XSS
Monthly
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.
Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.
Cross-site scripting in Microsoft SharePoint Server allows an authenticated network attacker to perform spoofing attacks against users by injecting malicious script content into web pages served by the platform. Affected deployments include SharePoint Server Subscription Edition prior to build 16.0.19725.20522 and SharePoint Server 2019 prior to build 16.0.10417.20198. Exploitation requires victim interaction (UI:R) and attacker authentication (PR:L), and no public exploit code or active exploitation has been identified at time of analysis per SSVC data.
Cross-site scripting in Microsoft SharePoint Server enables an authenticated low-privilege attacker to inject malicious scripts into SharePoint content that execute in a victim user's browser, enabling session token theft, credential harvesting, or on-behalf-of actions under the victim's identity. Affected products are SharePoint Server Subscription Edition prior to 16.0.19725.20522 and SharePoint Server 2019 prior to 16.0.10417.20198. Vendor-released patches are available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Activepieces' OAuth callback endpoint `/api/redirect` allows an unauthenticated attacker to steal session tokens or execute authenticated API calls on behalf of logged-in users. Versions prior to 0.83.0 embed the user-supplied `code` query parameter directly inside an inline `<script>` block, enabling script context breakout via closing tag injection - a flaw the public patch commit fully discloses, substantially lowering the barrier to exploit development. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
Cross-site scripting in BlackBerry AtHoc IWS Web Portals allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of an authenticated victim's session. All versions of AtHoc IWS prior to 7.21 HF-734 are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no special attacker privileges are needed, though a user interaction step is required, limiting mass-scale opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privileges to inject arbitrary JavaScript into the application by storing malicious markup in a finding's severity field. Because the frontend JavaScript (js/app.js) interpolates the severity value directly into HTML class attributes and CSS custom property references without sanitization, every subsequent authenticated user who views an affected findings list or report preview executes the injected script in the application's browser origin. No public exploit code has been identified at time of analysis, and no CISA KEV listing was provided; however, the stored nature of the flaw means a single malicious payload persists and silently affects all future report viewers until the database is sanitized.
Stored cross-site scripting in AVideo's user registration flow allows any attacker who can reach the registration form to inject persistent JavaScript via the phone field, which later executes in administrator browsers when the users management page loads. The injected payload is rendered through JavaScript innerHTML in the admin bootgrid component without sanitization, running in the admin's session context and enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck has documented and published an advisory for this vulnerability.
Persistent JavaScript injection in HortusFox 5.9 enables authenticated workspace members to execute arbitrary scripts in the browsers of all users who view affected plant notes, including administrators. The vulnerability stems from Parsedown's Markdown renderer operating without safe mode, allowing raw HTML and script tags embedded in plant notes to pass through to the DOM unescaped. An attacker with workspace membership can harvest session cookies or perform privileged actions on behalf of any user who visits the compromised plant entry. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting in ElkArte Forum 2.0 Beta 1 enables any registered member to persist malicious JavaScript in the cust_blurb and cust_locate profile fields, which render unescaped when administrators view affected profiles. The scope-changing nature of the flaw (CVSS S:C) means the payload executes within an administrator's browser session, creating a realistic path to session hijacking or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation - any registered account suffices - makes this a meaningful risk for forums with open registration.
Cross-site scripting in MISP's cti-transmute library allows an authenticated attacker to inject arbitrary HTML through conversion-table values rendered by the highlight() function. When processing content for search highlighting, the function inserted conversion data directly into an HTML sink without escaping special characters such as <, >, &, and quotes, allowing malicious markup embedded in CTI conversion data to execute in a victim's browser. No public exploit is identified at time of analysis; the CVSS 4.0 score of 5.1 reflects limited scope impact constrained by authenticated access requirements and necessary user interaction.
