XSS
Monthly
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
Stored XSS in Sulu CMS prior to versions 2.6.25 and 3.0.8 allows an authenticated attacker with media upload permissions to execute attacker-controlled JavaScript in a victim's browser on the Sulu origin. By uploading an HTML, XHTML, or XML file and crafting a download URL with the inline=1 query parameter, the attacker bypasses the expected Content-Disposition: attachment behavior, causing the browser to render the document instead of downloading it. When an authenticated victim opens the crafted link, the attacker's JavaScript executes with full access to the victim's Sulu-origin session and can read sensitive data or perform privileged actions on the victim's behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful risk for all unpatched Livewire deployments.
Cross-site scripting in Typora's embedded Mermaid rendering engine allows remote attackers to inject and execute arbitrary JavaScript by manipulating the `classDef` or `style` arguments within Mermaid diagram syntax. Affected versions include all Typora releases up to 1.13.8 and 1.14.6; a publicly available proof-of-concept exploit exists on GitHub. Exploitation requires passive user interaction (opening or previewing a crafted file), and no authentication is needed from the attacker, making social-engineering delivery via shared documents or email a realistic threat vector. No active exploitation is confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in code-projects Online Shopping System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email parameter of the Newsletter Subscription component at /offersmail.php. When a privileged user such as an administrator views stored subscription data, the injected payload executes in their browser. A public proof-of-concept is confirmed via GitHub; the vulnerability has not been listed in the CISA KEV catalog, and the CVSS 4.0 score of 2.1 reflects the constrained real-world impact due to required user interaction and a low integrity-only impact ceiling.
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. No public exploit has been identified and there is no CISA KEV listing, but the attack is trivially reproducible given the unsanitized rendering pipeline confirmed by source code evidence.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. A working proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbitrary JavaScript in the browsers of users who render Select schema components. The Select plugin's UI renderer interpolates template-controlled option values directly into an innerHTML assignment without HTML encoding, meaning a value containing `">` breaks out of the attribute context and injects arbitrary HTML and event handlers. A detailed proof-of-concept is publicly documented in GHSA-qq9g-96v4-m3cj; no active exploitation is recorded in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. No active exploitation is confirmed, but a proof-of-concept is published in the GHSA advisory. The CVSS 4.0 score of 2.1 reflects multiple required preconditions: attacker control over labels configuration, a specific UI trigger state, and passive victim interaction.
Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. The vendor addressed this by adding a valid CSP to the default image; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in yaojingang GEOFlow through version 2.1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript via the Search argument in the JSON-LD Theme Handler (app/Http/Controllers/Site/HomeController.php). Exploitation requires passive user interaction - a victim must follow a crafted link - limiting the attack to phishing and session-hijacking scenarios. A public proof-of-concept has been disclosed via GitHub issue #60, and vendor-released patch v2.1.1 is available.
Cross-site scripting in Apache Wicket's AbstractSingleSelectChoice base class allows injection of unescaped HTML into the default/null option of DropDownChoice form elements. Affected versions span all supported Wicket branches from 8.0.0 through 10.10.0, as well as unsupported releases back to 1.5.0. An attacker who can influence the value returned by the overridden getNullValidDisplayValue() or getNullKeyDisplayValue() methods, or who controls the relevant resource bundle entries, can execute arbitrary JavaScript in a victim user's browser. No public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's Palette component allows injection of arbitrary HTML attributes into rendered `<option>` tags when applications override specific attribute-extension methods with attacker-influenced data. Affected are `wicket-extensions` versions spanning the 8.x, 9.x, and 10.x release lines; applications relying on the default method implementations are definitively not affected. Vendor-released patches are available at versions 8.19.0, 9.24.0, and 10.11.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. Affected release lines span 8.0.0-8.18.0, 9.0.0-9.23.0, and 10.0.0-10.10.0; no public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's AutoLabelTextResolver allows injection of arbitrary markup into web pages when attacker-controlled data reaches a form component's label model via FormComponent#setLabel(IModel). The resolver, registered by default in every WebApplication, writes label values directly into rendered markup without any escaping and ignores the escape-model-strings application setting entirely - meaning there was no available configuration workaround. Applications are vulnerable wherever user-influenced data flows into a label model; this includes both stored XSS (data retrieved from a database) and reflected XSS (data sourced from the current request). No public exploit has been identified at time of analysis, but the vulnerability affects all supported release lines and all unsupported releases from 1.5.0 onwards.
Cross-site scripting in Apache Wicket's Button component allows injection of arbitrary markup into rendered pages when the button is bound to a `<button>` HTML element whose model contains attacker-influenced data. The root cause is an intentional design choice - Button's constructor clears the escape-model-strings flag to prevent double-encoding of `<input>` attribute values - that becomes a security flaw in the `<button>` rendering path, where element body content is never encoded by ComponentTag. Subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the same constructor and are equally affected; no public exploit or CISA KEV listing is recorded at time of analysis.
Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. The root cause is that two distinct rendering paths bypass Wicket's default HTML escaping, and the escapeModelStrings configuration property has no corrective effect on these components. No public exploit has been identified at time of analysis.
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inject persistent JavaScript via the last_name parameter of /register.php during user registration. When an administrator or privileged user subsequently views the registered user list, the stored payload executes in their browser context, enabling session hijacking or credential theft. A public proof-of-concept is available on GitHub; the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited real-world scope.
Stored cross-site scripting in Nokia NSP's workflow application allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other NSP users who view the compromised content. The vulnerability spans a wide range of NSP releases from version 22.3 through 25.11, affecting operators relying on Nokia's network management and orchestration platform. No public exploit code or active exploitation has been identified; SSVC assessment confirms exploitation status as none with a non-automatable attack path.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
Reflected cross-site scripting in SeaCMS up to version 13.6 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session via the `errtxt` parameter of `/err.php`. Exploitation requires social engineering to deliver a crafted URL to a target user; no privileges or prior authentication are needed. A public proof-of-concept exploit exists on GitHub, raising the likelihood of opportunistic abuse against sites running unpatched SeaCMS installations.
