XSS
Monthly
Cache poisoning via Host header injection in WP Fastest Cache before version 1.5.1 exposes every WordPress site visitor to unauthenticated JavaScript execution from attacker-controlled servers. The plugin incorporates the client-supplied HTTP Host header into asset file URLs baked into cached pages while omitting that header from the cache key, meaning a single forged request can persist malicious script references across all subsequent page serves. No public exploit code has been identified at time of analysis, but the technique - HTTP Host header injection leading to web cache poisoning - is well-documented and the attack carries a CVSS 3.1 score of 7.5.
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for a high-privilege Joomla account substantially limits the threat surface.
HTML escaping in the hbs Express/Handlebars view engine (versions 2.1.0-4.2.1) is bypassed by the registerAsyncHelper API, enabling stored or reflected cross-site scripting in any Express application that passes attacker-influenced data through an async helper callback. The two-pass rendering pipeline escapes only an opaque placeholder in the first pass, then silently substitutes the raw, unescaped callback return value, affecting cached, uncached, and layout render paths equally. No active exploitation has been confirmed in CISA KEV; the issue is fixed in hbs 4.3.0.
Stored Cross-Site Scripting in NotificationX Pro for WordPress (all versions through 3.1.4) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript into site pages, executing in any visitor's browser context. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the combination of zero-privilege access and a scope change impact reaching beyond the WordPress installation itself into the browser sessions of site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface and persistent payload storage make this a credible risk for any site running the affected plugin.
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser context of any user who visits or interacts with the affected page, confirmed by PR:N in the CVSS vector. The scope change metric (S:C) reflects that impact crosses from the plugin/server boundary into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Stored XSS in Sakai Conversations (versions 23.0-23.3) allows any authenticated site member - including students - to inject arbitrary HTML and JavaScript into topics, posts, or comments that subsequently execute in the browsers of every user who views that content. The Conversations REST API accepts raw HTML in message fields without invoking Sakai's standard `FormattedText.processFormattedText()` sanitizer, and the LitElement frontend renders stored content via `unsafeHTML()` with no secondary defense. A detailed proof-of-concept including cookie exfiltration and database verification is publicly available in the GitHub security advisory; no active exploitation is confirmed via CISA KEV. In university deployments with hundreds of students per course, a single malicious post can compromise all enrolled users simultaneously.
Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch exists in WebTop 1.5.7.
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. No public exploit code or CISA KEV listing was identified at time of analysis; the vendor has released a patch at version 6.1.3.
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. Because RansomLook ingests data from the public crowd-sourced ransomwhe.re feed without prior validation, exploitation may not require an authenticated RansomLook account - an attacker who can introduce a crafted wallet record into that upstream feed can reach the vulnerable rendering path. No public exploit code or active exploitation has been identified at time of analysis; a patch is available via a confirmed vendor commit.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. No active exploitation or public POC code has been identified at time of analysis.
Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw HTML in the output of to_markdown(), enabling cross-site scripting when that Markdown is later rendered. Although to_html() safely neutralizes the same input, the Markdown serializer escapes only a handful of Markdown metacharacters and leaves angle brackets (< and >) intact, so entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT elements like <title>, <textarea>, <noscript>, and <plaintext> is emitted verbatim. Publicly available exploit code exists (a proof-of-concept is published in the vendor advisory), and the flaw is fixed in 1.12.0.
Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilStenstrom) in all versions up to and including 1.15.0, letting active content such as script or style survive sanitization. The flaws mostly hit advanced usage - programmatic DOM input, reused or mutated policy objects, and custom policies that preserve SVG/MathML - rather than the default JustHTML(..., sanitize=True) path, though process-wide mutation of exported default policies can weaken sanitization broadly. Reported by VulnCheck and fixed in 1.16.0; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Brave Popup Builder WordPress plugin (versions up to 0.8.5) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser by crafting a malicious URL containing unsanitized UTM query parameters that are reflected directly into popup form HTML. Exploitation requires the victim to follow a crafted link, making phishing the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests limited real-world exploitation activity; nonetheless, the fix is available and upgrade is straightforward.
Stored cross-site scripting in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript via the jsactions feature. When any authenticated user - including site administrators - views content containing the malicious payload, the script executes in their browser context, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write path combined with high confidentiality and integrity impact (CVSS 4.0: 8.6) makes this a meaningful risk for Joomla sites running Fabrik.
Stored cross-site scripting in JoomGallery (Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 allows a privileged authenticated attacker to inject a persistent JavaScript payload into image metadata, which then executes in the browser of every subsequent visitor who views that image or gallery. The attacker plants the payload once and it fires automatically for all future visitors, making this a force-multiplier attack despite the high-privilege prerequisite. No public exploit or active exploitation via CISA KEV has been identified at time of analysis; the fix is upgrading to version 4.3.1.
Stored cross-site scripting in the Slider Hero with Video Background, Animation WordPress plugin (versions before 9.1.3) allows unauthenticated remote attackers to inject persistent malicious JavaScript by exploiting missing authorization and nonce checks on two of the plugin's request handlers. The injected payload executes in two distinct contexts: within the WordPress admin area when an administrator views the plugin's settings, and on the public-facing frontend for any visitor loading a page that embeds a slider. This dual-execution surface elevates the impact beyond a typical admin-only XSS, as it enables both administrative session hijacking (leading to full site compromise) and broad visitor-side attacks. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.19% (8th percentile), indicating low observed exploitation activity at time of analysis.
Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers to execute arbitrary JavaScript in the browser context of authenticated iTop users by delivering a crafted URL. The CVSS 8.8 rating reflects low attack complexity and high impact on confidentiality, integrity, and availability within the ITSM platform's session context. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch 3.2.3 is available.
Reflected XSS in Combodo iTop's universal search feature (all versions prior to 3.2.3) allows an authenticated attacker to inject arbitrary JavaScript via the OQL filter parameter, which executes in a victim's browser upon visiting a crafted URL. The root cause is direct HTML output of the user-supplied OQL query string in UniversalSearch.php without sanitization, confirmed by the patch commit adding utils::EscapeHtml(). No CISA KEV listing or confirmed public exploit exists at time of analysis; exploitation requires attacker-supplied credentials and victim interaction, limiting opportunistic risk despite the CVSS 8.0 rating.
Reflected Cross-Site Scripting in Combodo iTop's tagadmin.php page allows an authenticated attacker to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript in their browser session. All iTop installations prior to version 3.2.3 are affected, with the vulnerability root-caused to the $sFilter request parameter being reflected into HTML output without sanitization. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS impact scores reflect the realistic potential for session hijacking or privilege escalation within the iTop management interface.
Stored XSS in YOURLS 1.5.1 through 1.10.3 enables unauthenticated attackers to inject arbitrary JavaScript into per-link statistics pages by sending a crafted HTTP Referer header to any existing short URL - no account or special access required for the poisoning step. When an administrator or public stats-page visitor subsequently opens the affected short URL's statistics page, attacker-controlled code executes in the YOURLS origin, granting access to the API signature token, admin-visible session data, and privileged same-origin actions. No CISA KEV listing or independently confirmed public exploit exists at time of analysis, though the GHSA advisory includes a functional proof-of-concept payload that makes weaponization trivial.
Reflected XSS in Combodo iTop's synchro import script prior to version 3.2.3 enables attackers to inject and execute arbitrary JavaScript in the browsers of authenticated users who click a crafted link. The vulnerable parameter `data_source_id` in `synchro/synchro_import.php` was processed without output encoding, as confirmed by the vendor fix commit. No active exploitation has been identified at time of analysis, and no public exploit code has been disclosed.
Reflected XSS in Combodo iTop's dashboard save functionality, present in all releases prior to 3.2.3, allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of an authenticated iTop user. The vulnerability originates in ajax.render.php, where dashboard_id and reload_url parameters were interpolated directly into inline JavaScript without escaping. With a CVSS Scope Changed classification (S:C), successful exploitation can affect resources beyond the iTop origin. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Combodo iTop's OQL query testing interface (run_query.php) allows authenticated attackers to inject and execute arbitrary JavaScript in the browser sessions of other authenticated users. All iTop versions prior to 3.2.3 are affected; the vendor has released a patch in 3.2.3 confirmed by a public GitHub advisory and commit. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Defuddle prior to 0.19.1 allows an attacker who controls content on a domain handled by a site extractor (X/Twitter, Substack, YouTube) to inject event-handler attributes or javascript: URLs into extracted HTML output. Three site extractors interpolate page-derived values - image alt/src attributes, og:image metadata, and video descriptions - into template literals without HTML escaping, and the resulting HTML is returned by buildExtractorResponse() without passing through the main pipeline's DOM-based sanitization. A vendor-released patch is available in version 0.19.1; no public exploit has been identified at time of analysis.
Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated low-privilege attacker to inject arbitrary JavaScript via the unsanitized `dashboard_id` parameter in the dashboard revert endpoint `/pages/ajax.render.php`. When a crafted URL is opened by a higher-privileged victim, the payload executes in their browser context, enabling session hijacking or unauthorized actions performed under the victim's identity. No CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in DiscordChatExporter prior to 2.47.2 allows a Discord bot or webhook operator to plant script payloads in message content or embed fields that execute in a victim's browser when the channel is exported with markdown formatting disabled. Affected fields include message body, forwarded and referenced message content, embed titles, descriptions, and field name/value pairs - all rendered without HTML entity encoding in the vulnerable code path. The issue is fixed in version 2.47.2, confirmed by GitHub security advisory GHSA-8qrv-mmch-fr9c; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Jet Admin allows an authenticated attacker to inject arbitrary JavaScript into the sign-in page via the scripts and styles configuration option, with the payload executing in the browser context of every subsequent visitor to that page. The sign-in page is a high-traffic, public-facing endpoint, so any user - including administrators - who visits the login page becomes a victim after the payload is planted. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact against affected users.
