XSS
Monthly
Stored XSS in Shaarli's tag filtering functionality permits an authenticated user to inject persistent JavaScript payloads via the bookmark tags field, which execute in the browsers of any user who subsequently interacts with the 'Filter by tag' search feature on the homepage. All Shaarli deployments running version 0.16.1 or earlier are affected, including instances where administrators use the tag-filter feature. The vulnerability enables session hijacking or credential exfiltration against any user who triggers the tag search, with no public exploit code or CISA KEV listing identified at time of analysis. Vendor-released patch v0.16.2 (2026-05-23) resolves the issue.
Stored XSS in Shaarli's Markdown rendering pipeline (versions 0.16.1 and prior) allows an authenticated user to inject malicious javascript: URIs via Markdown reference-style links in bookmark descriptions, bypassing the filterProtocols sanitization method in BookmarkMarkdownFormatter.php. When any user or guest visitor views the crafted bookmark, arbitrary JavaScript executes in their browser context, enabling session theft or unauthorized actions. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; vendor-released patch v0.16.2 is available as of 2026-05-23.
Stored cross-site scripting in earmark (the Elixir Markdown-to-HTML library by pragdave) allows any attacker who can submit markdown content to inject arbitrary JavaScript that executes in the browsers of users who view the rendered output. The root cause is a code path in `_make_att1/2` (`lib/earmark/transform.ex`) that splices HTML attribute values verbatim without encoding double-quote characters, enabling a crafted link URL or title to break out of the `href` attribute and inject additional HTML event handlers. Critically, no patched version will be released - the library has been officially retired from Hex - making migration to a maintained alternative the only complete fix. No public exploit identified at time of analysis, though the CVE description itself contains a working proof-of-concept payload.
Stored cross-site scripting in Plane CE 1.3.1 allows an authenticated low-privileged project member to inject arbitrary HTML and JavaScript via the `description_html` field through the API v1 intake endpoint, with payloads persisting in the database and executing in the browsers of any user who views the affected intake item. The CVSS 4.0 vector rates confidentiality impact on the vulnerable system as High (VC:H), reflecting the realistic threat of session token exfiltration from higher-privileged users such as project administrators. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Open WebUI up to and including v0.9.5 allows authenticated users to execute arbitrary JavaScript in another user's browser under the application origin by uploading a malicious Markdown file containing a crafted Mermaid diagram. The flaw stems from Mermaid being initialized with securityLevel:'loose' and its SVG output being injected via innerHTML in the file preview panel. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis beyond the PoC, and the issue is not listed in CISA KEV.
Insecure direct object reference in Open WebUI calendar event update endpoint allows authenticated users to move events into any other user's calendar, bypassing destination authorization. An attacker with low-privileged user role can inject arbitrary calendar events with HTML content into a victim's private calendar, enabling phishing or spam. Publicly available exploit code exists (POC confirmed), and EPSS exploitation probability is low (0.18%, 8th percentile).
Stored Cross-Site Scripting in NocoDB (npm package, versions <= 0.301.3) allows an authenticated user with upload permissions to deliver malicious `.html` or `.svg` attachments that the victim's browser renders inline from the NocoDB origin, bypassing the intended forced-download behavior. The root cause is a header-key case mismatch in the secure attachment handler: the signed URL generator wrote overrides as PascalCase keys while the Express controller read them as lowercase-hyphen keys, silently dropping `Content-Disposition: attachment` and enabling inline rendering. When exploited, script executing in the victim's browser can exfiltrate the auth JWT stored in `localStorage`, leading to full session compromise. No public exploit code has been identified at time of analysis, and no patched version has been confirmed released.
Reflected cross-site scripting in the SweetDate Core WordPress plugin versions prior to 1.1.5 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser when the victim is lured into clicking a crafted link. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects unauthenticated network reach with required user interaction and a scope change typical of stored/reflected XSS in browser contexts. No public exploit identified at time of analysis and no EPSS or KEV signal was provided.
Reflected cross-site scripting in the Avante WordPress theme versions prior to 3.0.5 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim clicks a crafted link. Reported by Patchstack with CVSS 7.1 (scope-changed), no public exploit identified at time of analysis, but the unauthenticated nature and prevalence of WordPress themes makes this a practical phishing/account-takeover lure against site visitors and logged-in administrators.
Stored XSS in SimplCommerce's news module allows an authenticated administrator to persist arbitrary JavaScript via the ShortContent and FullContent fields of NewsItemApiController, which are stored without HTML sanitization and rendered unencoded through Razor's @Html.Raw() method. Any site visitor who subsequently loads an affected news page will execute the injected script in their browser, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing exists at time of analysis; an upstream fix is available at commit 6142d3b5 per Checkmarx's disclosure.
Reflected cross-site scripting in the Themify Folo WordPress theme (versions up to and including 1.9.6) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.1 driven by scope change and user interaction; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected or stored cross-site scripting in the Sonaar WordPress theme versions 4.27.4 and earlier allows remote unauthenticated attackers to inject malicious script into pages rendered to victims who follow a crafted link or interact with attacker-controlled content. The CVSS scope-change vector (S:C) indicates the injected script can impact resources beyond the vulnerable component, such as the WordPress admin session of a logged-in user. No public exploit identified at time of analysis, and the issue is not on CISA's KEV list.
Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Teldat's Regesta Smart HD-PLC (TLDPH16D2, firmware 11.02.05.10.02) allows a privileged, authenticated attacker to inject arbitrary JavaScript into the device's 'Hostname' configuration field, which executes in the browser of any user who subsequently loads the `/upgrade/query.php?cmd=p+3%3Bversion` endpoint. The CVSS 4.0 score of 4.8 reflects meaningful constraints: high-privilege access (PR:H) is required to write the malicious configuration, and victim user interaction (UI:P) is needed to trigger execution. No public exploit identified at time of analysis and not listed in CISA KEV; a vendor patch is available.
Stored Cross-Site Scripting in the Permalink Manager Lite WordPress plugin (all versions through 2.5.3.3) allows authenticated contributors to inject persistent JavaScript into the admin URI Editor interface via crafted post titles. The payload executes in the browser of any administrator who subsequently visits the Permalink Manager page, enabling session hijacking or unauthorized admin-level actions. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; vendor-released patch 2.5.3.4 is available.
Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.
Stored XSS in WP Magnific Popup WordPress plugin (versions through 1.0) enables authenticated attackers holding Author-level privileges or higher to persistently inject malicious scripts into WordPress pages by supplying unsanitized link URLs that the plugin renders unescaped in image load error messages. Any user visiting an affected page is silently targeted, making session hijacking, credential harvesting, or malicious redirects achievable without further attacker interaction after initial payload placement. A publicly available POC is confirmed by WPScan, though EPSS sits at only 0.19% (9th percentile), reflecting that opportunistic mass exploitation has not materialized despite exploit accessibility.
Universal Cross-Site Scripting (UXSS) in the Views component of Google Chrome on Linux (prior to 149.0.7827.155) enables an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML across security origins via a crafted HTML page, breaking Chrome's same-origin policy isolation. This is a post-renderer-compromise escalation step in a multi-stage attack chain, Linux-platform specific, requiring prior renderer RCE as a prerequisite. No public exploit code has been identified at time of analysis; EPSS sits at 0.29% (21st percentile), and CISA SSVC assesses exploitation status as none with partial technical impact.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Serial API implementation prior to version 149.0.7827.155 allows a remote, unauthenticated attacker to inject and execute arbitrary scripts or HTML across any browser origin by luring a user to a crafted HTML page. The Scope:Changed CVSS metric underscores the cross-origin nature of this flaw, which bypasses the Same-Origin Policy and can affect trusted co-loaded or previously visited sites. No active exploitation has been confirmed by CISA KEV, and EPSS at 0.27% (18th percentile) alongside SSVC 'exploitation: none' signal low real-world exploitation activity at time of analysis. Vendor-released patch: 149.0.7827.155.
Stored XSS in the HTML session export feature of pi-coding-agent allows script execution in an exported document when a user clicks a crafted Markdown link. Affected npm packages (@mariozechner/pi-coding-agent 0.27.5–0.73.1 and @earendil-works/pi-coding-agent 0.74.0–0.78.0) either omitted URL scheme validation entirely or implemented a blocklist that could be defeated by prepending C0 control characters (bytes 0x00–0x1F), which browsers silently strip before navigation. No public exploit is identified at time of analysis and this vulnerability is not in CISA KEV; the CVSS score of 2.5 and local attack vector reflect the multi-step, user-dependent exploitation chain discovered and responsibly disclosed by CrowdStrike researchers.
Reflected XSS in n8n's Facebook (Meta), WhatsApp, and Microsoft Teams webhook trigger nodes allows an attacker to execute arbitrary JavaScript in an authenticated user's browser by luring them to a crafted URL targeting the vulnerable webhook verification endpoints. Affected are all n8n deployments running version < 2.24.0 with any of the four vulnerable trigger nodes active; the CVSS scope change (S:C) means successful exploitation extends beyond the n8n component itself, enabling session hijacking or theft of API credentials stored in workflows. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is confirmed in n8n 2.24.0.
The `stripHTML` template function in Caddy web server can be bypassed with malformed HTML input such as `<<>img src=x onerror=alert()>`, allowing injected HTML tags to survive sanitization and reach the browser as executable markup, resulting in client-side XSS. Affected versions are Caddy v2 <= 2.11.3 and Caddy v1 <= 1.0.5; exploitation requires the templates middleware to be active and untrusted input to be processed via `stripHTML` and rendered without further escaping. A publicly available proof-of-concept exists per the GitHub security advisory GHSA-vcc4-2c75-vc9v; no active exploitation is confirmed in CISA KEV at time of analysis.
Reflected/unauthenticated cross-site scripting in the ThemeGoods Grand Car Rental WordPress theme versions 3.7 and earlier lets remote attackers execute arbitrary JavaScript in a victim's browser session after the victim follows a crafted link or visits a malicious page. The flaw carries a CVSS 3.1 base score of 7.1 with scope change, indicating impact beyond the vulnerable component, and no public exploit identified at time of analysis. Disclosure is coordinated through Patchstack and tracked as EUVD-2025-210174.