Reflected XSS in TechStore 1.0 contact_display endpoint allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by embedding a malicious payload in the `id` URL parameter, which the application echoes verbatim into the rendered HTML. The CVSS Scope:Changed metric confirms cross-origin browser-level impact, enabling session theft, credential harvesting, or DOM manipulation against any user who clicks a crafted link. No active exploitation is confirmed via CISA KEV; a public proof-of-concept exists on GitHub at the referenced gist, and EPSS at 0.16% (6th percentile) reflects low current exploitation activity.
Stored XSS in QD (versions 20220208-20250803) allows a low-privileged authenticated attacker to inject arbitrary JavaScript into the task execution log output, which then executes in a victim user's browser when they trigger the affected task run. The injection path runs through HAR template variables - specifically the `__log__` field populated via the `extract_variables` mechanism and the `api://util/unicode` endpoint - which are rendered unsanitized into HTML via Python `%` string formatting in `TaskRunHandler.post()`. A public POC is available via GitHub Gist; no patch version has been confirmed at time of analysis.
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Reflected cross-site scripting in SourceCodester Queue Management System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the unvalidated `Name` parameter of `/api/add_customer.php`. The flaw (CWE-79) stems from PHP output rendered without encoding, enabling script execution in a victim's browser when a crafted URL is visited. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub.
Reflected cross-site scripting in WWBN AVideo's url2Embed.json.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session. The attack is distinctive because the malicious payload is delivered as an encrypted evideo parameter, enabling the crafted link to originate from the target site's own domain and bypass naive URL-reputation checks. Successful exploitation enables session cookie theft and CSRF token harvesting, facilitating account takeover. No public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in the Beetel 450TC3 router's User Management component allows a low-privileged authenticated attacker to inject persistent malicious scripts via the Username field. Any administrator who subsequently views the User Management page triggers execution of the stored payload in their browser context. A public proof-of-concept exploit is available on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
Stored cross-site scripting in Coppermine Photo Gallery up to 1.6.28 allows an authenticated attacker to inject persistent malicious scripts via the Hidden Album Update Endpoint in db_input.php, which execute in the browsers of other users who view the affected album. The public proof-of-concept (stored_xss_album_desc.md on GitHub) confirms exploitation via the album description field. No active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects limited server-side impact, though browser-side session hijacking remains a realistic outcome.
Stored cross-site scripting in Coppermine Photo Gallery up to version 1.6.28 allows an authenticated user to inject malicious JavaScript into the Biography field of the edit_profile endpoint in profile.php, which executes in the browser of any user who subsequently views that profile. A public proof-of-concept exploit is available on GitHub (Leousum/VulnPoC), and the vendor has released version 1.6.29 to remediate the issue. No active exploitation is confirmed in the CISA KEV catalog, but the PoC lowers the practical barrier to abuse significantly.
Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. No confirmed active exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
Stored XSS in the silverstripe/versioned package allows a CMS user with content-creation rights to execute arbitrary JavaScript in an administrator's browser by embedding a malicious payload in a page title that is rendered without escaping during the ArchiveAdmin restore workflow. All versions prior to 3.2.1 are affected. No active exploitation or standalone public exploit has been identified, though the patch PR includes working test payloads confirming the mechanism.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.
DOM-based cross-site scripting in Yamcs's /ext URL routing endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL - typically via phishing. The vulnerability exists in extension.component.ts, where URL path segments are inserted into the DOM via innerHTML without validation against legitimate custom element names, allowing injected HTML event handlers to fire. Vendor-released patches are available in yamcs-5.12.8 and yamcs-5.13.2; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Reflected XSS in Yamcs versions through 5.8.6 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a logged-in user's browser by delivering a specially crafted URL targeting the OAuth authorization endpoint. Exploitation exfiltrates the victim's session and refresh tokens to an attacker-controlled server, enabling complete account takeover. No public exploit identified at time of analysis independent of the advisory, though GHSA-rxpg-wjf8-qv9c includes a working reproduction payload with exact URL and netcat listener steps; vendor patch is available in 5.9.4 (CVSS 6.5, UI:R).
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing; the threat is opportunistic phishing-driven rather than mass exploitation.
Reflected XSS in Dayneks Software Industry and Trade Inc.'s E-Commerce Platform (all versions through 28082026) allows unauthenticated remote attackers to inject and execute malicious scripts in victim browsers by delivering crafted URLs. The vulnerability, rooted in CWE-79 unsanitized input reflection, enables session hijacking, credential theft, or malicious redirection within the e-commerce site's origin context. No vendor patch is available; the vendor did not respond to TR-CERT's coordinated disclosure, leaving operators without an official remediation path.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Reflected XSS in the All Video Share Joomla extension (versions 1.0.0 through 4.5.0) exposes site visitors to script injection attacks when they interact with attacker-crafted URLs. Multiple user-supplied input parameters are rendered in HTTP responses without HTML encoding, providing several distinct reflected XSS entry points. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists.
Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis.
Stored cross-site scripting in All-in-One WP Migration Unlimited Extension (all versions up to and including 2.84) allows any authenticated WordPress user with Subscriber-level access to plant persistent JavaScript payloads via the ai1wm_backups_path parameter, which execute in the administrator's browser context when the plugin settings page is visited. Two compounding weaknesses drive the flaw: absent input sanitization on the parameter and missing authorization checks on the settings() function, permitting low-privileged users to write attacker-controlled data into plugin configuration. A partial fix was shipped in version 2.84 but a fully remediated release has not been confirmed, and no public exploit code has been identified at time of analysis.
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.
