XSS
Monthly
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript execution in end-user browsers when untrusted input is serialized inside template content nested within fallback raw-content elements (noscript, iframe, noembed, noframes) on versions prior to 20.3.30, 21.2.22, and 22.1.4. The root cause is a traversal bug in Angular's Domino serializer: the ancestor-tag walk that determines whether closing tags must be escaped stopped at DocumentFragment boundaries (the type returned by template.content), so unescaped closing tags could break out of their container and activate attacker-controlled markup when the browser's HTML5 RAWTEXT parser processes the server-rendered HTML. No public exploit or CISA KEV listing exists at time of analysis, but the Renderer2 imperative DOM construction path is unconditionally exploitable in all affected versions regardless of schema configuration.
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript execution in a victim's browser when attacker-controlled data reaches a `ProcessingInstruction` DOM node serialized inside an HTML5 RAWTEXT fallback container. Affected Angular versions prior to 20.3.30, 21.2.22, and 22.1.4 use a `domino` library build that escapes `>` in ProcessingInstruction data but not `<`, permitting a crafted closing tag such as `</noscript>` to prematurely terminate the RAWTEXT container and cause sibling elements to render as live HTML. The vulnerability is confirmed by GitHub Security Advisory GHSA-j3r3-mxqp-r2p4 with patches released across all three active Angular major release lines; no public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.
Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
Stored XSS in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated remote attackers to inject persistent JavaScript payloads into property listings and related content. Multiple template files across both frontend views and administrator list tables rendered user-supplied attributes and text values directly into HTML without contextual output escaping, enabling the stored payload to execute in the browser of any user who views the affected page - including Joomla administrators. No public exploit code has been identified and this vulnerability is not currently listed in CISA KEV, but the stored nature and admin-context execution make this a high-priority remediation target for any site running the affected extension.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Stored cross-site scripting in Open WebUI's terminal port preview feature allows an authenticated attacker sharing a terminal server with a victim to execute arbitrary JavaScript in the victim's browser at the Open WebUI origin, enabling full account takeover. The vulnerability affects versions 0.8.11 through 0.11.1 and stems from a dangerous iframe sandbox configuration that combines `allow-scripts` with `allow-same-origin`, which together nullify sandbox isolation when content is served from the application's own origin. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed, but the attack is straightforward for any authenticated user on a shared terminal deployment.
Stored cross-site scripting in SkillTree (NSA skills-service) before 4.4.2 lets an unauthenticated attacker self-register with a malicious firstName/lastName/nickname that executes in an administrator's browser when they open the Quiz Runs page. Because registration fields are stored unsanitized and later rendered through Vue's v-html directive, the flaw escalates from simple alert() proof to remote script loading via import() and full XSRF-token theft, enabling any admin action (delete projects, create backdoor accounts, exfiltrate user data). Publicly detailed in the GitHub Security Advisory; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in SiYuan's search asset preview feature allows authenticated workspace members to inject and execute arbitrary JavaScript in other users' browser sessions. All SiYuan releases before v3.8.2 are affected; the flaw stems from unescaped asset content passed directly to innerHTML during search preview rendering. Successful exploitation grants the attacker authenticated API access within the SiYuan origin, enabling workspace data exfiltration and content manipulation on behalf of the victim.
Stored cross-site scripting in SiYuan's Search Assets result list (all versions before 3.8.2) allows low-privilege authenticated attackers to plant JavaScript payloads inside asset filenames that execute in any user's browser session when that user performs an asset search. The CVSS 4.0 score of 8.4 (PR:L/UI:A) reflects the requirement for a valid account and victim interaction, but successful exploitation grants the attacker same-origin API access and full application state manipulation under the victim's identity. No active exploitation has been confirmed and no public POC is identified at time of analysis.
Stored cross-site scripting in SiYuan's Bazaar marketplace component (all versions before 3.8.2) allows an attacker to publish a package with a crafted iconURL containing JavaScript event handlers that execute in the authenticated user's SiYuan origin when Bazaar listing cards are rendered. The root flaw is unsanitized insertion of iconURL package metadata directly into HTML img src attributes, enabling injected event handlers such as onerror to fire arbitrary JavaScript within the victim's session. Once triggered, the injected script can make authenticated API requests and manipulate application state on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in SiYuan note-taking application before v3.8.2 allows an authenticated attacker to achieve same-origin JavaScript execution in a victim's browser session. Notebook template paths are persisted to storage and later reflected into HTML input value attributes without attribute-context encoding, enabling an attacker who can write a template path to inject JavaScript that executes when any user opens the affected notebook's configuration panel. Successful exploitation permits same-origin API requests and full application state manipulation, including access to notes, attachments, and configuration secrets. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Stored cross-site scripting in the Auth0 AD/LDAP Connector (versions up to and including 6.5.0) lets an attacker persist malicious script into directory-attribute search results or updater log content that later renders unencoded in the connector's admin panel, executing in an administrator's browser session. The payload can be planted either by an authenticated user permitted to modify directory attributes or by a low-privileged local user on the connector host, and fires when an admin views the affected search results or update logs. No public exploit identified at time of analysis; disclosure originates from Okta PSIRT.
Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) enables an adjacent-network attacker to inject and execute malicious scripts in a victim's browser, potentially resulting in full session hijacking and administrative account takeover. Exploitation is constrained by an adjacent network attack vector (AV:A) and mandatory victim interaction - the victim must open a specially crafted malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Adobe PSIRT advisory APSB26-119 governs the fix.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persist malicious JavaScript in vulnerable form fields that later executes in a victim's browser when they view the affected page. Successful exploitation can hijack the victim's session or account, and because scope is changed (S:C) the payload can affect resources beyond the vulnerable component - for example an admin session viewing attacker-supplied content. Adobe PSIRT rates it 9.3 Critical; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August 2026 builds of 2.4.4-2.4.9 / B2B 1.3.3-1.5.3) lets an attacker persist malicious JavaScript into vulnerable form fields that later executes in a victim's browser. Because the CVSS scope is changed, the injected script runs beyond the injection context and can hijack the victim's session or account, and CVSS:3.1 PR:N indicates the injection requires no attacker authentication while UI:R means a victim must load the affected page. No public exploit is identified at time of analysis, and the flaw was reported privately by Adobe PSIRT under APSB26-138.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Stored CSS injection in Snipe-IT before 8.7.0 lets a superuser plant malicious CSS in the Custom CSS branding setting that executes in every other superuser's browser, exfiltrating their CSRF tokens and enabling account takeover. The flawed sanitizer HTML-encoded input but then selectively reversed the encoding on '>' and '"' while never filtering @import or url(), permitting attribute-selector rules to leak tokens character-by-character. Publicly available exploit code exists via the VulnCheck advisory; no public exploit identified as actively exploited, and no EPSS/KEV signal was provided.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the `booked_add_appt` AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. Once stored, the payload executes in the browser context of every subsequent user who views an injected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. No public exploit has been identified at time of analysis, but the zero-privilege injection vector combined with scope-changing browser execution makes this a high-priority patch for any WordPress environment running Gravity Forms.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance plugin for WordPress (all versions through 3.13.4) allows unauthenticated attackers to persist executable JavaScript in comment content that runs in the WordPress origin for any subsequent visitor, including logged-in administrators. The root cause is an interaction between the plugin's global strtr() substitution logic and WordPress's KSES allowlist: the substitution strips substrings from KSES-permitted tags (such as abbr title attributes and HTML comments), mutating what KSES treated as safe markup into executable elements like img onerror handlers. No public exploit has been identified at time of analysis, but a patched version (3.13.5) is available.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance for GDPR/CCPA WordPress plugin (versions ≤3.13.4) allows unauthenticated attackers to inject persistent malicious scripts into pages via comment content processed through the AdSense regex rewrite path. The injected payload executes in any visiting user's browser, enabling session hijacking, credential theft, or malicious redirects. Exploitation is gated by a non-default parser engine configuration - sites running the newer DOM-based parser are not affected. Vendor-released patch 3.13.5 resolves the issue; no public exploit or KEV listing identified at time of analysis.
Stored cross-site scripting in Emlog versions 2.6.29 and prior enables arbitrary JavaScript execution in the browsers of all site visitors. The root cause is Parsedown being invoked without safe mode enabled, so raw HTML - including `<script>` tags and inline event handlers - embedded in article Markdown is passed through and rendered without any additional sanitization. No vendor-released patch was publicly available at the time of disclosure, leaving all deployed instances of Emlog ≤2.6.29 exposed; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Cross-site scripting in MapLibre GL JS before 6.4.1 lets an attacker who controls map style attribution strings or user-supplied custom attributions bypass the library's HTML sanitizer and run arbitrary JavaScript in the victim's browser. The flaw is a sanitizer bug in DOM.sanitize(): iterating the live attributes collection while deleting attributes shifts indexes, so a dangerous event handler placed immediately after another removed attribute (e.g. onload/ontoggle) survives cleaning and fires when the attribution control writes the content to innerHTML. No public exploit or KEV listing exists, but the fix commit ships working payloads (e.g. `<details open onload ontoggle=alert(1)>`) as regression tests, making a POC trivially reconstructable.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated Cross-Site Scripting in the EWWW Image Optimizer WordPress plugin (versions ≤ 8.7.6) enables remote attackers to inject arbitrary JavaScript into pages served to authenticated site visitors, including administrators. With Scope:Changed in the provided CVSS vector, successful exploitation can break out of the plugin's security boundary - allowing session token theft, admin-level action hijacking, or persistent backdoor injection via malicious script execution in a privileged browser context. Reported by Patchstack; no active exploitation or public PoC has been identified at time of analysis.
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated trigger and large install base elevate real-world risk.
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows remote attackers to inject and execute arbitrary JavaScript in victim browsers without any prior authentication. Exploitation requires a victim to visit or interact with a page or crafted URL where the plugin renders unsanitized attacker-controlled input. The CVSS vector (S:C) confirms a scope change to the victim's browser context; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated stored cross-site scripting in WP QuickLaTeX for WordPress (versions <= 3.8.8) allows a remote unauthenticated attacker to inject malicious scripts into LaTeX-rendered content. When a privileged user such as a site administrator views the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. Reported by Patchstack; no public exploit code or active exploitation confirmed at time of analysis.
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic targeting straightforward once a vulnerable site is discovered.
Unauthenticated cross-site scripting in the Under Construction WordPress plugin (versions ≤ 5.82) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to follow a crafted URL. The scope-change vector (S:C) confirms the payload executes in the browser's security context, enabling session token theft, credential harvesting, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement lowers the bar for abuse significantly.
Cross-site scripting in the Simple Payment WordPress plugin (versions ≤ 2.5.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, including site administrators. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own origin - enabling session hijacking, credential theft, or administrative actions executed on the victim's behalf. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/JavaScript in the notification template (endpoint /ocsreports/?function=notification) that executes in the browser of any other administrator who opens the template customisation view. The injected script runs in the application's security context, enabling session hijacking or privileged actions against fellow admins. Reported by INCIBE; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total.
Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.
Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102.
Cross-site scripting in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected page. The scope-changing CVSS vector (S:C) confirms that the injected payload can compromise sessions or data belonging to users other than the attacker, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit code has been identified at time of analysis, and no KEV listing is present.
Unauthenticated cross-site scripting in the Estatik real estate WordPress plugin affects all versions up to and including 4.3.4, allowing remote unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS scope-change flag (S:C) indicates the injected script can affect browser sessions beyond the vulnerable component itself - typically enabling session hijacking, credential theft, or unauthorized actions performed on behalf of logged-in administrators. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated cross-site scripting in the TrustedSite WordPress plugin (versions <=1.2.5) allows remote attackers without any credentials to inject arbitrary JavaScript into pages served to site visitors or administrators. The CVSS vector designates a scope change (S:C), meaning the injected script executes in the victim's browser context and can affect resources beyond the vulnerable WordPress installation itself - including session cookies and browser-stored credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated entry point and low attack complexity make this a realistic risk on any unpatched deployment.
Reflected Cross-Site Scripting in the Interactive Geo Maps WordPress plugin (versions <= 1.6.30) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to click a crafted URL. The vulnerability carries a CVSS 7.1 with scope change, meaning the injected script executes in the context of the victim's authenticated WordPress session rather than the plugin's own origin. No public exploit or active CISA KEV listing has been identified at time of analysis, though Patchstack has published a vulnerability entry.
Unauthenticated stored or reflected Cross-Site Scripting in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions <= 5.13.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they visit an affected page. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and crosses into the browser security context, making this a meaningful risk on any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has documented the issue.
Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in SiYuan before v3.8.2 enables authenticated users with upload access to bypass the asset extension blocklist by using file types such as .xht, .ehtml, .xsl, .xbl, or .rdf that browsers render as executable documents. When a victim opens or previews the malicious asset, embedded JavaScript runs in the SiYuan application context, allowing theft of API tokens and full workspace compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in v3.8.2.
Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed available as version 2.4.13.1.
Reflected cross-site scripting in the Login With Ajax WordPress plugin (versions through 4.5.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The scope change in the CVSS vector (S:C) reflects the XSS payload executing outside the origin context, enabling session theft, credential harvesting, or DOM manipulation against authenticated WordPress users. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists via WPScan, and a vendor-released patch (6.0.9.9) is confirmed available.
Stored cross-site scripting in the WWBN AVideo Bookmark plugin lets a video owner persist a JavaScript payload through the bookmark/chapter name parameter, which is concatenated into public watch-page HTML without output encoding (CWE-79). Every viewer of the affected video then executes attacker-controlled script in the AVideo origin, enabling session/account compromise of ordinary users and administrators. Reported by VulnCheck with a public advisory; no CISA KEV listing and no weaponized exploit code identified, though technical detail in the advisory lowers the barrier to reproduction.
Stored cross-site scripting in the LoginControl plugin of WWBN AVideo allows an authenticated low-privilege user to persist malicious JavaScript by submitting a crafted PGP public key, which is echoed unencoded into a textarea and executes in an administrator's browser session when the admin views the attacker's profile tab. This is a privilege-escalation vector - attacker-controlled script runs with admin session context, enabling account/platform takeover. VulnCheck reported it with a published GitHub Security Advisory; no public exploit is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo's CustomizeUser plugin lets an administrator persist an unsanitized field_name value through the add.json.php endpoint, which later executes as script when any user or admin renders the extra-info pages or profile forms via the typeToHTML function. The flaw affects AVideo up through commit c3edcc274c389816d434acadac07ee78eaf330c1 and was reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (through commit c3edcc27) lets an authenticated user poison their own 'donationLink' profile field, which is later rendered unencoded inside an <a href="..."> attribute on the video watch page. Because User::save() validates the value only with FILTER_VALIDATE_URL (which accepts embedded double quotes and event handlers) and getDonationLink() applies only strip_tags(), an attacker can break out of the href attribute and execute JavaScript in the browser of any visitor - including an administrator - who hovers over the donation button. Reported by VulnCheck; publicly available exploit code exists via the advisory, and the issue was unfixed at time of reporting.
Stored cross-site scripting in the YPTWallet plugin of WWBN AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets an authenticated low-privilege user plant malicious markup via a CryptoWallet configuration value that is base64-encoded but never HTML-escaped before being written to wallet_log.information. When an administrator reviews pending withdrawal requests in pendingRequests.php, the payload executes in their session, enabling attacker-driven administrative actions through same-origin fetch requests. Reported by VulnCheck with a vendor GitHub Security Advisory (GHSA-fvp5-q9jp-29mx); no public exploit identified at time of analysis.
Stored cross-site scripting in WWBN AVideo (open-source video CMS) allows an administrator holding the canAdminUserGroups permission to persist malicious HTML/JavaScript through UserGroups::setGroup_name(), which then executes in the browser of any other administrator who opens the user manager interface. Affects all builds through commit c3edcc274c389816d434acadac07ee78eaf330c1. Reported by VulnCheck; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored Cross-Site Scripting in the Kirki - Freeform Page Builder, Website Builder & Customizer WordPress plugin (all versions through 6.2.0) allows unauthenticated attackers to permanently embed malicious JavaScript into pages via the unsanitized 'comment' parameter. Injected payloads persist in the database and execute in every subsequent visitor's browser session, enabling session hijacking, credential theft, or privilege escalation against logged-in administrators who view the affected pages. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write vector makes mass-exploitation trivially automatable across unpatched WordPress installations.
Stored cross-site scripting in the Gutenverse News WordPress plugin (before 3.3.3) enables unauthenticated attackers to inject persistent JavaScript via the comment submission form. The plugin registers additional HTML elements into WordPress's global sanitization allowlist rather than scoping them to the block editor context, causing the relaxed ruleset to be applied to untrusted comment input. The payload executes in two distinct phases: immediately when an administrator opens the comment moderation queue, enabling pre-approval admin session hijacking, and again for every visitor once the comment is approved. A public proof-of-concept exploit is available via WPScan.
Stored cross-site scripting in the Vigilant WordPress security plugin (all versions ≤2.10.2) lets an unauthenticated attacker permanently inject malicious scripts by supplying a crafted User-Agent header during any failed login attempt, after which the payload persists in the plugin's login-security log. The script executes automatically in the browser of any administrator who subsequently reviews the login events dashboard, enabling session hijacking or administrative account takeover without further attacker involvement. No public exploit code or CISA KEV listing has been identified at time of analysis, but the passive, zero-interaction delivery path lowers the bar for exploitation considerably.
Stored XSS in the Simple Ajax Chat WordPress plugin (all versions ≤ 20260811) allows fully unauthenticated remote attackers to inject persistent JavaScript payloads that execute in every visitor's browser on every page load. The vulnerability is compounded by a nonce bypass: the WordPress nonce normally used to authenticate chat submissions is rendered in the public chat page DOM, enabling any anonymous attacker to extract and reuse it without logging in. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions through 9.2.08.003) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into pages served to other users. The vulnerability exists because the plugin's AJAX logging path - triggered via the unauthenticated wp_ajax_nopriv_wppa endpoint - records the attacker-supplied HTTP X-Forwarded-For header value directly to disk through wppa_log() without sanitization, then later renders that stored value without output escaping. No public exploit or KEV listing has been identified at time of analysis, but the technique (header spoofing against a nopriv AJAX endpoint) is trivially automatable.
Cross-site scripting via Angular's server-side rendering package (@angular/platform-server) allows arbitrary JavaScript execution in end-user browsers when untrusted input is serialized inside template content nested within fallback raw-content elements (noscript, iframe, noembed, noframes) on versions prior to 20.3.30, 21.2.22, and 22.1.4. The root cause is a traversal bug in Angular's Domino serializer: the ancestor-tag walk that determines whether closing tags must be escaped stopped at DocumentFragment boundaries (the type returned by template.content), so unescaped closing tags could break out of their container and activate attacker-controlled markup when the browser's HTML5 RAWTEXT parser processes the server-rendered HTML. No public exploit or CISA KEV listing exists at time of analysis, but the Renderer2 imperative DOM construction path is unconditionally exploitable in all affected versions regardless of schema configuration.