Reflected/stored cross-site scripting in the Qreatix WordPress theme (versions 1.9.4 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the victim interacts with a crafted link or page. The flaw is reported by Patchstack and tracked as EUVD-2025-210188; no public exploit identified at time of analysis and no CISA KEV listing. CVSS scope-change rating (7.1) reflects impact on a separate security authority - typically the WordPress admin session of a logged-in user lured to the payload.
Stored cross-site scripting in Hugo's content pipeline affects all versions prior to v0.162.0 when the site ingests HTML content from untrusted sources. Hugo emitted the body of any content file mapped to the text/html media type verbatim into the rendered output, making sites backed by CMS editors, external content adapters, or automated import pipelines potential XSS delivery vehicles to end users. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the risk is material for any Hugo deployment that does not fully trust every source populating the /content directory or content adapter pipeline.
Reflected cross-site scripting in PowerSchool Employee Access Center 23.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser context of any user who clicks a crafted login URL, with injected code evaluated directly via eval(). Reported by Palo Alto Networks Unit 42 (PANW-2026-0002), exploit code has been publicly released (CVSS 4.0 E:P), meaningfully lowering the barrier to exploitation. No active exploitation has been confirmed in CISA KEV at time of analysis, but the low-barrier phishing delivery path targeting an education-sector HR authentication page - with high subsequent-system impact - warrants treatment above the Medium CVSS 4.0 score of 5.7 implies.
Stored cross-site scripting in OpenClaw's session HTML export feature allows unsafe javascript: and data: URI schemes to survive into generated output files. All OpenClaw versions before 2026.5.12 are affected; exploitation requires a trusted operator to open an exported session HTML file and actively click a crafted link, at which point arbitrary JavaScript executes in their browser context. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the CVSS 4.0 score of 2.1 reflects the narrow attack prerequisites and limited subsequent-system impact.
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site scripting in Astro's server-side rendering pipeline allows injection of arbitrary HTML attributes and event handlers when the spread syntax `{...props}` is used with untrusted object keys. All Astro deployments — SSR, SSG, and hybrid — are affected when application code spreads props sourced from external APIs, CMS responses, or URL parameters onto HTML elements. A functional public proof-of-concept demonstrates session cookie theft via injected `onmousemove` event handlers; no active exploitation has been confirmed in CISA KEV at time of analysis.
Reflected cross-site scripting in Astro framework (versions prior to 6.3.3) allows remote attackers to inject arbitrary HTML and execute JavaScript in victim browsers when an SSR-rendered page passes user-controlled input as a slot name to a component using a client:* directive. The flaw lives in the server renderer, which interpolates the slot name into a data-astro-template attribute without HTML escaping, enabling attribute-context breakout. No public exploit identified at time of analysis beyond the reporter's PoC in the GHSA advisory, and the issue is not listed in CISA KEV.
Spoofing via CWE-1021 (UI layer restriction failure) in Mozilla Firefox's DOM Core & HTML component allows remote unauthenticated attackers to render deceptive UI content in a victim's browser when they interact with a malicious web page. All Firefox versions prior to 152 are affected. No public exploit has been identified at time of analysis, and CISA SSVC assessment classifies exploitation status as none with partial technical impact, placing real-world urgency below the moderate CVSS score suggests.
Clickjacking via the Widget: Gtk component in Mozilla Firefox allows a remote, unauthenticated attacker to deceive users on Linux desktop systems into unintended interactions with improperly restricted GTK-rendered browser UI layers. All Firefox versions prior to 152 on GTK-based Linux platforms are affected, with fixes confirmed in Mozilla Foundation Security Advisories MFSA2026-57 and MFSA2026-60. No public exploit is identified at time of analysis; SSVC rates exploitation as 'none' and EPSS sits at 0.17% (6th percentile), indicating negligible active exploitation pressure despite the network-accessible attack vector.
Stored Cross-Site Scripting in the WordPress 'File Sharing & Download Manager - User Private Files' plugin (all versions through 2.1.6) allows authenticated attackers with subscriber-level access to persistently inject malicious JavaScript via the 'fldr_ttl' (folder title) parameter. The payload is stored server-side and executes in the browsers of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing exists at time of analysis, but low privilege requirements (subscriber-level) expand the attacker pool significantly on sites with open registration.
Reflected XSS in Slim PHP framework (versions 4.4.0 through 4.15.1) allows attackers to inject arbitrary HTML and JavaScript into HTML error pages when application code passes request-derived data into HttpException::setTitle() or setDescription(). The payload executes in a victim's browser upon rendering the crafted error page, and critically this occurs even when displayErrorDetails is set to false, since the unescaped values are rendered on a separate code path. No public exploit code or CISA KEV listing has been identified; exploitation is scoped to applications that explicitly feed untrusted input into these specific exception setter methods.
Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.
Stored Cross-Site Scripting in WP Job Portal WordPress plugin versions up to and including 2.5.2 allows authenticated Subscriber-level users to inject persistent malicious JavaScript payloads that execute in other users' browsers, including administrators. The CVSS S:C scope change confirms the injected script crosses the security boundary into victims' browser sessions, enabling session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement makes this realistic on open-registration WordPress job-board deployments.
Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) allows authenticated subscribers to inject and persist malicious JavaScript payloads within plugin-rendered content. The scope-changed CVSS vector (S:C) reflects that injected scripts execute in the browsers of other site users - including administrators - enabling session hijacking and privilege escalation via social engineering. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the moderate-priority tier despite the network-reachable attack surface.
Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.
Cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.7.2) allows injection of malicious scripts that execute in the context of other users' browsers. The official CVSS vector assigns PR:L (low privileges required), which directly contradicts the CVE description's claim of 'unauthenticated' exploitation - this discrepancy must be resolved with the vendor before accurate risk tiering. With a scope-changed impact (S:C), the primary concern is an attacker inducing a privileged user such as a WordPress administrator to trigger the payload, enabling session hijacking or unauthorized administrative actions. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
Cross-site scripting in the Contest Gallery WordPress plugin (versions <= 28.1.6) can be triggered by a subscriber-level authenticated user, injecting malicious scripts that execute in the browsers of higher-privileged users such as administrators. The CVSS Scope:Changed metric confirms the payload escapes the subscriber's privilege boundary and impacts other user sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad WordPress ecosystem deployment surface make this a meaningful risk for any site accepting subscriber registrations.
Cross-site scripting in ProfilePress WordPress plugin versions up to and including 4.16.13 allows authenticated subscribers to inject malicious JavaScript payloads that execute in the browsers of other users - including administrators - who view affected content. The CVSS scope change (S:C) indicator confirms this is a stored or reflected XSS that crosses privilege boundaries, enabling low-privilege users to target higher-privilege accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Shipment Tracker for WooCommerce WordPress plugin (versions up to and including 1.5.3.2) allows authenticated subscriber-level users to inject malicious scripts that execute in a privileged user's browser session. The CVSS scope-change flag (S:C) indicates the injected payload crosses into the administrator's browser context, enabling session hijacking, credential theft, or unauthorized admin actions. Reported by Patchstack with no public exploit code identified at time of analysis and no CISA KEV listing.
Stored or reflected Cross-Site Scripting in the JupiterX Core WordPress plugin (versions up to and including 4.14.1) allows low-privilege authenticated users with Subscriber roles to inject malicious JavaScript that executes in the browser context of other users, including administrators. The scope change component (S:C in CVSS) confirms the payload crosses security boundaries, enabling session hijacking, credential theft, or unauthorized administrative actions against victims who view attacker-controlled content. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.
Reflected cross-site scripting in Eli's WordCents adSense Widget with Analytics WordPress plugin (versions <= 1.3.03.27) allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the user is lured into clicking a crafted link. The flaw stems from improper neutralization of user-supplied input (CWE-79), and while no public exploit identified at time of analysis, the scope-changing CVSS vector indicates potential for session hijacking or administrative account takeover if a logged-in WordPress admin is targeted.
Reflected cross-site scripting in the Okay Toolkit WordPress plugin (versions ≤2.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with a scope-changed impact, but no public exploit identified at time of analysis and EPSS data was not provided. Successful exploitation can lead to session hijacking, credential theft, or administrative actions against the targeted WordPress site.
Reflected cross-site scripting in the iRobots.txt SEO WordPress plugin (versions 1.1.2 and earlier) allows remote unauthenticated attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.1 driven by a scope change, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. Exploitation requires user interaction, which limits mass-scale weaponization but makes it viable for targeted phishing against WordPress administrators.
DOMPurify's HTML sanitizer silently skips shadow DOM contents nested inside <template> elements, allowing stored or reflected XSS payloads to survive sanitization untouched in versions up to and including 3.4.6. When a consuming application clones and inserts the sanitized template into the live DOM - the standard and intended usage pattern for HTML templates - any attacker-controlled payload within the shadow root executes with full script privileges in the victim's browser context. A publicly available proof-of-concept (poc.html) has been released alongside the advisory; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the low attack complexity and broad deployment of DOMPurify across web applications make this a high-priority patching target.
Cross-site scripting in DOMPurify ≤ 3.4.5 allows attackers to preserve executable markup through the library's IN_PLACE sanitization path by exploiting JavaScript's per-realm constructor architecture. When `DOMPurify.sanitize(node, { IN_PLACE: true })` receives a DOM node constructed in a different same-origin realm (iframe, popup, `<iframe srcdoc>`), the internal security checks `_isClobbered`, `_sanitizeShadowDOM`, and `_sanitizeAttachedShadowRoots` each perform realm-bound `instanceof` comparisons that silently return false for foreign-realm objects, causing the library to skip DOM-clobbering protection, template-content recursion, and shadow-root sanitization. Three working proof-of-concept scripts demonstrating form-attribute bypass, template-content bypass, and shadow-DOM bypass have been published by the advisory authors; no active exploitation or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in DOMPurify ≤ 3.4.5 allows attacker-controlled event handlers, javascript: URIs, and template syntax to survive sanitization when the IN_PLACE: true API is used with an HTMLFormElement root. Two interacting bugs create the bypass: _forceRemove silently no-ops on detached (parent-less) nodes per WebIDL spec, and _sanitizeAttributes unconditionally early-returns on clobbered nodes under the now-broken assumption that _sanitizeElements already removed them. A publicly available working PoC has been verified against Chromium 148.0.7778.96 and DOMPurify 3.4.5 including the HEAD commit 89da34e, which addressed a related shadow-root traversal issue but left this main-pipeline path unpatched. No KEV listing is present at time of analysis.