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attackers to inject persistent JavaScript payloads through comment fields and user-supplied field elements. Because these inputs were not escaped before being rendered, any user or administrator who subsequently views the affected content triggers execution of the attacker's script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator level. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
Stored HTML injection in Rocket.Chat's Omnichannel Queue panel allows unauthenticated external attackers to render arbitrary, clickable phishing links in the browsers of support agents viewing the queue. All Rocket.Chat deployments with Livechat/Omnichannel enabled and running versions prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15 are affected. An attacker submitting a crafted visitor name via the unauthenticated POST /api/v1/livechat/visitor REST endpoint can inject arbitrary HTML into the agent-facing side panel UI, enabling targeted social-engineering attacks against customer support staff; no public exploit has been identified at time of analysis, and the EPSS score of 0.18% indicates minimal opportunistic interest.
Stored XSS in LinkAce's Bulk Link API allows any authenticated user to persist a javascript: URI that executes arbitrary JavaScript in a victim's browser when they click the stored link. All LinkAce instances prior to version 2.5.7 are affected via the POST /api/v2/bulk/links endpoint. No public exploit has been identified at time of analysis, though the attack path is straightforward - session cookie exfiltration and account takeover are the primary impacts. Vendor-released patch 2.5.7 is available.
Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engineering chain requiring only that an administrator bookmark an attacker-controlled URL. The permalink handler in BookmarkListController.php writes raw bookmark titles into the HTML <title> element without HTML escaping, and Shaarli's built-in metadata fetcher copies remote page titles verbatim - meaning an attacker who controls a webpage's title silently plants a persistent payload the moment any admin bookmarks that URL. The injected script then executes in the Shaarli origin for every subsequent visitor to the permalink, including the administrator on first save, creating a one-shot session-hijacking path; no public exploit has been identified at time of analysis.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.
Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the `image` and `file` fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of this XSS elevates risk above reflected variants due to its persistence and elevated-privilege victim profile.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Splunk Enterprise's Dashboard Studio allows a user holding the 'power' role to persist a crafted workflow action URL that, when triggered by a separate authenticated victim, executes attacker-controlled JavaScript in the victim's browser session. All four actively maintained branches are affected: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. No public exploit has been identified at time of analysis, and exploitation is constrained by a required internal 'power' role and mandatory victim social engineering, meaningfully limiting the realistic attacker population despite the high impact ratings.
Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to persist a malicious ui-tour knowledge object that executes arbitrary JavaScript in the browser of any authenticated user who visits an affected Splunk Web page. Affected are all Splunk Enterprise deployments running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14, a broad multi-branch footprint reported via Cisco and confirmed by Splunk advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.3 rating and high confidentiality and integrity impact scores reflect meaningful lateral risk within an enterprise's Splunk deployment.
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. A vendor patch exists in 3.3.1; no public exploit identified at time of analysis, though the vendor's regression test embeds a working payload.
Stored cross-site scripting in Wekan's HTML board export function allows a board member - including one whose access has since been revoked - to inject JavaScript that executes when any recipient clicks a card in a downloaded HTML export file. Wekan versions 8.72 through 10.23 are affected; the exploit survives membership removal and is capable of exfiltrating all board data embedded in the export to an attacker-controlled endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Scope:Changed CVSS classification and post-revocation persistence make this more dangerous than its 7.6 score suggests.
Stored XSS in Grav Shortcode Core Plugin (prior to 6.2.2) allows an authenticated user with admin.pages permission to inject arbitrary JavaScript into page content by supplying a crafted shortcode attribute value that breaks out of an HTML attribute context. The plugin's shortcode syntax bypasses Grav's save-time XSS filter because shortcode notation never contains a literal less-than character, and multiple attribute handlers (ColorShortcode, DivShortcode, ColumnsShortcode, and others) then concatenate the raw parameter directly into rendered HTML. The stored payload executes in the browser of any visitor or administrator who subsequently views the affected page. No public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in HumHub 1.18.4 lets a Space administrator embed arbitrary HTML or JavaScript into the deletion-reason field of a comment-removal notification sent to the comment's original author. When the victim renders the notification in their browser, the injected script executes within their authenticated HumHub session, enabling session-token theft or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; an upstream patch is available as GitHub PR #8365, though a tagged release version has not been independently confirmed.
Reflected cross-site scripting in HumHub Community Edition 1.18.4 allows a low-privileged attacker to inject arbitrary JavaScript into the browser session of an authenticated non-member by embedding malicious button configuration in the `options` query-string parameter of the `space/membership/request-membership-form` endpoint. When a social-engineering lure causes the victim to submit the membership request form, the server reflects attacker-controlled markup inside a script context, enabling account takeover-class impact. No active exploitation has been confirmed (no CISA KEV listing); an upstream patch is available as GitHub PR #8381, though a formally tagged release version has not been independently confirmed.
Stored XSS in HumHub Community Edition 1.18.4 and 1.18.4-pl1 allows authenticated low-privilege users to inject arbitrary HTML and JavaScript into the oEmbed confirmation prompt rendered for other users. The attacker-controlled URL prefix was passed unencoded into the HTML consent dialog via Html::tag() in UrlOembed.php, and a secondary code path flaw allowed confirmation content to flow through a CSP nonce injection routine - meaning embedded markup could acquire a valid nonce and bypass Content Security Policy. No public exploit identified at time of analysis, though Fluid Attacks has published a coordinated disclosure advisory with proof-of-concept detail.
Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.
Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.
Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.
