious .apv-style file. Vendor-rated impact is limited (low confidentiality, integrity, and availability per the assessed CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L vector), consistent with a crash or constrained memory corruption rather than reliable code execution, and no public exploit code or CISA KEV active-exploitation record was identified at time of analysis.
Stored cross-site scripting in the SEOPress - AI SEO Plugin & On-site SEO for WordPress (all versions up to and including 10.2) lets authenticated attackers with subscriber-level access inject arbitrary web scripts through the 'seopress_google_analytics_matomo_id' setting, which then execute in the browser of any user who views a page rendering the stored Matomo ID. Exploitation is gated by a non-default prerequisite: an administrator must have explicitly delegated Analytics management capability to the Subscriber role via the plugin's Advanced > Security settings, without which subscribers cannot reach the vulnerable setting, and the injected payload only fires when a victim subsequently visits an affected page. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS base score of 4.9 (Medium) reflects the opt-in configuration and user-visit dependency that limit real-world exploitation.
Improper authentication in the Burst Statistics - Simple WordPress Analytics (Google Analytics Alternative) plugin, in all versions up to and including 3.7.1, lets anyone holding a valid `burst_share_token` receive a genuine WordPress session cookie for the `burst_statistics_viewer` account because the `maybe_load_shared_dashboard()` handler calls `wp_set_auth_cookie()` for token-bearing visitors. Once authenticated as that account, an attacker can drive core's self-service `/wp-json/wp/v2/users/me` password-update endpoint - the plugin blocks Application Passwords for the `burst_viewer` role but never filters the endpoint or the `edit_user` capability - and set an attacker-chosen password, giving a permanent takeover of the limited-privilege (`view_burst_statistics`) account that survives share-token revocation, token expiration, and the plugin's daily `cleanup_viewer_sessions()` routine. Exposure is bounded: the CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 4.3) is scored low-privilege specifically because a valid share token is a prerequisite, so sites that never generate or circulate share tokens are not reachable, and there is no confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Authorization bypass in the Alt Text AI WordPress plugin (≤1.10.41) allows any authenticated user with subscriber-level access to overwrite the content of arbitrary posts and pages with LLM-generated text, enabling SEO poisoning and unauthorized consumption of the site owner's AltText.ai API credits. The vulnerability is a low-severity (CVSS 4.3) missing authorization check (CWE-862) that is exploitable because the required nonce is trivially obtainable on the subscriber-accessible profile page. No public exploit has been identified at time of analysis, and the vendor has published a code changeset that appears to remediate the issue.
Authenticated users with subscriber-level access or above on WordPress sites running the Helpdesk Support Ticket System for WooCommerce plugin version 2.1.6 or earlier can delete support ticket responses belonging to other users by supplying any stsw_responses row ID to the plugin's deletion handler. The root cause is an insecure direct object reference (CWE-639) in the 'id' parameter, where the plugin performs no ownership or capability validation on the user-controlled key; the only extra step needed is harvesting the deletion nonce that the plugin exposes in the admin footer. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; CVSS 3.1 rates it 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), consistent with a low-integrity impact limited to unauthorized deletion rather than data disclosure or site compromise.