Stored cross-site scripting in MISP's cti-transmute allows a low-privileged authenticated user to inject arbitrary HTML and JavaScript into the administrative triage interface by supplying a crafted icon value when creating or editing a tag. The malicious payload persists in the database and silently executes in the browser of any user who subsequently renders the affected tag, including administrators. No public exploit code or active exploitation has been identified at time of analysis; a remediation commit (cc13416d) is available in the MISP/cti-transmute repository.
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.
Stored cross-site scripting in MISP's cti-transmute visualization engine allows an attacker who can supply crafted STIX or MISP data to inject arbitrary HTML and JavaScript into ECharts Sunburst and Treemap tooltips, executing in a victim analyst's browser when they hover over an affected chart slice. All versions of cti-transmute prior to upstream fix commit c5b024a8ef5632f8939cfe2dad9026064698f4bb are affected, with vulnerable field values including STIX type, relationship_type, pattern prefix, and MISP category and type - all attacker-controllable in a shared threat intelligence environment. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.
Stored XSS in FlyEnv before 4.18.0 allows remote attackers to execute arbitrary JavaScript in the Electron renderer process by injecting unsanitized HTML through markdown sources or AI chat messages rendered via Vue v-html directives. Because FlyEnv's Electron renderer operates with Node.js API integration active, exploitation escalates beyond conventional XSS to effective local code execution with unrestricted filesystem access on the developer's machine. A publicly available exploit exists at GitHub issue #809, and vendor-released patch v4.18.0 addresses the flaw.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Discourse's discourse-local-dates plugin allows an authenticated attacker to inject arbitrary HTML by embedding crafted markup in local-date format attributes (data-format, data-displayed-timezone, data-timezone), which were interpolated directly into the DOM via template literals instead of safe DOM text APIs. Exploitation is gated by a non-default condition: the site's Content Security Policy must be modified or disabled from the default. No public exploit independent of the vendor fix commits exists at time of analysis, and this is not listed in CISA KEV. The CVSS 4.0 score of 2.0 reflects the constrained attack requirements (AT:P, PR:L, UI:A).
Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.
Stored cross-site scripting in Discourse's moderation review queue allows a low-privileged registered user to execute arbitrary JavaScript in a moderator's browser session. All Discourse deployments running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 are affected, but only when the platform's default Content Security Policy has been modified or disabled. No public exploit identified at time of analysis and no CISA KEV listing; real-world risk is bounded by both the CSP prerequisite and the requirement for moderator interaction.
Stored XSS in Discourse's staff action log interface allows authenticated users to inject malicious HTML into log entries that execute in administrator browser sessions. All Discourse releases prior to 2026.1.6 are affected, with the root cause being an unescaped rendering of previous_value and new_value fields in the admin frontend model. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches across four stable branches confirm the issue is fully remediated.
HTML injection in Discourse's PrettyText.format_for_email function allows authenticated users to embed arbitrary markup into outbound email notifications across all versions prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. Three distinct code paths in the email conversion pipeline re-inject cooked HTML attribute values as raw markup strings rather than treating them as data - exploitable via crafted Vimeo iframe sources, secure-upload URLs or dimension attributes, and hashtag data-slug values. No public exploit code or CISA KEV listing is identified at time of analysis; the CVSS 3.1 score of 6.4 reflects a meaningful scope change to email recipients' clients combined with the low-privilege authentication requirement.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored XSS in Magnolia CMS's import functionality enables authenticated editors to embed arbitrary JavaScript inside an uploaded image's filename, which executes in the browser of any CMS user who subsequently opens that image. The attack requires low-privileged editor access and passive victim interaction within the CMS backend. No active exploitation has been confirmed (not listed in CISA KEV), no public POC exists, and a vendor-released patch is available in version 6.3.10 as reported by CERT-PL.
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.
Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.
Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.
Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Stored cross-site scripting in the LWS Optimize WordPress plugin (all versions before 4.1.2) enables unauthenticated remote attackers to inject persistent JavaScript via the plugin's analytics endpoint, which then executes in the browser of any administrator who views the affected dashboard page. The vulnerability requires no authentication to exploit the injection phase, making mass poisoning of sites feasible before any admin interaction occurs. No public exploit is identified at time of analysis; a vendor-released patch is available in version 4.1.2.
Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.
Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. No public exploit identified at time of analysis is contradicted here - a publicly available exploit code exists per WPScan, though EPSS of 0.17% (7th percentile) indicates limited observed exploitation at time of analysis and no CISA KEV listing exists.
Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the `accordionTitleTag` block attribute. The `accordion_header_renderer()` function incorrectly uses WordPress's `esc_attr()` sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where `tag_escape()` is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored cross-site scripting in Domoticz's mobile dashboard (all versions prior to 2026.3) allows any authenticated API user to inject persistent JavaScript payloads via Text or Alert subtype device values. The ng-bind-html rendering path applies only an nl2br() newline transform with no HTML escaping, meaning stored payloads execute in every administrator's browser that loads the mobile dashboard. Successful exploitation enables session cookie theft and account takeover; no active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.
Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.
Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the `fullname` parameter in `/manage-newvisitors.php`, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV.
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.
Stored cross-site scripting in Tobit Laboratories AG TeamDavid's Webbox email interface allows any network-reachable attacker to embed malicious JavaScript within an email body; the payload executes in the browser context of any Webbox user who opens the message. All TeamDavid versions through Rollout 524 are affected per NCSC.ch disclosure and NVD CPE data. No public exploit identified at time of analysis and no CISA KEV confirmation, though the attack technique is trivial and requires no authentication from the sender.
Reflected XSS in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (marketed as a secure Microsoft 365 alternative) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability is exploitable via three distinct injection points: the URL path, the `EntryInfo` query parameter, and the `!templateName=entryMail` parameter. Disclosed as part of a coordinated batch of 22 CVEs in TeamDavid by InfoGuard Labs and reported through NCSC.ch; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Stored cross-site scripting in BNE Testimonials WordPress plugin (all versions before 2.0.8.2) allows contributor-level authenticated users to inject arbitrary JavaScript into an inline script block via an unescaped shortcode attribute. The payload persists in published content and executes in the browser of any visitor who views the affected page, including administrators. A public proof-of-concept is documented by WPScan; however, the vulnerability is not listed in CISA KEV and EPSS sits at the 5th percentile, indicating low automated exploitation probability.
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. A publicly available proof-of-concept exists per WPScan; EPSS at 0.16% (5th percentile) indicates limited automated exploitation despite the low attack complexity.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in AIL Framework's Chat Explorer and Forum Explorer views allows an attacker who can influence indexed dark-web content to inject arbitrary JavaScript into translation button onclick handlers, executing in the analyst's browser under the AIL security origin. Versions up to and including 7.0.0 are affected; the vulnerability stems from Jinja2 templates passing message and post identifiers through HTML escaping rather than JavaScript-safe encoding, leaving single-quote and escape-sequence injection paths open. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; exploitation requires the victim analyst to click the 'Translate to preferred language' button, limiting automated attack surface.
Stored XSS in AIL Framework's crawler domain view (versions ≤ 7.0.0) lets a low-privileged attacker embed executable JavaScript inside crawled URL values that persist in the AIL datastore. The payload triggers within an authenticated analyst's browser session the moment they click the screenshot icon for the malicious crawler entry, granting the attacker access to session data and the ability to perform application actions as that analyst. No CISA KEV listing or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects high confidentiality impact tempered by required user interaction and low-privilege preconditions.
Stored cross-site scripting in Frappe's Data Import feature allows an authenticated user with import permissions to inject persistent script payloads via maliciously crafted column headers in imported files. The unescaped headers are rendered in import preview and warning messages, causing script execution in the browser of any other user who subsequently views the import interface. Affected are all Frappe deployments on the 15.x branch prior to 15.109.0 and the 16.x branch prior to 16.19.0; no active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis.