Stored Cross-Site Scripting in ElementsKit Pro for WordPress allows unauthenticated attackers to persistently inject arbitrary JavaScript via the Advanced Search REST endpoint, affecting all versions through 4.10.1. The flaw combines an authentication bypass (permission_callback set to __return_true) with inadequate output escaping: sanitize_text_field() permits double-quote characters to pass through, and stored keywords are later rendered into HTML attributes using sprintf() without esc_attr(), enabling attribute injection. Unlike reflected XSS, this stored variant poisons the site globally - every visitor who triggers the 'no results' state on any page using the Advanced Search widget executes the injected payload. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated contributors to permanently embed malicious JavaScript in page content via the 'size' shortcode attribute. The root bypass is structural: WordPress's wp_kses_post filter only inspects HTML angle-bracket constructs, so payloads confined entirely to a shortcode attribute string pass the filter unchanged at save time and execute in any visitor's browser. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the Scope:Changed CVSS designation reflects that successful injection escalates attacker influence from the contributor's own context into the browsers of higher-privileged users, including site administrators.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. No public exploit code or CISA KEV listing has been identified; the primary real-world risk is insider-threat or compromised-contributor scenarios leading to privileged account takeover.
Stored Cross-Site Scripting in the Spiffy Calendar WordPress plugin (before version 5.0.9) allows an authenticated attacker holding the lowest standard WordPress role (contributor) to inject malicious script via the Event Title field. When a higher-privileged user - such as an administrator or editor - subsequently views the affected event listing, the payload executes in their browser context, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. EPSS is 0.15% (4th percentile) and no active exploitation has been identified at time of analysis.
Cross-site scripting in oPanel's DNS lookup and management component before v1.20.25 allows a remote unauthenticated attacker who controls any DNS zone to inject arbitrary JavaScript into an authenticated panel user's browser session by poisoning a DNS TXT record with a crafted payload. When a panel user performs a DNS lookup on the attacker-controlled domain, the unsanitized TXT record value executes in the victim's browser context, enabling session token theft and full account takeover. A public proof-of-concept is available on GitHub; the vulnerability is not in CISA KEV and EPSS sits at 0.37%, indicating low automated exploitation probability but a documented and accessible attack technique.
Stored Cross-Site Scripting in the Bit Assist WordPress plugin (versions before 1.7.2) allows an authenticated administrator to inject persistent malicious scripts via the Call-To-Action feature. When other users or administrators visit affected pages, the injected payload executes in their browser context, enabling session hijacking, credential theft, or forced redirection to attacker-controlled sites. No public exploit or CISA KEV listing is confirmed at time of analysis; EPSS of 0.15% (4th percentile) reflects very low observed exploitation probability.
Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.
Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.
Stored XSS in WatchGuard Dimension's Trusted CA certificate configuration enables an authenticated administrator to inject persistent JavaScript that executes in the browser of other authenticated administrators. The attack requires high-privilege access to the management console to plant the payload and passive interaction from a victim administrator to trigger it, constraining the threat to insider abuse or compromised admin accounts. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.8 reflects the limited, intra-admin scope.
Stored cross-site scripting in WatchGuard Dimension's Backup Historical Data feature permits an authenticated administrator to inject arbitrary JavaScript that executes in the browser context of other users who view the affected data. The CVSS 4.0 vector (PR:H, SC:L/SI:L) confirms the attacker must hold admin credentials and that impact is confined to subsequent systems - other users' browser sessions - with no direct impact on the Dimension host itself. No public exploit code and no CISA KEV listing exist at time of analysis.
Reflected XSS in WatchGuard Dimension's report detail page allows arbitrary JavaScript execution in the browser of an authenticated victim when they follow a specially crafted URL. The vulnerability requires social engineering an already-authenticated Dimension user - likely an administrator, given the CVSS 4.0 PR:H rating - into clicking an attacker-controlled link, constraining the attack to targeted phishing scenarios against active sessions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not provided in the source intelligence.
Stored XSS in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject persistent JavaScript into scheduling fields, which silently executes in the browser session of any other user who subsequently views the affected interface. Unlike reflected XSS, the stored nature of this vulnerability means a single injection can compromise multiple sessions without further attacker interaction, including those of higher-privileged administrators. No public exploit code or active exploitation has been identified at the time of analysis.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Stored XSS in Frappe's workspace link description feature (versions 15.11.0-16.32.0) allows any user holding the Workspace Manager role to inject arbitrary JavaScript into a public workspace card, which executes in the browser session of any desk user who opens the workspace and hovers over the card description. The attack path reaches higher-privileged users through shared public workspaces, enabling session token theft and impersonation via authenticated API requests as the victim. No released version carries the fix; the upstream correction exists only on the development branch per commit 9f65e5ceca71aae91dcfd9bb3c0904afd386a01a, leaving all 15.x and 16.x deployments exposed.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Reflected XSS in doggo's Phoenix date field component (versions 0.1.0 through 0.14.7) allows network-accessible, unauthenticated attackers to inject HTML into the rendered page when a form validation failure re-renders a user-supplied date value. The root cause is `Doggo.normalize_value/2` wrapping the raw user input in Phoenix.HTML's `{:safe, ...}` marker - bypassing the framework's built-in escaping - before emitting it verbatim into the `value` attribute of the generated `<input>` element. Payloads are constrained to ten bytes by the original truncation logic, which prevents full inline script injection but still permits attribute-breaking strings (e.g., `" onload=x`) sufficient to attach short event handlers. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor patch is available in doggo 0.14.8.
Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.
Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.
Reflected XSS in Netron desktop application versions ≤9.1.2 executes attacker-controlled JavaScript when a victim opens a crafted neural network model file containing malicious node names, type labels, or value descriptions. Because Netron runs on Electron (a Chromium-based runtime), the injected script operates within a privileged renderer process capable of port-scanning local networks and, with a separately-acquired Chrome n-day, achieving full remote code execution on the host machine. HiddenLayer reported the vulnerability and a vendor fix is available via GitHub commit cd14bad8c91; no public standalone exploit has been confirmed and this CVE does not appear in CISA KEV.
Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. No public exploit code has been identified at time of analysis, and the product has no CISA KEV listing.
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inject arbitrary HTML into case timelines by supplying malicious content in MISP object fields - including UUID, object name, attribute values, types, comments, first/last seen timestamps, and IDS flags. These fields were concatenated directly into HTML strings without escaping; although DOMPurify was present, the upstream commit explicitly acknowledges it blocked script-based XSS vectors but still permitted other HTML elements such as forms to pass through. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-site scripting (Cross Zone Scripting variant) in BilPark Informatics Technologies' DoXBASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser, affecting all versions through 27082026. The CVSS 3.1 score of 6.1 reflects network-based exploitation requiring victim interaction, with a changed scope indicating the injected script executes across browser security zones. No patch is available and the vendor did not respond to TR-CERT's disclosure, leaving organizations with no official remediation path.
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-creation or case-editing privileges to inject arbitrary HTML or JavaScript into case titles, which is then executed in the browser of any user who views the calendar. The root cause is unsanitized assignment of user-controlled strings to titleEl.innerHTML. No public exploit has been identified at time of analysis, but the fix is available as an upstream commit and the vulnerability is straightforward to reproduce by any authenticated user.
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious JavaScript via crafted Mermaid diagram blocks, which executes in the browser of any user who subsequently views the affected note. Affected are Flowintel deployments running version 3.3.0 and later; the CVSS 4.0 score of 5.1 reflects that exploitation requires both an authenticated session with note-edit rights and passive victim interaction. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Reflected XSS in Joomla Events Manager versions prior to 5.0.1 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser via a crafted PDF export URL. The root cause is in `buildCurrentPdfLink`, which blindly copies the raw HTTP request query string into a PDF button URL, and `pdfbutton()` subsequently renders that value in HTML without any output escaping. Exploitation requires social engineering to lure an authenticated or unauthenticated Joomla site visitor into clicking a malicious link; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, but the changed-scope CVSS vector reflects the elevated risk of token and session theft in OAuth2 flows.
Stored cross-site scripting in CMP WordPress plugin before version 4.1.18 allows Editor-role users - only when an administrator has explicitly delegated CMP admin-bar control access to them - to persist malicious scripts in the coming-soon page settings field. Any visitor who subsequently loads the coming-soon page executes the injected script in their browser. No public exploit code exists, EPSS stands at 0.15% (5th percentile), and SSVC marks exploitation as none, confirming this as a low-probability risk that is inert on standard WordPress installations lacking the non-default Editor delegation.
Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.
Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.
Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.
Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.
Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.
Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.
Stored XSS in Sulu CMS prior to versions 2.6.25 and 3.0.8 allows an authenticated attacker with media upload permissions to execute attacker-controlled JavaScript in a victim's browser on the Sulu origin. By uploading an HTML, XHTML, or XML file and crafting a download URL with the inline=1 query parameter, the attacker bypasses the expected Content-Disposition: attachment behavior, causing the browser to render the document instead of downloading it. When an authenticated victim opens the crafted link, the attacker's JavaScript executes with full access to the victim's Sulu-origin session and can read sensitive data or perform privileged actions on the victim's behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.
Prototype pollution in Livewire's client-side query-string parser enables reflected cross-site scripting against applications running versions 3.0.0-beta.1 through 3.8.2 or 4.0.0 through 4.3.3. The dot-notated URL parser in js/plugins/history/index.js accepts __proto__, constructor, and prototype as path segments, injecting attacker-controlled values into Object.prototype; multiple effect handlers then read effects.html, effects.js, effects.xjs, and effects.scripts without hasOwnProperty guards, treating inherited values as trusted server-delivered directives and executing arbitrary JavaScript in the application's origin. No public exploit or CISA KEV listing has been identified at time of analysis, but the network-accessible attack surface and zero-privilege requirement make this a meaningful risk for all unpatched Livewire deployments.
Cross-site scripting in Typora's embedded Mermaid rendering engine allows remote attackers to inject and execute arbitrary JavaScript by manipulating the `classDef` or `style` arguments within Mermaid diagram syntax. Affected versions include all Typora releases up to 1.13.8 and 1.14.6; a publicly available proof-of-concept exploit exists on GitHub. Exploitation requires passive user interaction (opening or previewing a crafted file), and no authentication is needed from the attacker, making social-engineering delivery via shared documents or email a realistic threat vector. No active exploitation is confirmed in CISA KEV at time of analysis.
Stored cross-site scripting in code-projects Online Shopping System 1.0 allows unauthenticated remote attackers to inject malicious scripts via the email parameter of the Newsletter Subscription component at /offersmail.php. When a privileged user such as an administrator views stored subscription data, the injected payload executes in their browser. A public proof-of-concept is confirmed via GitHub; the vulnerability has not been listed in the CISA KEV catalog, and the CVSS 4.0 score of 2.1 reflects the constrained real-world impact due to required user interaction and a low integrity-only impact ceiling.
Stored cross-site scripting in Aix-DB through version 1.2.4 allows authenticated low-privilege users to inject persistent malicious HTML and JavaScript into chat responses, skill descriptions, or knowledge messages, which then execute in other users' browsers when the content is viewed. The root cause is two separate rendering paths - a markdown-it component and a marked-based knowledge view - that both pass rendered HTML directly into Vue.js v-html bindings without sanitization. No public exploit has been identified and there is no CISA KEV listing, but the attack is trivially reproducible given the unsanitized rendering pipeline confirmed by source code evidence.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows execution of arbitrary JavaScript in users' browsers via unsanitized SVG content rendered directly to innerHTML. The SVG schema plugin's viewer and readOnly form modes assign raw SVG markup to container.innerHTML without stripping script elements, event handler attributes, or foreignObject payloads. A working proof-of-concept is published in the GHSA advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.9 allows any party who can supply a malicious template to execute arbitrary JavaScript in the browsers of users who render Select schema components. The Select plugin's UI renderer interpolates template-controlled option values directly into an innerHTML assignment without HTML encoding, meaning a value containing `">` breaks out of the attribute context and injects arbitrary HTML and event handlers. A detailed proof-of-concept is publicly documented in GHSA-qq9g-96v4-m3cj; no active exploitation is recorded in CISA KEV at time of analysis.