DOM sanitization bypass in @angular/compiler allows client-side XSS in Angular applications that use two-way property binding syntax on security-sensitive native DOM properties. The Angular template compiler's sanitizer-resolution phase omitted a case for the TwoWayProperty IR operation, meaning compiled templates with [(innerHTML)], [(src)], [(href)], [(srcdoc)], [(data)], or [(sandbox)] bindings emit the runtime ɵɵtwoWayProperty() instruction without the required sanitizer function argument, while identical one-way [property] bindings are correctly protected. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the patch diff in PR #69107 fully characterizes the missing code path.
Cross-site scripting execution is possible in Angular applications (@angular/compiler and @angular/core) through a dual-bypass of the framework's template sanitization engine using XML namespace prefixes. The Angular template preparser used a simple string comparison for 'script' that failed to match namespaced representations such as ':svg:script', allowing those elements to survive template compilation unstripped. Concurrently, the security context schema mappings for namespaced SVG and MathML attributes were incomplete, allowing malicious attribute bindings to evade both compile-time and runtime sanitizers. No public exploit has been identified at time of analysis, and exploitation requires the specific non-default deployment condition of runtime JIT template compilation with user-controlled input.
Dynamic component mounting in @angular/core permits client-side XSS by failing to reject script elements as valid host targets for `createComponent`. Angular applications that pass user-supplied selectors or host element references to the `createComponent` API without prior sanitization are vulnerable to namespace bypass, allowing an attacker to mount Angular components onto `<script>` or `<svg:script>` elements and execute arbitrary JavaScript in the victim's browser. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but vendor-released patches are available across multiple supported major versions.
Stored XSS in the Symfony HtmlSanitizer component (symfony/html-sanitizer) allows injection of javascript: scheme URLs through HTML attributes not covered by the library's URL sanitization allow-list. The UrlAttributeSanitizer hardcodes a fixed set of URL-bearing attributes to sanitize, omitting data (on object), codebase and archive (on applet), and longdesc (on iframe/img); a related gap allows javascript: URLs embedded in meta http-equiv=refresh content values to pass through unchanged. Only non-default configurations that explicitly opt in to those element-attribute combinations via allowElement() or allowAttribute() are affected - default Symfony configurations are confirmed safe. No public exploit code has been identified at time of analysis, though the vendor advisory includes functional proof-of-concept payloads; the issue was reported by Scott Arciszewski of Trail of Bits.
Reflected XSS in Valhalla's JSONP endpoint allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing payload in the callback parameter. All versions through 3.6.3 are affected, and the CVSS scope change (S:C) reflects that execution occurs in the serving origin's context rather than a sandboxed one, enabling session theft and unauthorized actions on authenticated victims. No patch was available at time of publication, and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Elizaibots WordPress chatbot plugin (versions <= 1.0.2) allows authenticated Contributor-level users to inject malicious scripts that execute in the browser context of higher-privileged users - including site administrators - when they visit affected pages. The CVSS scope-change indicator (S:C) confirms the payload escapes the contributor's privilege boundary and can compromise admin sessions, enabling privilege escalation or site takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the WP Emmet WordPress plugin (by rewish) versions 0.3.4 and earlier allows an administrator-level user to inject persistent malicious scripts through the plugin interface, which then execute in the browsers of other users who visit affected pages. The CVSS scope-change metric (S:C) confirms the injected payload crosses trust boundaries beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized actions against victims. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA KEV.
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in the Form Builder CP WordPress plugin (all versions before 1.2.47) allows authenticated users holding Editor-level access or above to inject persistent malicious scripts via unsanitized form configuration values, which execute in every visitor's browser upon rendering the affected form. Critically, this attack succeeds even when WordPress's `unfiltered_html` capability has been revoked - a control that multisite administrators commonly rely on to prevent exactly this class of injection from Editor-level roles. A publicly available exploit exists per WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and the EPSS score of 0.19% (9th percentile) reflects limited automated mass exploitation at time of analysis.
Cross-site scripting in Intelliants Subrion CMS up to version 4.0.3 allows an authenticated high-privilege attacker to inject malicious JavaScript via the CSS class name argument in the Blocks Endpoint, executing in a victim user's browser upon viewing the manipulated block. Publicly available exploit code exists (disclosed on HackMD), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis. Exploitation is constrained by a high-privilege authentication requirement and mandatory user interaction, limiting opportunistic mass exploitation but posing meaningful insider-threat and compromised-credential risk.
Cross-site scripting in PublicCMS V5.202506.d allows unauthenticated network-accessible attackers to inject malicious scripts via the site configuration management module, which execute in the browser of any user who subsequently views the affected page. The CVSS scope change (S:C) indicates injected code escapes the vulnerable component's security context, making administrator session hijacking the primary realistic impact. A proof-of-concept is publicly available on GitHub Gist per SSVC classification, though EPSS remains very low at 0.15% (4th percentile) and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog.