Workspace Save API in Frappe prior to version 16.18.0 permits any authenticated user to overwrite another user's private workspace by supplying an arbitrary workspace identifier, and to inject persistent malicious scripts into that workspace. The root cause is a missing ownership check in the `save_page` handler in `frappe/desk/doctype/workspace/workspace.py`, confirmed by the vendor fix and classified as stored XSS (CWE-79). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity for any authenticated user and the persistent, targeted nature of the injection make it a meaningful risk in all multi-user Frappe and ERPNext deployments.
Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.
WSO2 API Manager's Swagger UI Try-out console in the API Publisher portal accepts an externally supplied OpenAPI/Swagger definition URL, allowing that definition to override the legitimate API specifications rendered to users. An attacker who tricks an API Publisher user into visiting a crafted URL can substitute attacker-controlled backend endpoints for real ones, potentially harvesting authentication tokens, credentials, or other sensitive payloads submitted via the Try-out console. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; exploitation requires user interaction, confining realistic risk to targeted social engineering against developer or API management personnel.
HTML sanitization bypass in jsoup versions 1.14.3 through 1.23.0 allows cross-site scripting when applications deploy a custom Safelist that explicitly permits raw-text elements. The parser's tag-name normalization trimmed trailing control characters (e.g., U+001E) from malformed tag names, causing a crafted element to acquire the parsing behavior of a recognized raw-text element; content intended to remain escaped text was then serialized as active markup, bypassing sanitization. jsoup's built-in Safelists are unaffected, and no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary JavaScript in victim browsers by embedding WHATWG URL control bytes (TAB, CR, LF, or leading C0 controls) within a javascript: scheme in href or src attribute values. The unsafe-link filter (RegexHelper::isLinkPotentiallyUnsafe()) uses an anchored prefix regex that does not normalize inputs as browsers do, so java<TAB>script: passes the filter but executes as javascript: in every compliant browser. Critically, this bypass defeats the allow_unsafe_links => false configuration - the library's own documented hardening recommendation for untrusted input - meaning even security-conscious deployments running versions 1.5.0 through 2.8.3 remain exploitable. No public exploit confirmed as KEV; however, the advisory provides explicit PoC payloads, substantially lowering attacker effort.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored cross-site scripting in Silverstripe CMS's admin page list view allows an authenticated CMS editor to execute arbitrary JavaScript in the browser session of any CMS user who views the page list. The flaw exists in composer/silverstripe/cms prior to 6.2.1, where ancestor page titles were concatenated directly into rendered HTML without HTML-entity escaping in the breadcrumb component. No public standalone exploit code and no CISA KEV listing have been identified; however, the patch diff, GHSA advisory, and test-case payloads are all publicly accessible, making reproduction straightforward for any researcher.
HTML injection via unescaped form submissions in Statamic CMS's automagic email notification template allows unauthenticated attackers to deliver malicious HTML content to site administrators and other configured email recipients. Statamic's Antlers templating engine rendered all user-controlled form field values - including text, select, radio, and checkbox inputs - directly into HTML email bodies without sanitization, enabling payload delivery through a standard public-facing form submission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability requires no authentication and is accessible to any user who can submit a Statamic form.
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.
Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.
Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the `uwp_get_user_badge()` function's `%%input%%` and `%%profile_url%%` template substitutions, and the `uwp_replace_variables()` function - both of which fail to apply `esc_html()` or `esc_url()` before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload crosses trust boundaries, enabling session hijacking, credential theft, or unauthorized actions against procurement administrators and reviewers who visit affected pages. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.
Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.
Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.