Cross-site scripting in @pdfme/schemas before 5.5.10 allows an attacker who can supply the Designer's options.labels configuration to execute arbitrary JavaScript in the browser of any user who opens the Designer and selects a multiVariableText field containing no variable placeholders. The vulnerable sink at propPanel.ts:65-71 concatenates i18n-translated strings directly into innerHTML without HTML encoding; while the adjacent color value is allowlist-validated (showing existing security awareness), the label strings were overlooked. No active exploitation is confirmed, but a proof-of-concept is published in the GHSA advisory. The CVSS 4.0 score of 2.1 reflects multiple required preconditions: attacker control over labels configuration, a specific UI trigger state, and passive victim interaction.
Stored cross-site scripting in the Venueless default Docker image allows a low-privileged authenticated user to upload an SVG file containing executable JavaScript, which executes in the browser of any user who subsequently views the file. The root cause is absent Content Security Policy enforcement combined with unfiltered SVG delivery, classified as CWE-80. The vendor addressed this by adding a valid CSP to the default image; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected cross-site scripting in yaojingang GEOFlow through version 2.1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript via the Search argument in the JSON-LD Theme Handler (app/Http/Controllers/Site/HomeController.php). Exploitation requires passive user interaction - a victim must follow a crafted link - limiting the attack to phishing and session-hijacking scenarios. A public proof-of-concept has been disclosed via GitHub issue #60, and vendor-released patch v2.1.1 is available.
Cross-site scripting in Apache Wicket's AbstractSingleSelectChoice base class allows injection of unescaped HTML into the default/null option of DropDownChoice form elements. Affected versions span all supported Wicket branches from 8.0.0 through 10.10.0, as well as unsupported releases back to 1.5.0. An attacker who can influence the value returned by the overridden getNullValidDisplayValue() or getNullKeyDisplayValue() methods, or who controls the relevant resource bundle entries, can execute arbitrary JavaScript in a victim user's browser. No public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's Palette component allows injection of arbitrary HTML attributes into rendered `<option>` tags when applications override specific attribute-extension methods with attacker-influenced data. Affected are `wicket-extensions` versions spanning the 8.x, 9.x, and 10.x release lines; applications relying on the default method implementations are definitively not affected. Vendor-released patches are available at versions 8.19.0, 9.24.0, and 10.11.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Apache Wicket's MetaDataHeaderItem class allows injection of arbitrary HTML attributes into generated <meta> and <link> header tags when applications pass attacker-influenced data to the addTagAttribute, forMetaTag, or forLinkTag APIs. The flawed escaping logic - replacing double-quote characters with backslash-double-quote, which carries no escaping semantics in HTML - permits a double-quote in an attacker-controlled value to break out of the attribute context and inject additional attributes such as JavaScript event handlers. Affected release lines span 8.0.0-8.18.0, 9.0.0-9.23.0, and 10.0.0-10.10.0; no public exploit has been identified at time of analysis.
Cross-site scripting in Apache Wicket's AutoLabelTextResolver allows injection of arbitrary markup into web pages when attacker-controlled data reaches a form component's label model via FormComponent#setLabel(IModel). The resolver, registered by default in every WebApplication, writes label values directly into rendered markup without any escaping and ignores the escape-model-strings application setting entirely - meaning there was no available configuration workaround. Applications are vulnerable wherever user-influenced data flows into a label model; this includes both stored XSS (data retrieved from a database) and reflected XSS (data sourced from the current request). No public exploit has been identified at time of analysis, but the vulnerability affects all supported release lines and all unsupported releases from 1.5.0 onwards.
Cross-site scripting in Apache Wicket's Button component allows injection of arbitrary markup into rendered pages when the button is bound to a `<button>` HTML element whose model contains attacker-influenced data. The root cause is an intentional design choice - Button's constructor clears the escape-model-strings flag to prevent double-encoding of `<input>` attribute values - that becomes a security flaw in the `<button>` rendering path, where element body content is never encoded by ComponentTag. Subclasses AjaxButton, AjaxFallbackButton, and WizardButton inherit the same constructor and are equally affected; no public exploit or CISA KEV listing is recorded at time of analysis.
Cross-site scripting vulnerabilities in Apache Wicket's AjaxEditableChoiceLabel and related wicket-extensions components allow an attacker who can influence rendered choice or model data to inject arbitrary HTML or JavaScript into page markup, executing in the browser of any user viewing the affected page. Versions 8.0.0 through 8.18.0, 9.0.0 through 9.23.0, and 10.0.0 through 10.10.0 of the org.apache.wicket:wicket-extensions module are confirmed affected. The root cause is that two distinct rendering paths bypass Wicket's default HTML escaping, and the escapeModelStrings configuration property has no corrective effect on these components. No public exploit has been identified at time of analysis.
Stored cross-site scripting in code-projects Simple Inventory System 1.0 allows remote unauthenticated attackers to inject persistent JavaScript via the last_name parameter of /register.php during user registration. When an administrator or privileged user subsequently views the registered user list, the stored payload executes in their browser context, enabling session hijacking or credential theft. A public proof-of-concept is available on GitHub; the vulnerability is not listed in CISA KEV and carries a CVSS 4.0 score of 2.1 reflecting limited real-world scope.
Stored cross-site scripting in Nokia NSP's workflow application allows an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other NSP users who view the compromised content. The vulnerability spans a wide range of NSP releases from version 22.3 through 25.11, affecting operators relying on Nokia's network management and orchestration platform. No public exploit code or active exploitation has been identified; SSVC assessment confirms exploitation status as none with a non-automatable attack path.