Cache poisoning via Host header injection in WP Fastest Cache before version 1.5.1 exposes every WordPress site visitor to unauthenticated JavaScript execution from attacker-controlled servers. The plugin incorporates the client-supplied HTTP Host header into asset file URLs baked into cached pages while omitting that header from the cache key, meaning a single forged request can persist malicious script references across all subsequent page serves. No public exploit code has been identified at time of analysis, but the technique - HTTP Host header injection leading to web cache poisoning - is well-documented and the attack carries a CVSS 3.1 score of 7.5.
Stored cross-site scripting in YOOtheme Pro Extension for Joomla versions 1.0.0 through 5.0.41 allows authenticated, privileged users to inject persistent malicious scripts via the location custom field, which lacks HTML output escaping before rendering user-supplied content in the browser. Any site visitor who subsequently loads a page rendering the tainted field will execute the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis, and the requirement for a high-privilege Joomla account substantially limits the threat surface.
HTML escaping in the hbs Express/Handlebars view engine (versions 2.1.0-4.2.1) is bypassed by the registerAsyncHelper API, enabling stored or reflected cross-site scripting in any Express application that passes attacker-influenced data through an async helper callback. The two-pass rendering pipeline escapes only an opaque placeholder in the first pass, then silently substitutes the raw, unescaped callback return value, affecting cached, uncached, and layout render paths equally. No active exploitation has been confirmed in CISA KEV; the issue is fixed in hbs 4.3.0.
Stored Cross-Site Scripting in NotificationX Pro for WordPress (all versions through 3.1.4) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript into site pages, executing in any visitor's browser context. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C) reflects the combination of zero-privilege access and a scope change impact reaching beyond the WordPress installation itself into the browser sessions of site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface and persistent payload storage make this a credible risk for any site running the affected plugin.
DOM-based reflected XSS in the Forminator Forms WordPress plugin (all versions up to and including 1.57.0) allows unauthenticated network attackers to execute arbitrary JavaScript in victim browsers by embedding a payload in the 'error_description' URL parameter, which the plugin's front.stripe.js writes to the DOM without sanitization. The attack surface expanded significantly when Stripe Checkout Sessions became the plugin's default payment method in version 1.56.0, meaning any site that upgraded to 1.56.0 or 1.57.0 without changing payment settings is exposed on pages hosting a Forminator form. No public exploit has been identified at time of analysis, but the vulnerable code paths at four specific locations in front.stripe.js are publicly documented in Wordfence's disclosure, with the fix released in version 1.57.0.1.
Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.2) allows unauthenticated attackers to inject persistent JavaScript payloads that auto-execute in the WordPress admin panel when an administrator views the Submissions page. The attack vector is the Save-and-Continue draft AJAX endpoint, which is registered without privilege checks (nopriv), bypassing radio field option-membership validation and permitting arbitrary values to be stored. Payload execution is triggered automatically via the bundled Inputmask library's data-attribute callback binding, requiring no further attacker interaction after initial injection. No public exploit code or CISA KEV listing is identified at time of analysis, though the unauthenticated, zero-complexity attack path and high-value admin-panel target represent meaningful real-world risk.
Unauthenticated XSS in the Stripe Payments WordPress plugin (versions ≤ 2.1.2) allows remote attackers to inject malicious scripts into victim browsers with no attacker-side authentication required, as disclosed by Patchstack (EUVD-2026-65176). The CVSS Scope:Changed metric reflects that injected scripts execute within the victim's browser security context, enabling session hijacking, credential theft, or malicious content injection against WordPress site visitors or administrators. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated XSS in the Toolset Blocks WordPress plugin (versions through 1.6.26) allows remote attackers to inject malicious scripts into pages rendered by the plugin without any prior authentication. The CVSS vector's scope-change indicator (S:C) signals that injected code executes in the victim's browser context outside the vulnerable component itself, making administrator session hijacking a realistic secondary impact. Reported by Patchstack and tracked under EUVD-2026-65171; no public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in the Event Tickets WordPress plugin (versions ≤ 5.29.2.1) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in victims' browsers by delivering a crafted link or triggering stored output. The scope-changed CVSS vector (S:C) indicates the injected script can operate outside the plugin's own execution boundary, enabling session theft, credential harvesting, or defacement against authenticated WordPress users who interact with affected pages. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Unauthenticated cross-site scripting in the Boost WordPress plugin (versions ≤ 2.0.4) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser context of any user who visits or interacts with the affected page, confirmed by PR:N in the CVSS vector. The scope change metric (S:C) reflects that impact crosses from the plugin/server boundary into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.
Stored XSS in Sakai Conversations (versions 23.0-23.3) allows any authenticated site member - including students - to inject arbitrary HTML and JavaScript into topics, posts, or comments that subsequently execute in the browsers of every user who views that content. The Conversations REST API accepts raw HTML in message fields without invoking Sakai's standard `FormattedText.processFormattedText()` sanitizer, and the LitElement frontend renders stored content via `unsafeHTML()` with no secondary defense. A detailed proof-of-concept including cookie exfiltration and database verification is publicly available in the GitHub security advisory; no active exploitation is confirmed via CISA KEV. In university deployments with hundreds of students per course, a single malicious post can compromise all enrolled users simultaneously.
Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated attacker to inject malicious scripts via the dashboard revert functionality, executing arbitrary JavaScript in a victim's browser session within the iTop context. The CVSS 8.9 score and Changed scope (S:C) reflect that successful exploitation extends impact beyond the iTop application itself - enabling session hijacking, credential theft, or privilege escalation on behalf of the victim user. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in NethServer's WebTop calendar component (versions 1.5.6 and earlier) permits an authenticated attacker to inject malicious JavaScript into calendar event fields, which silently executes in the browser of any user who subsequently views the poisoned event. The impact scope includes session hijacking, unauthorized access to emails, contacts, and files, and the ability to perform actions as the victim within the platform - all without the victim taking any action beyond viewing the event. No active exploitation or public exploit code has been identified at time of analysis; a vendor-released patch exists in WebTop 1.5.7.
Cross-site scripting in the Network Optix Nx Witness VMS Web Administration interface (all versions before 6.1.3 on Linux, Windows, and macOS) enables an adjacent-network attacker who controls a rogue Nx server to inject arbitrary JavaScript into an authenticated administrator's browser session by setting the rogue server's site name to a script payload. The injected script executes when the administrator opens the 'Merge with Another Site' dialog, triggering session token theft and full administrator account takeover. No public exploit code or CISA KEV listing was identified at time of analysis; the vendor has released a patch at version 6.1.3.
Stored XSS in RansomLook's cryptocurrency wallet detail view allows attacker-controlled JavaScript to execute in the security context of any user who clicks the CSV export button on an affected wallet record. The root cause is insertion of externally-sourced wallet addresses and blockchain names directly into an inline JavaScript onclick handler, where Jinja2's HTML autoescaping is bypassed because the browser's HTML parser decodes entities such as ' back to quote characters before the JavaScript engine processes the attribute value. Because RansomLook ingests data from the public crowd-sourced ransomwhe.re feed without prior validation, exploitation may not require an authenticated RansomLook account - an attacker who can introduce a crafted wallet record into that upstream feed can reach the vulnerable rendering path. No public exploit code or active exploitation has been identified at time of analysis; a patch is available via a confirmed vendor commit.
Unauthenticated cross-site scripting in the Urna WordPress theme (by Thembay) affects all versions up to and including 2.6.2, allowing a remote attacker to inject malicious scripts into pages viewed by other users. The scope-changed CVSS vector (S:C) confirms the payload executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack path lowers the barrier for opportunistic exploitation against sites running the vulnerable theme.
Cross-site scripting in Brave Conversion Engine (PRO), a WordPress plugin by Amplebyte Pvt Limited, is exploitable by unauthenticated remote attackers against all versions through 0.8.6. The CVSS scope-change indicator (S:C) confirms that successful injection executes attacker-controlled JavaScript within a victim user's browser context - separate from the vulnerable server component - enabling session hijacking, credential theft, or malicious redirects. No active exploitation has been confirmed via CISA KEV, and no EPSS score was included in available intelligence; however, the PR:N/AC:L attack profile means any internet-accessible WordPress installation running this plugin is trivially reachable.
Unauthenticated XSS in the Goodlayers Tourmaster WordPress plugin (versions ≤ 5.4.9) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to victims, with a scope change that can affect the broader WordPress session context. Exploitation requires victim interaction - typically clicking a crafted link - but carries no authentication prerequisite, keeping the barrier to attempt low. No CISA KEV listing and no public exploit code have been identified at the time of analysis, placing this in a 'patch promptly but not emergency' risk tier.
Unauthenticated cross-site scripting in the Events Made Easy WordPress plugin (versions up to and including 3.2.5) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser upon interaction with attacker-controlled content. The CVSS scope change (S:C) indicates the injected script operates outside the plugin's own security context, enabling actions such as session hijacking, credential theft, or admin account takeover. No public exploit code or active exploitation has been identified at time of analysis; however, the unauthenticated attack vector and low attack complexity lower the barrier for abuse.
Unauthenticated cross-site scripting in the Social Media & Share Icons WordPress plugin (by Inisev, versions ≤ 2.9.9) allows remote attackers to inject arbitrary JavaScript that executes in the context of a victim's browser when they visit an affected page. The CVSS scope change (S:C) indicates injected scripts can breach the plugin's own security boundary, enabling session hijacking, credential theft, or page defacement against site visitors and administrators. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the zero-authentication requirement substantially lowers the exploitation bar.
Unauthenticated cross-site scripting in the WPComplete WordPress plugin (versions up to and including 2.9.5.6) allows remote attackers to inject and execute arbitrary JavaScript in the context of another user's browser session, with scope change indicating the payload crosses the plugin's security boundary to affect authenticated users such as site administrators. The CVSS vector (PR:N/UI:R/S:C) is consistent with a stored or reflected XSS pattern where an unauthenticated attacker plants a payload that is later triggered when a privileged user visits an affected page. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the 12 Step Meeting List WordPress plugin (versions ≤ 3.19.16) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of visitors or administrators who interact with affected pages. Carrying a CVSS 7.1 score with a Scope:Changed flag, the vulnerability crosses from the plugin context into the victim's browser session, enabling session hijacking, credential theft, or page defacement. No active exploitation or public POC code has been identified at time of analysis.