Cross-site scripting in Microsoft SharePoint Server allows an authenticated network attacker to perform spoofing attacks against users by injecting malicious script content into web pages served by the platform. Affected deployments include SharePoint Server Subscription Edition prior to build 16.0.19725.20522 and SharePoint Server 2019 prior to build 16.0.10417.20198. Exploitation requires victim interaction (UI:R) and attacker authentication (PR:L), and no public exploit code or active exploitation has been identified at time of analysis per SSVC data.
Cross-site scripting in Microsoft SharePoint Server enables an authenticated low-privilege attacker to inject malicious scripts into SharePoint content that execute in a victim user's browser, enabling session token theft, credential harvesting, or on-behalf-of actions under the victim's identity. Affected products are SharePoint Server Subscription Edition prior to 16.0.19725.20522 and SharePoint Server 2019 prior to 16.0.10417.20198. Vendor-released patches are available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Activepieces' OAuth callback endpoint `/api/redirect` allows an unauthenticated attacker to steal session tokens or execute authenticated API calls on behalf of logged-in users. Versions prior to 0.83.0 embed the user-supplied `code` query parameter directly inside an inline `<script>` block, enabling script context breakout via closing tag injection - a flaw the public patch commit fully discloses, substantially lowering the barrier to exploit development. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.
Cross-site scripting in BlackBerry AtHoc IWS Web Portals allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of an authenticated victim's session. All versions of AtHoc IWS prior to 7.21 HF-734 are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no special attacker privileges are needed, though a user interaction step is required, limiting mass-scale opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.
Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privileges to inject arbitrary JavaScript into the application by storing malicious markup in a finding's severity field. Because the frontend JavaScript (js/app.js) interpolates the severity value directly into HTML class attributes and CSS custom property references without sanitization, every subsequent authenticated user who views an affected findings list or report preview executes the injected script in the application's browser origin. No public exploit code has been identified at time of analysis, and no CISA KEV listing was provided; however, the stored nature of the flaw means a single malicious payload persists and silently affects all future report viewers until the database is sanitized.
Stored cross-site scripting in AVideo's user registration flow allows any attacker who can reach the registration form to inject persistent JavaScript via the phone field, which later executes in administrator browsers when the users management page loads. The injected payload is rendered through JavaScript innerHTML in the admin bootgrid component without sanitization, running in the admin's session context and enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck has documented and published an advisory for this vulnerability.
Persistent JavaScript injection in HortusFox 5.9 enables authenticated workspace members to execute arbitrary scripts in the browsers of all users who view affected plant notes, including administrators. The vulnerability stems from Parsedown's Markdown renderer operating without safe mode, allowing raw HTML and script tags embedded in plant notes to pass through to the DOM unescaped. An attacker with workspace membership can harvest session cookies or perform privileged actions on behalf of any user who visits the compromised plant entry. No public exploit code or active exploitation has been confirmed at time of analysis.
Stored cross-site scripting in ElkArte Forum 2.0 Beta 1 enables any registered member to persist malicious JavaScript in the cust_blurb and cust_locate profile fields, which render unescaped when administrators view affected profiles. The scope-changing nature of the flaw (CVSS S:C) means the payload executes within an administrator's browser session, creating a realistic path to session hijacking or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation - any registered account suffices - makes this a meaningful risk for forums with open registration.
Cross-site scripting in MISP's cti-transmute library allows an authenticated attacker to inject arbitrary HTML through conversion-table values rendered by the highlight() function. When processing content for search highlighting, the function inserted conversion data directly into an HTML sink without escaping special characters such as <, >, &, and quotes, allowing malicious markup embedded in CTI conversion data to execute in a victim's browser. No public exploit is identified at time of analysis; the CVSS 4.0 score of 5.1 reflects limited scope impact constrained by authenticated access requirements and necessary user interaction.
Stored cross-site scripting in MISP's cti-transmute allows a low-privileged authenticated user to inject arbitrary HTML and JavaScript into the administrative triage interface by supplying a crafted icon value when creating or editing a tag. The malicious payload persists in the database and silently executes in the browser of any user who subsequently renders the affected tag, including administrators. No public exploit code or active exploitation has been identified at time of analysis; a remediation commit (cc13416d) is available in the MISP/cti-transmute repository.
Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.
Stored cross-site scripting in MISP's cti-transmute visualization engine allows an attacker who can supply crafted STIX or MISP data to inject arbitrary HTML and JavaScript into ECharts Sunburst and Treemap tooltips, executing in a victim analyst's browser when they hover over an affected chart slice. All versions of cti-transmute prior to upstream fix commit c5b024a8ef5632f8939cfe2dad9026064698f4bb are affected, with vulnerable field values including STIX type, relationship_type, pattern prefix, and MISP category and type - all attacker-controllable in a shared threat intelligence environment. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.
Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.
Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.
DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.
Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.
SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.
Stored XSS in FlyEnv before 4.18.0 allows remote attackers to execute arbitrary JavaScript in the Electron renderer process by injecting unsanitized HTML through markdown sources or AI chat messages rendered via Vue v-html directives. Because FlyEnv's Electron renderer operates with Node.js API integration active, exploitation escalates beyond conventional XSS to effective local code execution with unrestricted filesystem access on the developer's machine. A publicly available exploit exists at GitHub issue #809, and vendor-released patch v4.18.0 addresses the flaw.
Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Discourse's discourse-local-dates plugin allows an authenticated attacker to inject arbitrary HTML by embedding crafted markup in local-date format attributes (data-format, data-displayed-timezone, data-timezone), which were interpolated directly into the DOM via template literals instead of safe DOM text APIs. Exploitation is gated by a non-default condition: the site's Content Security Policy must be modified or disabled from the default. No public exploit independent of the vendor fix commits exists at time of analysis, and this is not listed in CISA KEV. The CVSS 4.0 score of 2.0 reflects the constrained attack requirements (AT:P, PR:L, UI:A).
Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.
Stored cross-site scripting in Discourse's moderation review queue allows a low-privileged registered user to execute arbitrary JavaScript in a moderator's browser session. All Discourse deployments running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 are affected, but only when the platform's default Content Security Policy has been modified or disabled. No public exploit identified at time of analysis and no CISA KEV listing; real-world risk is bounded by both the CSP prerequisite and the requirement for moderator interaction.
Stored XSS in Discourse's staff action log interface allows authenticated users to inject malicious HTML into log entries that execute in administrator browser sessions. All Discourse releases prior to 2026.1.6 are affected, with the root cause being an unescaped rendering of previous_value and new_value fields in the admin frontend model. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches across four stable branches confirm the issue is fully remediated.
HTML injection in Discourse's PrettyText.format_for_email function allows authenticated users to embed arbitrary markup into outbound email notifications across all versions prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. Three distinct code paths in the email conversion pipeline re-inject cooked HTML attribute values as raw markup strings rather than treating them as data - exploitable via crafted Vimeo iframe sources, secure-upload URLs or dimension attributes, and hashtag data-slug values. No public exploit code or CISA KEV listing is identified at time of analysis; the CVSS 3.1 score of 6.4 reflects a meaningful scope change to email recipients' clients combined with the low-privilege authentication requirement.
Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.
Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Stored XSS in Magnolia CMS's import functionality enables authenticated editors to embed arbitrary JavaScript inside an uploaded image's filename, which executes in the browser of any CMS user who subsequently opens that image. The attack requires low-privileged editor access and passive victim interaction within the CMS backend. No active exploitation has been confirmed (not listed in CISA KEV), no public POC exists, and a vendor-released patch is available in version 6.3.10 as reported by CERT-PL.
Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.
Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.
Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.
Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.
Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.
Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.
Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.
Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.
Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.