Cross-site scripting in Angular's server-side rendering engine (`@angular/platform-server`) allows arbitrary JavaScript execution in a victim's browser when attacker-controlled data reaches a `ProcessingInstruction` DOM node serialized inside an HTML5 RAWTEXT fallback container. Affected Angular versions prior to 20.3.30, 21.2.22, and 22.1.4 use a `domino` library build that escapes `>` in ProcessingInstruction data but not `<`, permitting a crafted closing tag such as `</noscript>` to prematurely terminate the RAWTEXT container and cause sibling elements to render as live HTML. The vulnerability is confirmed by GitHub Security Advisory GHSA-j3r3-mxqp-r2p4 with patches released across all three active Angular major release lines; no public exploit or CISA KEV listing exists at time of analysis.
Unauthenticated Cross-Site Scripting (XSS) in the WPAdverts WordPress plugin affects all versions through 2.3.3, allowing a remote attacker without any credentials to inject malicious JavaScript into pages served by the plugin. With user interaction (UI:R), a victim - likely a logged-in site administrator - must visit or trigger the vulnerable endpoint for the payload to execute in their browser context. Successful exploitation can lead to session hijacking, unauthorized administrative actions, or content manipulation via the changed-scope (S:C) browser execution context. No public exploit or KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the WPCS WordPress currency switcher plugin (versions ≤ 1.3.2) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in victims' browsers without any server-side privileges. The CVSS Scope:Changed metric confirms the injected payload escapes the plugin's own security context, enabling session theft, credential harvesting, or admin-level action execution on behalf of a tricked user. No public exploit or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature lowers the bar for exploitation significantly.
Unauthenticated cross-site scripting in the Page Visits Counter - Lite WordPress plugin (versions ≤ 1.2.3) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser context of a visiting user. Because CVSS marks scope as Changed (S:C), the injected script can escape the plugin's own context and affect the broader WordPress page environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing has been identified at time of analysis; the issue was disclosed by Patchstack.
Stored cross-site scripting in WWBN AVideo's AD_Server plugin lets an unauthenticated attacker persist malicious HTML via the unescaped 'label' parameter of the log.php endpoint, which later executes as arbitrary JavaScript when an administrator opens the Ad Types report. Because the admin report renders the stored value with jQuery .html() without sanitization, exploitation yields code execution in a privileged administrator's browser session, enabling account/session takeover of the affected AVideo installation. No public exploit identified at time of analysis, though a coordinated GitHub Security Advisory (GHSA-h68w-3r38-wmm8) documents the flaw.
Stored cross-site scripting in WWBN AVideo's LiveLinks plugin lets a low-privileged user with canStream permission persist malicious JavaScript via unsanitized title and description fields, which then executes in the browser of every visitor who views the live-link page - including administrators - inside the site origin. Reported by VulnCheck, the flaw affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in WWBN AVideo (all versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1) lets a low-privileged, self-registered user plant a persistent JavaScript payload through video category creation. The unsanitized `name` and `iconClass` POST parameters in objects/categoryAddNew.json.php are later rendered into HTML text and a class attribute on watch pages and Gallery cards, so the payload executes in the browser of any visitor - including administrators - enabling session-riding authenticated requests. VulnCheck reported it unpatched; no public exploit code is identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in the WWBN AVideo LoginControl plugin (all versions through commit c3edcc274c389816d434acadac07ee78eaf330c1) lets any authenticated user inject JavaScript via the User-Agent header, which is stored unencoded in login history and executes in an administrator's browser when they open the Login History page. Because it runs inside the admin session, an attacker can drive privileged actions and effect account takeover of the platform. Reported by VulnCheck; no public exploit identified at time of analysis and no active exploitation confirmed.
Stored XSS in SP Property (a Joomla real estate extension by joomshaper.com) before version 4.1.4 allows unauthenticated remote attackers to inject persistent JavaScript payloads into property listings and related content. Multiple template files across both frontend views and administrator list tables rendered user-supplied attributes and text values directly into HTML without contextual output escaping, enabling the stored payload to execute in the browser of any user who views the affected page - including Joomla administrators. No public exploit code has been identified and this vulnerability is not currently listed in CISA KEV, but the stored nature and admin-context execution make this a high-priority remediation target for any site running the affected extension.
Stored XSS in the Sidebar Manager Light WordPress plugin (all versions through 1.18) allows unauthenticated attackers to permanently inject malicious JavaScript via the `sbm_description` parameter into pages served to any site visitor. The scope-changed impact means attacker-controlled scripts execute within victims' browsers rather than solely the plugin's own context, enabling session hijacking, credential phishing, or drive-by malware delivery. No public exploit code has been identified at time of analysis, and the plugin's limited deployment footprint constrains real-world exposure.
Stored cross-site scripting in Open WebUI's terminal port preview feature allows an authenticated attacker sharing a terminal server with a victim to execute arbitrary JavaScript in the victim's browser at the Open WebUI origin, enabling full account takeover. The vulnerability affects versions 0.8.11 through 0.11.1 and stems from a dangerous iframe sandbox configuration that combines `allow-scripts` with `allow-same-origin`, which together nullify sandbox isolation when content is served from the application's own origin. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed, but the attack is straightforward for any authenticated user on a shared terminal deployment.
Stored cross-site scripting in SkillTree (NSA skills-service) before 4.4.2 lets an unauthenticated attacker self-register with a malicious firstName/lastName/nickname that executes in an administrator's browser when they open the Quiz Runs page. Because registration fields are stored unsanitized and later rendered through Vue's v-html directive, the flaw escalates from simple alert() proof to remote script loading via import() and full XSRF-token theft, enabling any admin action (delete projects, create backdoor accounts, exfiltrate user data). Publicly detailed in the GitHub Security Advisory; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
DOM-based Cross-Site Scripting in the FreeIPA/IdM Web UI password reset page allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a victim's authenticated browser session. By crafting a malicious URL targeting the password reset page and socially engineering a victim into clicking it and completing the reset flow, the attacker hijacks the active session. If the targeted victim is an IdM administrator, this yields full administrative control over the FreeIPA identity management infrastructure. No public exploit or CISA KEV listing identified at time of analysis.