Sanitizer bypass in the justhtml Python library (versions <= 1.11.0) allows attacker-controlled input to survive as raw HTML in the output of to_markdown(), enabling cross-site scripting when that Markdown is later rendered. Although to_html() safely neutralizes the same input, the Markdown serializer escapes only a handful of Markdown metacharacters and leaves angle brackets (< and >) intact, so entity-decoded text (e.g. <script>) or text from RCDATA/RAWTEXT elements like <title>, <textarea>, <noscript>, and <plaintext> is emitted verbatim. Publicly available exploit code exists (a proof-of-concept is published in the vendor advisory), and the flaw is fixed in 1.12.0.
Cross-site scripting via HTML sanitization bypass affects justhtml (a Python HTML parsing/sanitization library by EmilStenstrom) in all versions up to and including 1.15.0, letting active content such as script or style survive sanitization. The flaws mostly hit advanced usage - programmatic DOM input, reused or mutated policy objects, and custom policies that preserve SVG/MathML - rather than the default JustHTML(..., sanitize=True) path, though process-wide mutation of exported default policies can weaken sanitization broadly. Reported by VulnCheck and fixed in 1.16.0; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Reflected cross-site scripting in the Brave Popup Builder WordPress plugin (versions up to 0.8.5) allows unauthenticated remote attackers to inject arbitrary JavaScript into a victim's browser by crafting a malicious URL containing unsanitized UTM query parameters that are reflected directly into popup form HTML. Exploitation requires the victim to follow a crafted link, making phishing the primary delivery mechanism. No public exploit code or CISA KEV listing has been identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests limited real-world exploitation activity; nonetheless, the fix is available and upgrade is straightforward.
Stored cross-site scripting in the Fabrik extension for Joomla (versions 1.0.0 through 4.7.1) allows unauthenticated remote attackers to persistently inject arbitrary JavaScript via the jsactions feature. When any authenticated user - including site administrators - views content containing the malicious payload, the script executes in their browser context, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated write path combined with high confidentiality and integrity impact (CVSS 4.0: 8.6) makes this a meaningful risk for Joomla sites running Fabrik.
Stored cross-site scripting in JoomGallery (Joomla extension by joomgalleryfriends.net) versions prior to 4.3.1 allows a privileged authenticated attacker to inject a persistent JavaScript payload into image metadata, which then executes in the browser of every subsequent visitor who views that image or gallery. The attacker plants the payload once and it fires automatically for all future visitors, making this a force-multiplier attack despite the high-privilege prerequisite. No public exploit or active exploitation via CISA KEV has been identified at time of analysis; the fix is upgrading to version 4.3.1.
Stored cross-site scripting in the Slider Hero with Video Background, Animation WordPress plugin (versions before 9.1.3) allows unauthenticated remote attackers to inject persistent malicious JavaScript by exploiting missing authorization and nonce checks on two of the plugin's request handlers. The injected payload executes in two distinct contexts: within the WordPress admin area when an administrator views the plugin's settings, and on the public-facing frontend for any visitor loading a page that embeds a slider. This dual-execution surface elevates the impact beyond a typical admin-only XSS, as it enables both administrative session hijacking (leading to full site compromise) and broad visitor-side attacks. No public exploit code or CISA KEV listing has been identified; EPSS sits at 0.19% (8th percentile), indicating low observed exploitation activity at time of analysis.
Reflected XSS in Combodo iTop's foreign key search criteria API (all versions prior to 3.2.3) enables remote attackers to execute arbitrary JavaScript in the browser context of authenticated iTop users by delivering a crafted URL. The CVSS 8.8 rating reflects low attack complexity and high impact on confidentiality, integrity, and availability within the ITSM platform's session context. No public exploit code and no CISA KEV listing have been identified at time of analysis; vendor-released patch 3.2.3 is available.
Reflected XSS in Combodo iTop's universal search feature (all versions prior to 3.2.3) allows an authenticated attacker to inject arbitrary JavaScript via the OQL filter parameter, which executes in a victim's browser upon visiting a crafted URL. The root cause is direct HTML output of the user-supplied OQL query string in UniversalSearch.php without sanitization, confirmed by the patch commit adding utils::EscapeHtml(). No CISA KEV listing or confirmed public exploit exists at time of analysis; exploitation requires attacker-supplied credentials and victim interaction, limiting opportunistic risk despite the CVSS 8.0 rating.
Reflected Cross-Site Scripting in Combodo iTop's tagadmin.php page allows an authenticated attacker to craft a malicious URL that, when visited by another authenticated user, executes arbitrary JavaScript in their browser session. All iTop installations prior to version 3.2.3 are affected, with the vulnerability root-caused to the $sFilter request parameter being reflected into HTML output without sanitization. No public exploit or active exploitation has been identified at time of analysis, but the high CVSS impact scores reflect the realistic potential for session hijacking or privilege escalation within the iTop management interface.