Cross-site scripting in RuoYi 4.8.2 enables script injection via the /system/notice/add endpoint, executing malicious payloads in the browsers of users who subsequently view the injected notice content. The CVSS Scope:Changed designation confirms the impact escapes the originating component's trust boundary, affecting victim sessions across the application. A proof-of-concept is available per SSVC data; however, no CISA KEV listing exists and the EPSS score of 0.15% (4th percentile) reflects negligible observed exploitation probability at time of analysis.
Cross-site scripting in Deck9 Input v2.0.1 enables authenticated attackers to inject arbitrary JavaScript or HTML via crafted input payloads that execute within other users' browser sessions. The CVSS scope-changed vector (S:C, PR:L, UI:R) confirms the impact crosses user boundaries - a single low-privileged attacker can affect multiple victims - though account access and victim interaction are prerequisites. EPSS at 0.15% (4th percentile) and SSVC Exploitation: none indicate no current active exploitation; no CISA KEV listing is present.
Cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via the unsanitized `action` parameter in `/index.php`. Publicly available exploit code exists (CVSS 4.0 E:P), and the attack requires no authentication, only that a victim interact with a crafted URL or request. No vendor-released patch has been identified at time of analysis.
Stored Cross-Site Scripting in the Canvas plugin for WordPress (versions ≤ 2.5.2) allows an authenticated attacker holding contributor-level access or above to inject persistent JavaScript via the unsanitized 'tag' parameter in the block-section-heading Gutenberg block. The payload is stored in the database and executes in the browser of any user who subsequently loads the compromised page, enabling session hijacking, credential theft, or malicious redirects at scale. No active exploitation is confirmed (not listed in CISA KEV), but the low privilege bar makes this a realistic threat on multi-author WordPress installations; a fix is available in version 2.5.3.
Stored cross-site scripting in the Pagelayer Drag and Drop website builder plugin for WordPress (versions up to and including 2.0.9) allows authenticated contributors to inject persistent malicious scripts via the Anchor block component. Any site visitor - including privileged administrators - who loads an injected page will execute the attacker-supplied script in their browser, enabling session token theft, credential harvesting, or privilege escalation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; however, the low authentication barrier (contributor-level) makes it realistically accessible on multi-author WordPress sites.
Stored Cross-Site Scripting in FooGallery WordPress plugin versions through 3.1.31 allows authenticated contributors to inject persistent JavaScript via the 'custom_attribute_key' shortcode parameter, executing against any visitor who views an affected page. The flaw combines a bypass-prone event-handler blacklist in foogallery_sanitize_javascript() - which omits handlers like 'onmouseenter' - with unescaped attribute key output in foogallery_build_container_attributes_safe(), together enabling DOM-level script injection. A patched version 3.1.32 is confirmed released; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject persistent malicious scripts via unsanitized store logo metadata, which executes when the admin page is rendered in another user's browser. The vulnerability is especially significant in WordPress multisite networks because it bypasses the `unfiltered_html` capability restriction - a control specifically intended to prevent administrators from injecting raw HTML and scripts. A public POC is documented by WPScan; no active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% indicates low current exploitation probability.
Cross-site scripting in Allegra's downloadAttachment method enables authenticated remote attackers to inject and execute arbitrary JavaScript within a victim user's browser session. Exploitation requires an authenticated low-privilege attacker account and mandatory victim interaction - the target must visit a malicious page or open a crafted file - limiting the realistic attack surface. Reported by Zero Day Initiative (ZDI-CAN-28236 / ZDI-26-358), patched in Allegra 9.0.0. No public exploit code and no active exploitation (CISA KEV) identified at time of analysis.
Cross-site scripting in Fabric.js (npm: fabric) versions prior to 7.4.0 is triggered when applications export canvas content via `canvas.toSVG()` and render the result into the DOM using `innerHTML`. The `color` field within `colorStops` of a `fabric.Gradient` object is inserted into SVG `<stop>` elements without escaping `"`, `<`, or `>`, allowing crafted input to break attribute context and inject arbitrary HTML. A working proof-of-concept is publicly confirmed against v7.2.0; no active exploitation appears in CISA KEV, and the EPSS score of 0.04% reflects low observed exploitation breadth consistent with the chained conditions required.
Cross-site scripting in sanitize-html prior to 2.17.5 allows low-privileged attackers to inject executable `javascript:` URIs through HTML attributes that the library's scheme-blocking logic never inspects. The `naughtyHref()` function gates dangerous URI schemes only for attributes listed in `allowedSchemesAppliedToAttributes` (defaulting to `href`, `src`, and `cite`), leaving attributes such as `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc` entirely unchecked. Applications that explicitly permit any of these attributes in their sanitize-html configuration are vulnerable; no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in ApostropheCMS up to and including version 4.29.0 allows an attacker who controls a user account to inject malicious script into the draft version tooltip via an unsanitized display name field. Any editor or administrator who subsequently views that tooltip in the CMS backend will execute the attacker's payload in their browser, enabling session hijacking or unauthorized action execution. No public exploit has been identified at time of analysis and no patched version is available per the vendor advisory.
Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 allows an authenticated low-privilege user to inject persistent malicious script via the `protitle` argument on the `/Projects/Add_Projects` endpoint. When any other authenticated user (e.g., an HR administrator) subsequently views the Projects Management Page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. A public proof-of-concept exploit is hosted on GitHub, lowering the bar for exploitation, though KEV listing is absent and the CVSS 4.0 score of 2.0 reflects the constrained impact scope.
Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.
Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 allows an authenticated remote attacker to inject persistent malicious scripts via the `todo_data` parameter at the `/dashboard/add_tod` endpoint. When a higher-privileged user subsequently views the to-do list in the dashboard, the stored payload executes silently in their browser context, enabling session hijacking or unauthorized privileged actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists at time of analysis, but the low barrier to exploitation for any authenticated user elevates practical risk above the CVSS 4.0 score of 2.0 implies.
Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.
Stored XSS in Parse Server is achievable by authenticated users who bypass the file upload extension blocklist by appending a trailing dot to a blocked filename (e.g., `poc.svg.`), causing the extension parser to return an empty string and skip the block check. The attacker-supplied Content-Type is forwarded unchanged to cloud storage adapters (S3, GCS), which persist and serve the file under that active MIME type - enabling script execution in a victim's browser when the file URL is opened. No active exploitation is confirmed (not in CISA KEV, EPSS 0.05% at 15th percentile), but the attack mechanism is low-complexity and fully documented in the vendor's fix PRs. Patches are available in versions 8.6.79 and 9.9.1-alpha.4.
Stored XSS in Frappe's Report and List View components allows injection of persistent JavaScript payloads that execute in the browsers of any user who subsequently accesses the affected views. All Frappe deployments on the v15 branch prior to 15.107.2 and v16 branch prior to 16.17.4 are affected per the GitHub security advisory GHSA-rx63-c3fh-8926. No public exploit has been identified at time of analysis and the EPSS score of 0.02% (7th percentile) reflects low current exploitation probability, though the network-accessible nature of Frappe instances keeps this relevant for organizations running unpatched versions.
Stored cross-site scripting in Frappe's user profile image section enables script injection that executes in the browsers of any user who views the compromised profile. Affected versions are all Frappe releases prior to 15.106.0. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.02% (7th percentile) reflects low observed exploitation activity, though stored XSS in a shared framework carries inherent persistence risk across all applications built on Frappe.
Stored cross-site scripting in the Frappe framework's Note feature allows a low-privileged attacker to persist malicious JavaScript that executes in the browsers of users who subsequently view the poisoned note. All Frappe deployments on the v15 branch prior to 15.106.0 and the v16 branch prior to 16.16.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed patches are available and should be applied promptly given the ease of exploitation once an attacker holds any valid user account.
Reflected DOM-based XSS in Nuxt's built-in <NuxtLink> component allows an unauthenticated attacker to inject script-capable URLs (javascript:, vbscript:) that execute in the application's origin when a victim clicks a crafted link, affecting all Nuxt v3 versions prior to 3.21.7 and v4 versions prior to 4.4.7. Exploitation is contingent on application code that binds attacker-controlled input - such as query parameters, CMS link fields, or user-supplied profile URLs - directly to the component's to or href props without prior sanitization. No public exploit code has been identified and the EPSS score of 0.06% (20th percentile) indicates low observed exploitation probability; vendor-released patches are available in versions 3.21.7 and 4.4.7.
Stored Cross-Site Scripting in the Secure Copy Content Protection and Content Locking WordPress plugin (all versions before 5.1.5) enables high-privilege users such as administrators to inject persistent malicious scripts through unsanitized plugin settings fields. This is particularly impactful in WordPress multisite environments, where the unfiltered_html capability is typically revoked from administrators, making this bypass noteworthy - the plugin fails to enforce its own output escaping independently of WordPress core capabilities. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS places this at the 9th percentile for exploitation probability.
Stored XSS in the Presto Player WordPress plugin (versions ≤ 4.2.0) lets authenticated contributors persist arbitrary JavaScript payloads by supplying a javascript: URI as the link_url parameter of the [presto_player_overlay] shortcode. The getOverlays() function in Shortcodes.php copies the attribute into overlay configuration without scheme validation, causing the URI to survive into the href attribute rendered by the presto-dynamic-overlay-ui Stencil.js web component; any visitor who loads the injected page triggers execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity within the contributor-access constraint makes this a realistic risk on multi-author or membership-based WordPress installations.
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
Denial of service on the GitLab CI/CD Catalog page is achievable by any authenticated user across a broad version range (17.0 through pre-patch releases of 18.10, 18.11, and 19.0) due to improper sanitization of user-supplied content. The low-privilege, network-accessible attack vector means any GitLab account holder can trigger the condition without elevated permissions or complex setup. No public exploit code or CISA KEV listing has been identified at time of analysis, and the limited availability impact (A:L) constrains real-world severity, though the wide version exposure across three concurrent release branches broadens organizational risk.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Spring Web Flow's JavaScript RemotingHandler allows an authenticated attacker to inject and execute arbitrary scripts in a victim's browser by embedding malicious content in input that the server reflects within error response bodies. The RemotingHandler renders these error bodies as HTML regardless of the declared Content-Type, bypassing MIME-type enforcement. Affected versions span the 2.5.x, 3.0.x, and 4.0.0 release lines; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Open User Map PRO WordPress plugin (versions ≤ 1.4.31) via the 'oum_location_notification' parameter enables unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages. The injected payload executes in any visitor's browser upon accessing the affected page, with scope extending beyond the originating application context (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface lowers the barrier for mass exploitation against unpatched sites.