Stored cross-site scripting in SiYuan's search asset preview feature allows authenticated workspace members to inject and execute arbitrary JavaScript in other users' browser sessions. All SiYuan releases before v3.8.2 are affected; the flaw stems from unescaped asset content passed directly to innerHTML during search preview rendering. Successful exploitation grants the attacker authenticated API access within the SiYuan origin, enabling workspace data exfiltration and content manipulation on behalf of the victim.
Stored cross-site scripting in SiYuan's Search Assets result list (all versions before 3.8.2) allows low-privilege authenticated attackers to plant JavaScript payloads inside asset filenames that execute in any user's browser session when that user performs an asset search. The CVSS 4.0 score of 8.4 (PR:L/UI:A) reflects the requirement for a valid account and victim interaction, but successful exploitation grants the attacker same-origin API access and full application state manipulation under the victim's identity. No active exploitation has been confirmed and no public POC is identified at time of analysis.
Stored cross-site scripting in SiYuan's Bazaar marketplace component (all versions before 3.8.2) allows an attacker to publish a package with a crafted iconURL containing JavaScript event handlers that execute in the authenticated user's SiYuan origin when Bazaar listing cards are rendered. The root flaw is unsanitized insertion of iconURL package metadata directly into HTML img src attributes, enabling injected event handlers such as onerror to fire arbitrary JavaScript within the victim's session. Once triggered, the injected script can make authenticated API requests and manipulate application state on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis.
Stored XSS in SiYuan note-taking application before v3.8.2 allows an authenticated attacker to achieve same-origin JavaScript execution in a victim's browser session. Notebook template paths are persisted to storage and later reflected into HTML input value attributes without attribute-context encoding, enabling an attacker who can write a template path to inject JavaScript that executes when any user opens the affected notebook's configuration panel. Successful exploitation permits same-origin API requests and full application state manipulation, including access to notes, attachments, and configuration secrets. No public exploit code has been identified at time of analysis, and CISA KEV status is not confirmed.
Stored cross-site scripting in the WPLP Cookie Consent WordPress plugin (all versions ≤ 4.4.1) enables any unauthenticated site visitor to inject persistent malicious scripts via the `wpl_user_preference` AJAX parameter. The consent-logging endpoint is registered without authentication requirements, and the protective nonce (`wpl_consent_logging_nonce`) is publicly broadcast to every page visitor via `wp_localize_script()`, rendering the nonce mechanism entirely ineffective as an access barrier. Injected payloads execute in the browsers of administrators or users who subsequently view pages rendering consent log data, enabling session hijacking, credential theft, or full administrative account takeover. No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV, but the trivially low exploitation barrier warrants prompt patching.
Stored Cross-Site Scripting in the WPBot AI ChatBot WordPress plugin (QuantumCloud, all versions through 8.7.3) allows unauthenticated remote attackers to inject persistent JavaScript into pages viewed by site users and administrators. The critical design flaw is that the only access gate - a WordPress nonce - is rendered useless because it is embedded in every public-facing page via wp_localize_script, making it fully readable by any visitor. No public exploit code has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this a straightforward exploitation path for opportunistic attackers targeting WordPress sites.
Stored Cross-Site Scripting in the Repeater Fields for Gravity Forms WordPress plugin (all versions ≤3.0.4) allows unauthenticated attackers to inject arbitrary JavaScript into pages via multi-input sub-field types (Name, Address, Checkbox) within a repeater block, executing whenever any user views the affected page. The flaw is isolated to complex sub-field types because scalar single-input fields were patched with esc_html() output escaping in 3.0.4, leaving multi-input composite fields unprotected. Discovered and reported by Wordfence; no public exploit identified at time of analysis, though the vulnerability requires no authentication or special site configuration to abuse via a publicly accessible Gravity Form.
Stored Cross-Site Scripting in the Contact Form to DB by BestWebSoft WordPress plugin (versions ≤1.7.5) allows unauthenticated attackers to compromise administrator sessions via a malicious contact form submission. The `cntctfrm_contact_dropdown` parameter lacks input sanitization and output escaping, so injected JavaScript persists in the plugin's message store and executes automatically in the admin's browser context when they navigate to the message manager page at `/wp-admin/admin.php?page=cntctfrmtdb_manager`. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-prerequisite submission path make this trivially weaponizable against any site with the plugin installed.
Stored cross-site scripting in the Auth0 AD/LDAP Connector (versions up to and including 6.5.0) lets an attacker persist malicious script into directory-attribute search results or updater log content that later renders unencoded in the connector's admin panel, executing in an administrator's browser session. The payload can be planted either by an authenticated user permitted to modify directory attributes or by a low-privileged local user on the connector host, and fires when an admin views the affected search results or update logs. No public exploit identified at time of analysis; disclosure originates from Okta PSIRT.
Reflected Cross-Site Scripting in Adobe ColdFusion 2023 (through Update 23) and ColdFusion 2025 (through Update 12) enables an adjacent-network attacker to inject and execute malicious scripts in a victim's browser, potentially resulting in full session hijacking and administrative account takeover. Exploitation is constrained by an adjacent network attack vector (AV:A) and mandatory victim interaction - the victim must open a specially crafted malicious file. No public exploit code and no CISA KEV listing have been identified at time of analysis; the Adobe PSIRT advisory APSB26-119 governs the fix.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B lets a remote attacker persist malicious JavaScript in vulnerable form fields that later executes in a victim's browser when they view the affected page. Successful exploitation can hijack the victim's session or account, and because scope is changed (S:C) the payload can affect resources beyond the vulnerable component - for example an admin session viewing attacker-supplied content. Adobe PSIRT rates it 9.3 Critical; no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in Adobe Commerce, Magento Open Source, and Adobe Commerce B2B (versions through the August 2026 builds of 2.4.4-2.4.9 / B2B 1.3.3-1.5.3) lets an attacker persist malicious JavaScript into vulnerable form fields that later executes in a victim's browser. Because the CVSS scope is changed, the injected script runs beyond the injection context and can hijack the victim's session or account, and CVSS:3.1 PR:N indicates the injection requires no attacker authentication while UI:R means a victim must load the affected page. No public exploit is identified at time of analysis, and the flaw was reported privately by Adobe PSIRT under APSB26-138.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Stored CSS injection in Snipe-IT before 8.7.0 lets a superuser plant malicious CSS in the Custom CSS branding setting that executes in every other superuser's browser, exfiltrating their CSRF tokens and enabling account takeover. The flawed sanitizer HTML-encoded input but then selectively reversed the encoding on '>' and '"' while never filtering @import or url(), permitting attribute-selector rules to leak tokens character-by-character. Publicly available exploit code exists via the VulnCheck advisory; no public exploit identified as actively exploited, and no EPSS/KEV signal was provided.