Stored cross-site scripting in the LWS Optimize WordPress plugin (all versions before 4.1.2) enables unauthenticated remote attackers to inject persistent JavaScript via the plugin's analytics endpoint, which then executes in the browser of any administrator who views the affected dashboard page. The vulnerability requires no authentication to exploit the injection phase, making mass poisoning of sites feasible before any admin interaction occurs. No public exploit is identified at time of analysis; a vendor-released patch is available in version 4.1.2.
Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.
Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. No public exploit identified at time of analysis is contradicted here - a publicly available exploit code exists per WPScan, though EPSS of 0.17% (7th percentile) indicates limited observed exploitation at time of analysis and no CISA KEV listing exists.
Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the `accordionTitleTag` block attribute. The `accordion_header_renderer()` function incorrectly uses WordPress's `esc_attr()` sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where `tag_escape()` is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Stored cross-site scripting in Domoticz's mobile dashboard (all versions prior to 2026.3) allows any authenticated API user to inject persistent JavaScript payloads via Text or Alert subtype device values. The ng-bind-html rendering path applies only an nl2br() newline transform with no HTML escaping, meaning stored payloads execute in every administrator's browser that loads the mobile dashboard. Successful exploitation enables session cookie theft and account takeover; no active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.
Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.
Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.
Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.
Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.
Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the `fullname` parameter in `/manage-newvisitors.php`, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV.
Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.
Stored cross-site scripting in Tobit Laboratories AG TeamDavid's Webbox email interface allows any network-reachable attacker to embed malicious JavaScript within an email body; the payload executes in the browser context of any Webbox user who opens the message. All TeamDavid versions through Rollout 524 are affected per NCSC.ch disclosure and NVD CPE data. No public exploit identified at time of analysis and no CISA KEV confirmation, though the attack technique is trivial and requires no authentication from the sender.
Reflected XSS in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (marketed as a secure Microsoft 365 alternative) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability is exploitable via three distinct injection points: the URL path, the `EntryInfo` query parameter, and the `!templateName=entryMail` parameter. Disclosed as part of a coordinated batch of 22 CVEs in TeamDavid by InfoGuard Labs and reported through NCSC.ch; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.
Stored cross-site scripting in BNE Testimonials WordPress plugin (all versions before 2.0.8.2) allows contributor-level authenticated users to inject arbitrary JavaScript into an inline script block via an unescaped shortcode attribute. The payload persists in published content and executes in the browser of any visitor who views the affected page, including administrators. A public proof-of-concept is documented by WPScan; however, the vulnerability is not listed in CISA KEV and EPSS sits at the 5th percentile, indicating low automated exploitation probability.
Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.
Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. A publicly available proof-of-concept exists per WPScan; EPSS at 0.16% (5th percentile) indicates limited automated exploitation despite the low attack complexity.
Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Stored cross-site scripting in AIL Framework's Chat Explorer and Forum Explorer views allows an attacker who can influence indexed dark-web content to inject arbitrary JavaScript into translation button onclick handlers, executing in the analyst's browser under the AIL security origin. Versions up to and including 7.0.0 are affected; the vulnerability stems from Jinja2 templates passing message and post identifiers through HTML escaping rather than JavaScript-safe encoding, leaving single-quote and escape-sequence injection paths open. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; exploitation requires the victim analyst to click the 'Translate to preferred language' button, limiting automated attack surface.
Stored XSS in AIL Framework's crawler domain view (versions ≤ 7.0.0) lets a low-privileged attacker embed executable JavaScript inside crawled URL values that persist in the AIL datastore. The payload triggers within an authenticated analyst's browser session the moment they click the screenshot icon for the malicious crawler entry, granting the attacker access to session data and the ability to perform application actions as that analyst. No CISA KEV listing or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects high confidentiality impact tempered by required user interaction and low-privilege preconditions.
Stored cross-site scripting in Frappe's Data Import feature allows an authenticated user with import permissions to inject persistent script payloads via maliciously crafted column headers in imported files. The unescaped headers are rendered in import preview and warning messages, causing script execution in the browser of any other user who subsequently views the import interface. Affected are all Frappe deployments on the 15.x branch prior to 15.109.0 and the 16.x branch prior to 16.19.0; no active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis.