Stored cross-site scripting in code-projects Employee Leave Managing System 1.0 allows an authenticated low-privilege employee to inject persistent malicious script via the Name parameter in the Employee Profile Update endpoint (/EmpManageSys/editaction.php). When a privileged user such as an HR administrator subsequently views the tampered employee profile, the payload executes in their browser, enabling session hijacking or unauthorized administrative actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists, so confirmed in-the-wild exploitation is not established at time of analysis.
Reflected cross-site scripting in SeaCMS up to version 13.6 allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session via the `errtxt` parameter of `/err.php`. Exploitation requires social engineering to deliver a crafted URL to a target user; no privileges or prior authentication are needed. A public proof-of-concept exploit exists on GitHub, raising the likelihood of opportunistic abuse against sites running unpatched SeaCMS installations.
Reflected XSS in TechStore 1.0 contact_display endpoint allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by embedding a malicious payload in the `id` URL parameter, which the application echoes verbatim into the rendered HTML. The CVSS Scope:Changed metric confirms cross-origin browser-level impact, enabling session theft, credential harvesting, or DOM manipulation against any user who clicks a crafted link. No active exploitation is confirmed via CISA KEV; a public proof-of-concept exists on GitHub at the referenced gist, and EPSS at 0.16% (6th percentile) reflects low current exploitation activity.
Stored XSS in QD (versions 20220208-20250803) allows a low-privileged authenticated attacker to inject arbitrary JavaScript into the task execution log output, which then executes in a victim user's browser when they trigger the affected task run. The injection path runs through HAR template variables - specifically the `__log__` field populated via the `extract_variables` mechanism and the `api://util/unicode` endpoint - which are rendered unsanitized into HTML via Python `%` string formatting in `TaskRunHandler.post()`. A public POC is available via GitHub Gist; no patch version has been confirmed at time of analysis.
Cross-site request forgery protection bypasses in Apache Wicket's ResourceIsolationRequestCycleListener allow network attackers to execute authenticated listener actions - link callbacks, form submits, behavior endpoints - on behalf of logged-in users across versions 9.1.0-9.23.0 and 10.0.0-10.10.0. The default FetchMetadataResourceIsolationPolicy incorrectly permits cross-site top-level GET navigations (exploitable because Wicket routes Link.onClick() and form callbacks through ordinary browser navigations) and unconditionally trusts Sec-Fetch-Site: same-site requests from sibling origins - both vectors deliver the victim's SameSite=Lax session cookie to the targeted listener. No public exploit has been identified at time of analysis; vendor-released patches are available in versions 9.24.0 and 10.11.0.
Reflected cross-site scripting in SourceCodester Queue Management System 1.0 allows unauthenticated remote attackers to inject arbitrary JavaScript via the unvalidated `Name` parameter of `/api/add_customer.php`. The flaw (CWE-79) stems from PHP output rendered without encoding, enabling script execution in a victim's browser when a crafted URL is visited. No public KEV listing exists, but a proof-of-concept exploit is publicly available on GitHub.
Reflected cross-site scripting in WWBN AVideo's url2Embed.json.php endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser session. The attack is distinctive because the malicious payload is delivered as an encrypted evideo parameter, enabling the crafted link to originate from the target site's own domain and bypass naive URL-reputation checks. Successful exploitation enables session cookie theft and CSRF token harvesting, facilitating account takeover. No public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in the Beetel 450TC3 router's User Management component allows a low-privileged authenticated attacker to inject persistent malicious scripts via the Username field. Any administrator who subsequently views the User Management page triggers execution of the stored payload in their browser context. A public proof-of-concept exploit is available on GitHub; no vendor patch has been issued and the vendor did not respond to responsible disclosure.
Stored cross-site scripting in Coppermine Photo Gallery up to 1.6.28 allows an authenticated attacker to inject persistent malicious scripts via the Hidden Album Update Endpoint in db_input.php, which execute in the browsers of other users who view the affected album. The public proof-of-concept (stored_xss_album_desc.md on GitHub) confirms exploitation via the album description field. No active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects limited server-side impact, though browser-side session hijacking remains a realistic outcome.
Stored cross-site scripting in Coppermine Photo Gallery up to version 1.6.28 allows an authenticated user to inject malicious JavaScript into the Biography field of the edit_profile endpoint in profile.php, which executes in the browser of any user who subsequently views that profile. A public proof-of-concept exploit is available on GitHub (Leousum/VulnPoC), and the vendor has released version 1.6.29 to remediate the issue. No active exploitation is confirmed in the CISA KEV catalog, but the PoC lowers the practical barrier to abuse significantly.
Stored XSS in the MW WP Form WordPress plugin (all versions before 5.1.6) lets authenticated users holding the Editor role or above inject persistent malicious JavaScript into form settings, which then executes in the browser of any administrator who views the affected dashboard page. A publicly available proof-of-concept has been published by WPScan, though EPSS sits at 0.15% (5th percentile), indicating low measured exploitation probability at this time. No confirmed active exploitation has been reported and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in the SOGO Add Script to Individual Pages Header Footer WordPress plugin (through version 3.9) enables any contributor-level WordPress user to inject arbitrary JavaScript into per-post header and footer script fields without sanitization or capability gating. The payload executes in an administrator's browser when reviewing the pending post, enabling session hijacking and full site takeover, and persists for all site visitors once the post is published. A publicly available proof-of-concept exists per WPScan, though EPSS remains at 0.15% (5th percentile) and there is no CISA KEV listing, indicating limited opportunistic exploitation to date.
Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in the User Profile Builder WordPress plugin (versions before 4.0.1) allows users with contributor-level WordPress roles to embed persistent JavaScript via an improperly escaped optional shortcode, executing in the browser of any user who views the affected content - including administrators. A publicly available exploit exists per WPScan intelligence, though EPSS remains at 0.15% (5th percentile) and the vulnerability is absent from CISA's KEV catalog. The non-default shortcode requirement meaningfully limits exposure to sites that have explicitly enabled the affected feature.
Stored XSS in the silverstripe/versioned package allows a CMS user with content-creation rights to execute arbitrary JavaScript in an administrator's browser by embedding a malicious payload in a page title that is rendered without escaping during the ArchiveAdmin restore workflow. All versions prior to 3.2.1 are affected. No active exploitation or standalone public exploit has been identified, though the patch PR includes working test payloads confirming the mechanism.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.
Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.
DOM-based cross-site scripting in Yamcs's /ext URL routing endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL - typically via phishing. The vulnerability exists in extension.component.ts, where URL path segments are inserted into the DOM via innerHTML without validation against legitimate custom element names, allowing injected HTML event handlers to fire. Vendor-released patches are available in yamcs-5.12.8 and yamcs-5.13.2; no public exploit code or CISA KEV listing has been confirmed at time of analysis.
Reflected XSS in Yamcs versions through 5.8.6 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a logged-in user's browser by delivering a specially crafted URL targeting the OAuth authorization endpoint. Exploitation exfiltrates the victim's session and refresh tokens to an attacker-controlled server, enabling complete account takeover. No public exploit identified at time of analysis independent of the advisory, though GHSA-rxpg-wjf8-qv9c includes a working reproduction payload with exact URL and netcat listener steps; vendor patch is available in 5.9.4 (CVSS 6.5, UI:R).
Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing; the threat is opportunistic phishing-driven rather than mass exploitation.
Reflected XSS in Dayneks Software Industry and Trade Inc.'s E-Commerce Platform (all versions through 28082026) allows unauthenticated remote attackers to inject and execute malicious scripts in victim browsers by delivering crafted URLs. The vulnerability, rooted in CWE-79 unsanitized input reflection, enables session hijacking, credential theft, or malicious redirection within the e-commerce site's origin context. No vendor patch is available; the vendor did not respond to TR-CERT's coordinated disclosure, leaving operators without an official remediation path.
Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.
Reflected XSS in the All Video Share Joomla extension (versions 1.0.0 through 4.5.0) exposes site visitors to script injection attacks when they interact with attacker-crafted URLs. Multiple user-supplied input parameters are rendered in HTTP responses without HTML encoding, providing several distinct reflected XSS entry points. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists.
Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis.
Stored cross-site scripting in All-in-One WP Migration Unlimited Extension (all versions up to and including 2.84) allows any authenticated WordPress user with Subscriber-level access to plant persistent JavaScript payloads via the ai1wm_backups_path parameter, which execute in the administrator's browser context when the plugin settings page is visited. Two compounding weaknesses drive the flaw: absent input sanitization on the parameter and missing authorization checks on the settings() function, permitting low-privileged users to write attacker-controlled data into plugin configuration. A partial fix was shipped in version 2.84 but a fully remediated release has not been confirmed, and no public exploit code has been identified at time of analysis.
Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.
Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.
Stored Cross-Site Scripting in ElementsKit Pro for WordPress allows unauthenticated attackers to persistently inject arbitrary JavaScript via the Advanced Search REST endpoint, affecting all versions through 4.10.1. The flaw combines an authentication bypass (permission_callback set to __return_true) with inadequate output escaping: sanitize_text_field() permits double-quote characters to pass through, and stored keywords are later rendered into HTML attributes using sprintf() without esc_attr(), enabling attribute injection. Unlike reflected XSS, this stored variant poisons the site globally - every visitor who triggers the 'no results' state on any page using the Advanced Search widget executes the injected payload. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated contributors to permanently embed malicious JavaScript in page content via the 'size' shortcode attribute. The root bypass is structural: WordPress's wp_kses_post filter only inspects HTML angle-bracket constructs, so payloads confined entirely to a shortcode attribute string pass the filter unchanged at save time and execute in any visitor's browser. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the Scope:Changed CVSS designation reflects that successful injection escalates attacker influence from the contributor's own context into the browsers of higher-privileged users, including site administrators.
Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. No public exploit code or CISA KEV listing has been identified; the primary real-world risk is insider-threat or compromised-contributor scenarios leading to privileged account takeover.
Stored Cross-Site Scripting in the Spiffy Calendar WordPress plugin (before version 5.0.9) allows an authenticated attacker holding the lowest standard WordPress role (contributor) to inject malicious script via the Event Title field. When a higher-privileged user - such as an administrator or editor - subsequently views the affected event listing, the payload executes in their browser context, enabling session hijacking, credential theft, or redirection to attacker-controlled infrastructure. EPSS is 0.15% (4th percentile) and no active exploitation has been identified at time of analysis.
Cross-site scripting in oPanel's DNS lookup and management component before v1.20.25 allows a remote unauthenticated attacker who controls any DNS zone to inject arbitrary JavaScript into an authenticated panel user's browser session by poisoning a DNS TXT record with a crafted payload. When a panel user performs a DNS lookup on the attacker-controlled domain, the unsanitized TXT record value executes in the victim's browser context, enabling session token theft and full account takeover. A public proof-of-concept is available on GitHub; the vulnerability is not in CISA KEV and EPSS sits at 0.37%, indicating low automated exploitation probability but a documented and accessible attack technique.
Stored Cross-Site Scripting in the Bit Assist WordPress plugin (versions before 1.7.2) allows an authenticated administrator to inject persistent malicious scripts via the Call-To-Action feature. When other users or administrators visit affected pages, the injected payload executes in their browser context, enabling session hijacking, credential theft, or forced redirection to attacker-controlled sites. No public exploit or CISA KEV listing is confirmed at time of analysis; EPSS of 0.15% (4th percentile) reflects very low observed exploitation probability.
Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.
Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.