Remote code execution in SiYuan desktop before 3.8.2 allows an unauthenticated network attacker to achieve full Node.js-level system access by poisoning a victim's clipboard from a malicious web page. The paste handler in app/src/protyle/util/paste.ts treated the custom text/siyuan clipboard MIME type as implicitly trusted internal content and skipped HTML sanitization before rendering, and a secondary code path used a same-origin hidden iframe to parse large HTML blobs, permitting inline script execution. Because SiYuan's Electron desktop build enables Node.js integration in the renderer process, injected scripts escape the browser sandbox entirely and execute with the privileges of the running user. A vendor-released patch is available at v3.8.2; no public exploit has been identified at time of analysis.
Reflected XSS in Siemens Teamcenter's authentication redirect endpoint (/auth/) allows an unauthenticated remote attacker to inject arbitrary JavaScript into the browser of an already-authenticated user by delivering a crafted URL. Four active Teamcenter release trains are affected across versions prior to V2412.0013, V2506.0010, V2512.2607, and V2606.2607. Successful exploitation enables the attacker to act within the victim's live Teamcenter PLM session - accessing engineering data, modifying records, or pivoting laterally - with no public exploit identified at time of analysis.
DOM-based cross-site scripting in the Easy Appointments WordPress plugin (all versions through 4.0.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victim browsers by delivering a crafted URL. The CVSS scope-change metric (S:C) indicates injected scripts execute within the broader WordPress page context, enabling session hijacking, credential theft, or unauthorized actions on behalf of administrators or site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the Open User Map WordPress plugin (versions <= 1.4.50) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser context of visiting users. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own trust boundary, enabling session hijacking, credential theft, or malicious redirects against authenticated site visitors. No public exploit code or active exploitation has been identified at time of analysis, but the unauthenticated nature and WordPress plugin attack surface make this a realistic target for opportunistic actors.
Unauthenticated reflected cross-site scripting in the JetFormBuilder WordPress plugin (Crocoblock) affects all versions through 3.6.5.1, allowing a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The CVSS vector (PR:N/UI:R/S:C) confirms no authentication is needed to craft a malicious payload, but exploitation requires social engineering to lure a logged-in user into clicking a crafted URL. No public exploit code or CISA KEV listing is identified at time of analysis, though the plugin's wide deployment in WordPress form-building workflows elevates the realistic exposure surface.
Cross-site scripting in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to and including 2.0.17 allows unauthenticated attackers to inject malicious scripts that execute in the browser context of site visitors or privileged WordPress users. The CVSS 7.1 rating reflects a scope change (S:C), meaning the injected payload escapes the plugin's own origin and can compromise administrator browser sessions. No public exploit code or active exploitation has been identified at time of analysis.
Universal Cross-Site Scripting (UXSS) in UC Browser for Android (com.UCMobile.intl 13.7.8.1314) lets remote attackers run arbitrary JavaScript in the security context of any origin, defeating the same-origin policy. By luring a victim to a reflected-XSS page hosted on a UC-owned domain, an attacker abuses the browser's internal JavaScript bridge to register a deferred callback, silently navigate the tab to a target site, and fire attacker code against that origin when a login dialog is dismissed. EPSS is low (0.15%), there is no CISA KEV listing, and no vendor-confirmed exploit code, though the CVE references two public gists that appear to document the technique.
Stored cross-site scripting in the User Profile Builder WordPress plugin (Cozmoslabs, versions ≤3.15.7) permits unauthenticated attackers to inject persistent JavaScript payloads via the 'Biographical Info' registration field, which execute in any visitor's browser upon viewing the affected profile page. The vulnerability is rooted in missing input sanitization and output escaping in class-formbuilder.php and class-email-confirmation.php, enabling session hijacking, credential theft, or malicious redirects targeting administrators and other authenticated users. A patch is confirmed via WordPress.org SVN changeset 3511465; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Kirki WordPress plugin before 6.3.0 allows unauthenticated remote attackers to persistently inject JavaScript into comment fields by bypassing the plugin's HTML entity decoding logic through alternate entity encodings. The malicious payload executes in the browser session of any user - including administrators - who views a page rendering the affected comment, and propagates site-wide when Kirki-managed headers or footers display comment data. A publicly available proof-of-concept exists and the vendor has released a patching fix in version 6.3.0.
Stored cross-site scripting in the Contact Form by Supsystic WordPress plugin (all versions ≤1.10.2) allows unauthenticated attackers to inject persistent malicious scripts via a spoofed IP address header. The exploit chain is notable for its two-stage unauthenticated entry: the plugin's `updateNonce` action is excluded from the permission-check list, granting any unauthenticated caller a valid WordPress nonce; that nonce is then used to submit a contact form with a crafted `X-Forwarded-For` value, which the plugin stores unsanitized and later renders in the admin contacts list. No public exploit has been identified at time of analysis and no KEV listing exists, but the Wordfence advisory includes direct source-code references to the vulnerable code paths.
Stored Cross-Site Scripting in the QuickCal WordPress appointment booking plugin (all versions ≤ 1.0.20) permits unauthenticated remote attackers to inject persistent JavaScript payloads into pages rendered by the booking calendar. The attack is enabled by a design flaw in which the nonce protecting the `booked_add_appt` AJAX action is publicly embedded in any page displaying the booking shortcode, completely nullifying its role as an access control mechanism and allowing any visitor to submit malicious input without credentials. Once stored, the payload executes in the browser context of every subsequent user who views an injected page, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in the SureForms plugin for WordPress (all versions up to and including 2.12.2) permits unauthenticated form submitters to embed persistent malicious scripts by bypassing sanitization with entity-encoded payloads in text fields. The injected payload executes in any visitor's or administrator's browser when they load an affected page, enabling session hijacking, cookie theft, or page defacement across any WordPress site running the vulnerable plugin version. Wordfence reported the issue and a fix was released in version 2.12.3.