Workspace Save API in Frappe prior to version 16.18.0 permits any authenticated user to overwrite another user's private workspace by supplying an arbitrary workspace identifier, and to inject persistent malicious scripts into that workspace. The root cause is a missing ownership check in the `save_page` handler in `frappe/desk/doctype/workspace/workspace.py`, confirmed by the vendor fix and classified as stored XSS (CWE-79). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity for any authenticated user and the persistent, targeted nature of the injection make it a meaningful risk in all multi-user Frappe and ERPNext deployments.
Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.
WSO2 API Manager's Swagger UI Try-out console in the API Publisher portal accepts an externally supplied OpenAPI/Swagger definition URL, allowing that definition to override the legitimate API specifications rendered to users. An attacker who tricks an API Publisher user into visiting a crafted URL can substitute attacker-controlled backend endpoints for real ones, potentially harvesting authentication tokens, credentials, or other sensitive payloads submitted via the Try-out console. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; exploitation requires user interaction, confining realistic risk to targeted social engineering against developer or API management personnel.
HTML sanitization bypass in jsoup versions 1.14.3 through 1.23.0 allows cross-site scripting when applications deploy a custom Safelist that explicitly permits raw-text elements. The parser's tag-name normalization trimmed trailing control characters (e.g., U+001E) from malformed tag names, causing a crafted element to acquire the parsing behavior of a recognized raw-text element; content intended to remain escaped text was then serialized as active markup, bypassing sanitization. jsoup's built-in Safelists are unaffected, and no public exploit or CISA KEV listing has been identified at time of analysis.
Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary JavaScript in victim browsers by embedding WHATWG URL control bytes (TAB, CR, LF, or leading C0 controls) within a javascript: scheme in href or src attribute values. The unsafe-link filter (RegexHelper::isLinkPotentiallyUnsafe()) uses an anchored prefix regex that does not normalize inputs as browsers do, so java<TAB>script: passes the filter but executes as javascript: in every compliant browser. Critically, this bypass defeats the allow_unsafe_links => false configuration - the library's own documented hardening recommendation for untrusted input - meaning even security-conscious deployments running versions 1.5.0 through 2.8.3 remain exploitable. No public exploit confirmed as KEV; however, the advisory provides explicit PoC payloads, substantially lowering attacker effort.
Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored cross-site scripting in Silverstripe CMS's admin page list view allows an authenticated CMS editor to execute arbitrary JavaScript in the browser session of any CMS user who views the page list. The flaw exists in composer/silverstripe/cms prior to 6.2.1, where ancestor page titles were concatenated directly into rendered HTML without HTML-entity escaping in the breadcrumb component. No public standalone exploit code and no CISA KEV listing have been identified; however, the patch diff, GHSA advisory, and test-case payloads are all publicly accessible, making reproduction straightforward for any researcher.
HTML injection via unescaped form submissions in Statamic CMS's automagic email notification template allows unauthenticated attackers to deliver malicious HTML content to site administrators and other configured email recipients. Statamic's Antlers templating engine rendered all user-controlled form field values - including text, select, radio, and checkbox inputs - directly into HTML email bodies without sanitization, enabling payload delivery through a standard public-facing form submission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability requires no authentication and is accessible to any user who can submit a Statamic form.
Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.
html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.
Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.
Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.
Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.
Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.
Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.
Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.
Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the `uwp_get_user_badge()` function's `%%input%%` and `%%profile_url%%` template substitutions, and the `uwp_replace_variables()` function - both of which fail to apply `esc_html()` or `esc_url()` before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.
Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload crosses trust boundaries, enabling session hijacking, credential theft, or unauthorized actions against procurement administrators and reviewers who visit affected pages. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.
Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.
Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.
Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.
Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.
Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.
Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.