Stored XSS in WatchGuard Dimension's Trusted CA certificate configuration enables an authenticated administrator to inject persistent JavaScript that executes in the browser of other authenticated administrators. The attack requires high-privilege access to the management console to plant the payload and passive interaction from a victim administrator to trigger it, constraining the threat to insider abuse or compromised admin accounts. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.8 reflects the limited, intra-admin scope.
Stored cross-site scripting in WatchGuard Dimension's Backup Historical Data feature permits an authenticated administrator to inject arbitrary JavaScript that executes in the browser context of other users who view the affected data. The CVSS 4.0 vector (PR:H, SC:L/SI:L) confirms the attacker must hold admin credentials and that impact is confined to subsequent systems - other users' browser sessions - with no direct impact on the Dimension host itself. No public exploit code and no CISA KEV listing exist at time of analysis.
Reflected XSS in WatchGuard Dimension's report detail page allows arbitrary JavaScript execution in the browser of an authenticated victim when they follow a specially crafted URL. The vulnerability requires social engineering an already-authenticated Dimension user - likely an administrator, given the CVSS 4.0 PR:H rating - into clicking an attacker-controlled link, constraining the attack to targeted phishing scenarios against active sessions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not provided in the source intelligence.
Stored XSS in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject persistent JavaScript into scheduling fields, which silently executes in the browser session of any other user who subsequently views the affected interface. Unlike reflected XSS, the stored nature of this vulnerability means a single injection can compromise multiple sessions without further attacker interaction, including those of higher-privileged administrators. No public exploit code or active exploitation has been identified at the time of analysis.
Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.
Stored XSS in Frappe's workspace link description feature (versions 15.11.0-16.32.0) allows any user holding the Workspace Manager role to inject arbitrary JavaScript into a public workspace card, which executes in the browser session of any desk user who opens the workspace and hovers over the card description. The attack path reaches higher-privileged users through shared public workspaces, enabling session token theft and impersonation via authenticated API requests as the victim. No released version carries the fix; the upstream correction exists only on the development branch per commit 9f65e5ceca71aae91dcfd9bb3c0904afd386a01a, leaving all 15.x and 16.x deployments exposed.
Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.
Reflected XSS in doggo's Phoenix date field component (versions 0.1.0 through 0.14.7) allows network-accessible, unauthenticated attackers to inject HTML into the rendered page when a form validation failure re-renders a user-supplied date value. The root cause is `Doggo.normalize_value/2` wrapping the raw user input in Phoenix.HTML's `{:safe, ...}` marker - bypassing the framework's built-in escaping - before emitting it verbatim into the `value` attribute of the generated `<input>` element. Payloads are constrained to ten bytes by the original truncation logic, which prevents full inline script injection but still permits attribute-breaking strings (e.g., `" onload=x`) sufficient to attach short event handlers. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor patch is available in doggo 0.14.8.
Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.
Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.
Reflected XSS in Netron desktop application versions ≤9.1.2 executes attacker-controlled JavaScript when a victim opens a crafted neural network model file containing malicious node names, type labels, or value descriptions. Because Netron runs on Electron (a Chromium-based runtime), the injected script operates within a privileged renderer process capable of port-scanning local networks and, with a separately-acquired Chrome n-day, achieving full remote code execution on the host machine. HiddenLayer reported the vulnerability and a vendor fix is available via GitHub commit cd14bad8c91; no public standalone exploit has been confirmed and this CVE does not appear in CISA KEV.
Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. No public exploit code has been identified at time of analysis, and the product has no CISA KEV listing.
Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inject arbitrary HTML into case timelines by supplying malicious content in MISP object fields - including UUID, object name, attribute values, types, comments, first/last seen timestamps, and IDS flags. These fields were concatenated directly into HTML strings without escaping; although DOMPurify was present, the upstream commit explicitly acknowledges it blocked script-based XSS vectors but still permitted other HTML elements such as forms to pass through. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Cross-site scripting (Cross Zone Scripting variant) in BilPark Informatics Technologies' DoXBASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser, affecting all versions through 27082026. The CVSS 3.1 score of 6.1 reflects network-based exploitation requiring victim interaction, with a changed scope indicating the injected script executes across browser security zones. No patch is available and the vendor did not respond to TR-CERT's disclosure, leaving organizations with no official remediation path.
Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-creation or case-editing privileges to inject arbitrary HTML or JavaScript into case titles, which is then executed in the browser of any user who views the calendar. The root cause is unsanitized assignment of user-controlled strings to titleEl.innerHTML. No public exploit has been identified at time of analysis, but the fix is available as an upstream commit and the vulnerability is straightforward to reproduce by any authenticated user.
Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious JavaScript via crafted Mermaid diagram blocks, which executes in the browser of any user who subsequently views the affected note. Affected are Flowintel deployments running version 3.3.0 and later; the CVSS 4.0 score of 5.1 reflects that exploitation requires both an authenticated session with note-edit rights and passive victim interaction. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.
Reflected XSS in Joomla Events Manager versions prior to 5.0.1 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser via a crafted PDF export URL. The root cause is in `buildCurrentPdfLink`, which blindly copies the raw HTTP request query string into a PDF button URL, and `pdfbutton()` subsequently renders that value in HTML without any output escaping. Exploitation requires social engineering to lure an authenticated or unauthenticated Joomla site visitor into clicking a malicious link; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, but the changed-scope CVSS vector reflects the elevated risk of token and session theft in OAuth2 flows.
Stored cross-site scripting in CMP WordPress plugin before version 4.1.18 allows Editor-role users - only when an administrator has explicitly delegated CMP admin-bar control access to them - to persist malicious scripts in the coming-soon page settings field. Any visitor who subsequently loads the coming-soon page executes the injected script in their browser. No public exploit code exists, EPSS stands at 0.15% (5th percentile), and SSVC marks exploitation as none, confirming this as a low-probability risk that is inert on standard WordPress installations lacking the non-default Editor delegation.