Stored Cross-Site Scripting in W3 Total Cache (WordPress plugin) versions up to and including 2.10.5 allows unauthenticated attackers to inject arbitrary JavaScript via comment content processed by the LazyLoad Background Mutator. The flaw stems from insufficient sanitization and output escaping in UserExperience_LazyLoad_Mutator.php, specifically where comment text containing background-image CSS is mutated for lazy loading. Exploitation requires two non-default conditions: the Lazy Load Images feature with 'Process background images' enabled, and the malicious comment must be approved by a moderator before the payload executes against visiting users. A vendor-released patch is available in version 2.10.6.
Stored XSS with on-disk file write capability in the Ninja Forms WordPress plugin (versions ≤3.15.1) allows unauthenticated remote attackers to plant attacker-controlled HTML/JavaScript files anywhere in the web server's writable directory tree - including the site root - when the separately-installed Ninja Forms File Uploads add-on is active. The attack exploits a 'type' confusion flaw in Repeater child field processing: an unrecognized array key causes the submission pipeline to misroute input through the File Uploads handler, which writes raw attacker-supplied content to disk where it is subsequently served from the site's own origin. The fix is confirmed in version 3.15.2 via WordPress.org SVN changeset; no public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the Gravity Forms WordPress plugin (all versions ≤2.10.5) permits unauthenticated attackers to inject persistent malicious scripts via Post Body Field Values that survive WordPress's standard wp_kses_post sanitization. The bypass exploits a client-side tooltip component that re-parses aria-label attribute content as innerHTML - stripping script tags but leaving event-handler attributes such as onerror intact and executable - meaning any user who subsequently loads an affected page runs the attacker-controlled JavaScript in their browser. No public exploit has been identified at time of analysis, but the zero-privilege injection vector combined with scope-changing browser execution makes this a high-priority patch for any WordPress environment running Gravity Forms.
Stored cross-site scripting in the CleanTalk Spam Protection, Honeypot, Anti-Spam WordPress plugin (all versions through 6.86) allows injection of arbitrary JavaScript via unescaped aria-label attributes rendered from comment content by the plugin's ContactsEncoder component. The unauthenticated comment submission path makes the payload deliverable without credentials, though script execution is limited to non-logged-in visitors, and sites with comment moderation enabled require an administrator to approve the comment before it reaches other users. Version 6.87 contains the confirmed fix per WordPress SVN changeset 3677388; no public exploit code or CISA KEV entry is identified at time of analysis.
Stored cross-site scripting in the HT Menu WordPress plugin before 1.2.7 allows any authenticated subscriber-level user to inject arbitrary JavaScript into navigation menu-item settings, which then executes in the browser of every site visitor - including administrators - who views the affected menu. The flaw combines two missing controls: no capability or ownership check on the settings-save endpoint, and no output escaping on render. A public exploit is available via WPScan, and vendor-released patch 1.2.7 is available. No public KEV listing; EPSS is low at 0.15%, consistent with targeted rather than mass exploitation.
Stored cross-site scripting in the JCH Optimize WordPress plugin before 6.0.1 allows any authenticated user with Subscriber-level access to import arbitrary plugin settings via an unprotected AJAX endpoint, injecting persistent JavaScript that executes in the browsers of site visitors and administrators. The missing capability check means that low-privilege accounts bypass the intended authorization boundary, enabling stored XSS delivery without administrative permissions. A publicly available proof-of-concept from WPScan exists, and the vendor has released a fix in version 6.0.1.
Reflected Cross-Site Scripting in the IPGP Visitors Origin WordPress plugin before version 1.6 allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by delivering a crafted URL that the plugin echoes back unsanitized. No server-side authentication is required from the attacker, though victim interaction (clicking or submitting a crafted request) is mandatory for payload execution. A publicly available proof-of-concept via WPScan lowers the exploitation barrier, though EPSS of 0.18% indicates limited automated scanning activity to date and no active exploitation has been confirmed by CISA KEV.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance plugin for WordPress (all versions through 3.13.4) allows unauthenticated attackers to persist executable JavaScript in comment content that runs in the WordPress origin for any subsequent visitor, including logged-in administrators. The root cause is an interaction between the plugin's global strtr() substitution logic and WordPress's KSES allowlist: the substitution strips substrings from KSES-permitted tags (such as abbr title attributes and HTML comments), mutating what KSES treated as safe markup into executable elements like img onerror handlers. No public exploit has been identified at time of analysis, but a patched version (3.13.5) is available.
Stored Cross-Site Scripting in the iubenda All-in-one Compliance for GDPR/CCPA WordPress plugin (versions ≤3.13.4) allows unauthenticated attackers to inject persistent malicious scripts into pages via comment content processed through the AdSense regex rewrite path. The injected payload executes in any visiting user's browser, enabling session hijacking, credential theft, or malicious redirects. Exploitation is gated by a non-default parser engine configuration - sites running the newer DOM-based parser are not affected. Vendor-released patch 3.13.5 resolves the issue; no public exploit or KEV listing identified at time of analysis.
Stored cross-site scripting in Emlog versions 2.6.29 and prior enables arbitrary JavaScript execution in the browsers of all site visitors. The root cause is Parsedown being invoked without safe mode enabled, so raw HTML - including `<script>` tags and inline event handlers - embedded in article Markdown is passed through and rendered without any additional sanitization. No vendor-released patch was publicly available at the time of disclosure, leaving all deployed instances of Emlog ≤2.6.29 exposed; no public exploit code exists and the vulnerability is not listed in CISA KEV.
Unauthenticated XSS in OpenPanel before 2.3.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by supplying a malicious SVG URL to the unprotected favicon proxy endpoint GET /misc/favicon. Because the SVG is served from the OpenPanel API origin, embedded scripts inherit same-origin context, enabling the attacker's code to issue credentialed requests against authenticated admin API endpoints on the victim's behalf. No public exploit code has been identified at time of analysis, but the attack requires only standard web delivery and a logged-in admin victim.
Cross-site scripting in MapLibre GL JS before 6.4.1 lets an attacker who controls map style attribution strings or user-supplied custom attributions bypass the library's HTML sanitizer and run arbitrary JavaScript in the victim's browser. The flaw is a sanitizer bug in DOM.sanitize(): iterating the live attributes collection while deleting attributes shifts indexes, so a dangerous event handler placed immediately after another removed attribute (e.g. onload/ontoggle) survives cleaning and fires when the attribution control writes the content to innerHTML. No public exploit or KEV listing exists, but the fix commit ships working payloads (e.g. `<details open onload ontoggle=alert(1)>`) as regression tests, making a POC trivially reconstructable.