Stored XSS in YOURLS 1.5.1 through 1.10.3 enables unauthenticated attackers to inject arbitrary JavaScript into per-link statistics pages by sending a crafted HTTP Referer header to any existing short URL - no account or special access required for the poisoning step. When an administrator or public stats-page visitor subsequently opens the affected short URL's statistics page, attacker-controlled code executes in the YOURLS origin, granting access to the API signature token, admin-visible session data, and privileged same-origin actions. No CISA KEV listing or independently confirmed public exploit exists at time of analysis, though the GHSA advisory includes a functional proof-of-concept payload that makes weaponization trivial.
Reflected XSS in Combodo iTop's synchro import script prior to version 3.2.3 enables attackers to inject and execute arbitrary JavaScript in the browsers of authenticated users who click a crafted link. The vulnerable parameter `data_source_id` in `synchro/synchro_import.php` was processed without output encoding, as confirmed by the vendor fix commit. No active exploitation has been identified at time of analysis, and no public exploit code has been disclosed.
Reflected XSS in Combodo iTop's dashboard save functionality, present in all releases prior to 3.2.3, allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of an authenticated iTop user. The vulnerability originates in ajax.render.php, where dashboard_id and reload_url parameters were interpolated directly into inline JavaScript without escaping. With a CVSS Scope Changed classification (S:C), successful exploitation can affect resources beyond the iTop origin. No public exploit code or CISA KEV listing has been identified at time of analysis.
Reflected XSS in Combodo iTop's OQL query testing interface (run_query.php) allows authenticated attackers to inject and execute arbitrary JavaScript in the browser sessions of other authenticated users. All iTop versions prior to 3.2.3 are affected; the vendor has released a patch in 3.2.3 confirmed by a public GitHub advisory and commit. No public exploit code or active exploitation has been identified at time of analysis.
Cross-site scripting in Defuddle prior to 0.19.1 allows an attacker who controls content on a domain handled by a site extractor (X/Twitter, Substack, YouTube) to inject event-handler attributes or javascript: URLs into extracted HTML output. Three site extractors interpolate page-derived values - image alt/src attributes, og:image metadata, and video descriptions - into template literals without HTML escaping, and the resulting HTML is returned by buildExtractorResponse() without passing through the main pipeline's DOM-based sanitization. A vendor-released patch is available in version 0.19.1; no public exploit has been identified at time of analysis.
Reflected XSS in Combodo iTop prior to version 3.2.3 allows an authenticated low-privilege attacker to inject arbitrary JavaScript via the unsanitized `dashboard_id` parameter in the dashboard revert endpoint `/pages/ajax.render.php`. When a crafted URL is opened by a higher-privileged victim, the payload executes in their browser context, enabling session hijacking or unauthorized actions performed under the victim's identity. No CISA KEV listing or public proof-of-concept exploit has been identified at time of analysis.
Stored Cross-Site Scripting in J2Store and J2Commerce allows unauthenticated attackers to inject persistent malicious scripts via guest checkout billing address fields, affecting all versions from 1.0.0 through 4.1.5. The exploit abuses an interaction between Joomla's Input::getArray() sanitization and PHP's default variables_order=EGPCS setting, where Cookie values silently override POST parameters in $_REQUEST, allowing unsanitized HTML to persist in fields such as billing_first_name. When a privileged user such as a store administrator subsequently views the affected order record, the stored payload executes in their browser session. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in DiscordChatExporter prior to 2.47.2 allows a Discord bot or webhook operator to plant script payloads in message content or embed fields that execute in a victim's browser when the channel is exported with markdown formatting disabled. Affected fields include message body, forwarded and referenced message content, embed titles, descriptions, and field name/value pairs - all rendered without HTML entity encoding in the vulnerable code path. The issue is fixed in version 2.47.2, confirmed by GitHub security advisory GHSA-8qrv-mmch-fr9c; no public exploit code or active exploitation has been identified at time of analysis.
Stored cross-site scripting in Jet Admin allows an authenticated attacker to inject arbitrary JavaScript into the sign-in page via the scripts and styles configuration option, with the payload executing in the browser context of every subsequent visitor to that page. The sign-in page is a high-traffic, public-facing endpoint, so any user - including administrators - who visits the login page becomes a victim after the payload is planted. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog; however, the CVSS 4.0 score of 8.5 reflects high confidentiality and integrity impact against affected users.
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attackers to inject persistent JavaScript payloads through comment fields and user-supplied field elements. Because these inputs were not escaped before being rendered, any user or administrator who subsequently views the affected content triggers execution of the attacker's script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator level. No public exploit or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in WPForms Pro for WordPress (all versions through 2.0.0.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form text fields, which execute in the browser of any user who views the stored form entry. The vulnerability exploits a subtle interaction between the plugin's custom kses allowlist expansion - permitting iframes with a data-src attribute - and the WordPress core URI sanitizer's blindspot for that attribute, compounded by the plugin's own admin script promoting data-src to a live src. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the unauthenticated attack surface and administrative execution context make this a credible priority for WordPress site operators.
Stored HTML injection in Rocket.Chat's Omnichannel Queue panel allows unauthenticated external attackers to render arbitrary, clickable phishing links in the browsers of support agents viewing the queue. All Rocket.Chat deployments with Livechat/Omnichannel enabled and running versions prior to 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, or 7.10.15 are affected. An attacker submitting a crafted visitor name via the unauthenticated POST /api/v1/livechat/visitor REST endpoint can inject arbitrary HTML into the agent-facing side panel UI, enabling targeted social-engineering attacks against customer support staff; no public exploit has been identified at time of analysis, and the EPSS score of 0.18% indicates minimal opportunistic interest.