Cross-site scripting in the Quick Event Manager WordPress plugin (versions ≤ 9.17) allows unauthenticated remote attackers to inject malicious JavaScript into pages rendered for authenticated users. Exploitation requires a victim - typically a logged-in WordPress administrator or editor - to load a page or follow a crafted link carrying the payload, which then executes in their browser context with scope change beyond the plugin itself. No public exploit code or CISA KEV active-exploitation listing has been identified at time of analysis.
Cross-site scripting in the BP Better Messages WordPress plugin (≤2.15.27) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The CVSS scope-change metric (S:C) indicates the injected payload can escape the plugin's execution context and affect the broader WordPress environment, enabling session hijacking, credential theft, or admin-level CSRF actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated Cross-Site Scripting in the EWWW Image Optimizer WordPress plugin (versions ≤ 8.7.6) enables remote attackers to inject arbitrary JavaScript into pages served to authenticated site visitors, including administrators. With Scope:Changed in the provided CVSS vector, successful exploitation can break out of the plugin's security boundary - allowing session token theft, admin-level action hijacking, or persistent backdoor injection via malicious script execution in a privileged browser context. Reported by Patchstack; no active exploitation or public PoC has been identified at time of analysis.
Unauthenticated cross-site scripting in the Breadcrumb NavXT WordPress plugin (versions <= 7.5.1) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for visiting users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable, low-complexity exploitation with scope change into the victim's browser context. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the unauthenticated trigger and large install base elevate real-world risk.
Unauthenticated cross-site scripting in RTMKit (RomethemeKit For Elementor) versions up to and including 2.1.5 allows remote attackers to inject and execute arbitrary JavaScript in victim browsers without any prior authentication. Exploitation requires a victim to visit or interact with a page or crafted URL where the plugin renders unsanitized attacker-controlled input. The CVSS vector (S:C) confirms a scope change to the victim's browser context; no public exploit code or active exploitation has been identified at time of analysis.
Unauthenticated stored cross-site scripting in WP QuickLaTeX for WordPress (versions <= 3.8.8) allows a remote unauthenticated attacker to inject malicious scripts into LaTeX-rendered content. When a privileged user such as a site administrator views the affected page, the injected script executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. Reported by Patchstack; no public exploit code or active exploitation confirmed at time of analysis.
Cross-site scripting in the Ninja Forms File Uploads Extension for WordPress (versions up to and including 3.3.26) allows unauthenticated remote attackers to inject malicious scripts that execute in the browser of any user who views the affected content. The scope change (S:C) indicates the injected payload runs in the victim's browser context rather than the server, enabling session theft, credential harvesting, or UI redressing against site visitors or administrators. No public exploit code has been identified at time of analysis, though the Patchstack advisory provides sufficient detail for researchers to reproduce the issue.
Unauthenticated cross-site scripting (XSS) in the Calculation For Contact Form 7 WordPress plugin (all versions up to and including 1.0) allows a remote unauthenticated attacker to inject malicious scripts into pages viewed by other users. With no privileges required and a scope change confirmed by the CVSS vector (S:C), a successful exploit executes arbitrary JavaScript in the victim's browser context, enabling session hijacking, credential harvesting, or UI redressing. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity makes opportunistic targeting straightforward once a vulnerable site is discovered.
Unauthenticated cross-site scripting in the Under Construction WordPress plugin (versions ≤ 5.82) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to follow a crafted URL. The scope-change vector (S:C) confirms the payload executes in the browser's security context, enabling session token theft, credential harvesting, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement lowers the bar for abuse significantly.
Cross-site scripting in the Simple Payment WordPress plugin (versions ≤ 2.5.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, including site administrators. The scope-changed CVSS vector (S:C) indicates the injected script executes outside the plugin's own origin - enabling session hijacking, credential theft, or administrative actions executed on the victim's behalf. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/JavaScript in the notification template (endpoint /ocsreports/?function=notification) that executes in the browser of any other administrator who opens the template customisation view. The injected script runs in the application's security context, enabling session hijacking or privileged actions against fellow admins. Reported by INCIBE; no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total.
Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.
Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102.
Cross-site scripting in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected page. The scope-changing CVSS vector (S:C) confirms that the injected payload can compromise sessions or data belonging to users other than the attacker, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit code has been identified at time of analysis, and no KEV listing is present.
Unauthenticated cross-site scripting in the Estatik real estate WordPress plugin affects all versions up to and including 4.3.4, allowing remote unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS scope-change flag (S:C) indicates the injected script can affect browser sessions beyond the vulnerable component itself - typically enabling session hijacking, credential theft, or unauthorized actions performed on behalf of logged-in administrators. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.
Unauthenticated cross-site scripting in the TrustedSite WordPress plugin (versions <=1.2.5) allows remote attackers without any credentials to inject arbitrary JavaScript into pages served to site visitors or administrators. The CVSS vector designates a scope change (S:C), meaning the injected script executes in the victim's browser context and can affect resources beyond the vulnerable WordPress installation itself - including session cookies and browser-stored credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated entry point and low attack complexity make this a realistic risk on any unpatched deployment.
Reflected Cross-Site Scripting in the Interactive Geo Maps WordPress plugin (versions <= 1.6.30) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to click a crafted URL. The vulnerability carries a CVSS 7.1 with scope change, meaning the injected script executes in the context of the victim's authenticated WordPress session rather than the plugin's own origin. No public exploit or active CISA KEV listing has been identified at time of analysis, though Patchstack has published a vulnerability entry.
Unauthenticated stored or reflected Cross-Site Scripting in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions <= 5.13.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they visit an affected page. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and crosses into the browser security context, making this a meaningful risk on any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has documented the issue.
Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in SiYuan before v3.8.2 enables authenticated users with upload access to bypass the asset extension blocklist by using file types such as .xht, .ehtml, .xsl, .xbl, or .rdf that browsers render as executable documents. When a victim opens or previews the malicious asset, embedded JavaScript runs in the SiYuan application context, allowing theft of API tokens and full workspace compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in v3.8.2.
Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed available as version 2.4.13.1.
Reflected cross-site scripting in the Login With Ajax WordPress plugin (versions through 4.5.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The scope change in the CVSS vector (S:C) reflects the XSS payload executing outside the origin context, enabling session theft, credential harvesting, or DOM manipulation against authenticated WordPress users. No public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.
Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.
Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists via WPScan, and a vendor-released patch (6.0.9.9) is confirmed available.