Stored XSS in LinkAce's Bulk Link API allows any authenticated user to persist a javascript: URI that executes arbitrary JavaScript in a victim's browser when they click the stored link. All LinkAce instances prior to version 2.5.7 are affected via the POST /api/v2/bulk/links endpoint. No public exploit has been identified at time of analysis, though the attack path is straightforward - session cookie exfiltration and account takeover are the primary impacts. Vendor-released patch 2.5.7 is available.
Stored XSS in Shaarli versions prior to 0.16.3 enables administrator account takeover through a low-effort social engineering chain requiring only that an administrator bookmark an attacker-controlled URL. The permalink handler in BookmarkListController.php writes raw bookmark titles into the HTML <title> element without HTML escaping, and Shaarli's built-in metadata fetcher copies remote page titles verbatim - meaning an attacker who controls a webpage's title silently plants a persistent payload the moment any admin bookmarks that URL. The injected script then executes in the Shaarli origin for every subsequent visitor to the permalink, including the administrator on first save, creating a one-shot session-hijacking path; no public exploit has been identified at time of analysis.
Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.
Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.
Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.
Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.
Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.
Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.
Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.
Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.
Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.
Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.
Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.
Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.
Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the `image` and `file` fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of this XSS elevates risk above reflected variants due to its persistence and elevated-privilege victim profile.
Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Splunk Enterprise's Dashboard Studio allows a user holding the 'power' role to persist a crafted workflow action URL that, when triggered by a separate authenticated victim, executes attacker-controlled JavaScript in the victim's browser session. All four actively maintained branches are affected: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. No public exploit has been identified at time of analysis, and exploitation is constrained by a required internal 'power' role and mandatory victim social engineering, meaningfully limiting the realistic attacker population despite the high impact ratings.
Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to persist a malicious ui-tour knowledge object that executes arbitrary JavaScript in the browser of any authenticated user who visits an affected Splunk Web page. Affected are all Splunk Enterprise deployments running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14, a broad multi-branch footprint reported via Cisco and confirmed by Splunk advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.3 rating and high confidentiality and integrity impact scores reflect meaningful lateral risk within an enterprise's Splunk deployment.
Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. A vendor patch exists in 3.3.1; no public exploit identified at time of analysis, though the vendor's regression test embeds a working payload.
Stored cross-site scripting in Wekan's HTML board export function allows a board member - including one whose access has since been revoked - to inject JavaScript that executes when any recipient clicks a card in a downloaded HTML export file. Wekan versions 8.72 through 10.23 are affected; the exploit survives membership removal and is capable of exfiltrating all board data embedded in the export to an attacker-controlled endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Scope:Changed CVSS classification and post-revocation persistence make this more dangerous than its 7.6 score suggests.
Stored XSS in Grav Shortcode Core Plugin (prior to 6.2.2) allows an authenticated user with admin.pages permission to inject arbitrary JavaScript into page content by supplying a crafted shortcode attribute value that breaks out of an HTML attribute context. The plugin's shortcode syntax bypasses Grav's save-time XSS filter because shortcode notation never contains a literal less-than character, and multiple attribute handlers (ColorShortcode, DivShortcode, ColumnsShortcode, and others) then concatenate the raw parameter directly into rendered HTML. The stored payload executes in the browser of any visitor or administrator who subsequently views the affected page. No public exploit or CISA KEV listing is identified at time of analysis.
Stored cross-site scripting in HumHub 1.18.4 lets a Space administrator embed arbitrary HTML or JavaScript into the deletion-reason field of a comment-removal notification sent to the comment's original author. When the victim renders the notification in their browser, the injected script executes within their authenticated HumHub session, enabling session-token theft or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; an upstream patch is available as GitHub PR #8365, though a tagged release version has not been independently confirmed.
Reflected cross-site scripting in HumHub Community Edition 1.18.4 allows a low-privileged attacker to inject arbitrary JavaScript into the browser session of an authenticated non-member by embedding malicious button configuration in the `options` query-string parameter of the `space/membership/request-membership-form` endpoint. When a social-engineering lure causes the victim to submit the membership request form, the server reflects attacker-controlled markup inside a script context, enabling account takeover-class impact. No active exploitation has been confirmed (no CISA KEV listing); an upstream patch is available as GitHub PR #8381, though a formally tagged release version has not been independently confirmed.
Stored XSS in HumHub Community Edition 1.18.4 and 1.18.4-pl1 allows authenticated low-privilege users to inject arbitrary HTML and JavaScript into the oEmbed confirmation prompt rendered for other users. The attacker-controlled URL prefix was passed unencoded into the HTML consent dialog via Html::tag() in UrlOembed.php, and a secondary code path flaw allowed confirmation content to flow through a CSP nonce injection routine - meaning embedded markup could acquire a valid nonce and bypass Content Security Policy. No public exploit identified at time of analysis, though Fluid Attacks has published a coordinated disclosure advisory with proof-of-concept detail.
Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.
Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.
Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.
Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.
Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.
Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.
Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.
Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.