Stored XSS in Shaarli's tag filtering functionality permits an authenticated user to inject persistent JavaScript payloads via the bookmark tags field, which execute in the browsers of any user who subsequently interacts with the 'Filter by tag' search feature on the homepage. All Shaarli deployments running version 0.16.1 or earlier are affected, including instances where administrators use the tag-filter feature. The vulnerability enables session hijacking or credential exfiltration against any user who triggers the tag search, with no public exploit code or CISA KEV listing identified at time of analysis. Vendor-released patch v0.16.2 (2026-05-23) resolves the issue.
Stored XSS in Shaarli's Markdown rendering pipeline (versions 0.16.1 and prior) allows an authenticated user to inject malicious javascript: URIs via Markdown reference-style links in bookmark descriptions, bypassing the filterProtocols sanitization method in BookmarkMarkdownFormatter.php. When any user or guest visitor views the crafted bookmark, arbitrary JavaScript executes in their browser context, enabling session theft or unauthorized actions. No public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV; vendor-released patch v0.16.2 is available as of 2026-05-23.
Stored cross-site scripting in earmark (the Elixir Markdown-to-HTML library by pragdave) allows any attacker who can submit markdown content to inject arbitrary JavaScript that executes in the browsers of users who view the rendered output. The root cause is a code path in `_make_att1/2` (`lib/earmark/transform.ex`) that splices HTML attribute values verbatim without encoding double-quote characters, enabling a crafted link URL or title to break out of the `href` attribute and inject additional HTML event handlers. Critically, no patched version will be released - the library has been officially retired from Hex - making migration to a maintained alternative the only complete fix. No public exploit identified at time of analysis, though the CVE description itself contains a working proof-of-concept payload.
Stored cross-site scripting in Plane CE 1.3.1 allows an authenticated low-privileged project member to inject arbitrary HTML and JavaScript via the `description_html` field through the API v1 intake endpoint, with payloads persisting in the database and executing in the browsers of any user who views the affected intake item. The CVSS 4.0 vector rates confidentiality impact on the vulnerable system as High (VC:H), reflecting the realistic threat of session token exfiltration from higher-privileged users such as project administrators. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Open WebUI up to and including v0.9.5 allows authenticated users to execute arbitrary JavaScript in another user's browser under the application origin by uploading a malicious Markdown file containing a crafted Mermaid diagram. The flaw stems from Mermaid being initialized with securityLevel:'loose' and its SVG output being injected via innerHTML in the file preview panel. Publicly available exploit code exists in the GHSA advisory, but there is no public exploit identified at time of analysis beyond the PoC, and the issue is not listed in CISA KEV.
Insecure direct object reference in Open WebUI calendar event update endpoint allows authenticated users to move events into any other user's calendar, bypassing destination authorization. An attacker with low-privileged user role can inject arbitrary calendar events with HTML content into a victim's private calendar, enabling phishing or spam. Publicly available exploit code exists (POC confirmed), and EPSS exploitation probability is low (0.18%, 8th percentile).
Stored Cross-Site Scripting in NocoDB (npm package, versions <= 0.301.3) allows an authenticated user with upload permissions to deliver malicious `.html` or `.svg` attachments that the victim's browser renders inline from the NocoDB origin, bypassing the intended forced-download behavior. The root cause is a header-key case mismatch in the secure attachment handler: the signed URL generator wrote overrides as PascalCase keys while the Express controller read them as lowercase-hyphen keys, silently dropping `Content-Disposition: attachment` and enabling inline rendering. When exploited, script executing in the victim's browser can exfiltrate the auth JWT stored in `localStorage`, leading to full session compromise. No public exploit code has been identified at time of analysis, and no patched version has been confirmed released.
Reflected cross-site scripting in the SweetDate Core WordPress plugin versions prior to 1.1.5 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser when the victim is lured into clicking a crafted link. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects unauthenticated network reach with required user interaction and a scope change typical of stored/reflected XSS in browser contexts. No public exploit identified at time of analysis and no EPSS or KEV signal was provided.
Reflected cross-site scripting in the Avante WordPress theme versions prior to 3.0.5 allows unauthenticated remote attackers to inject script that executes in a victim's browser when the victim clicks a crafted link. Reported by Patchstack with CVSS 7.1 (scope-changed), no public exploit identified at time of analysis, but the unauthenticated nature and prevalence of WordPress themes makes this a practical phishing/account-takeover lure against site visitors and logged-in administrators.
Stored XSS in SimplCommerce's news module allows an authenticated administrator to persist arbitrary JavaScript via the ShortContent and FullContent fields of NewsItemApiController, which are stored without HTML sanitization and rendered unencoded through Razor's @Html.Raw() method. Any site visitor who subsequently loads an affected news page will execute the injected script in their browser, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing exists at time of analysis; an upstream fix is available at commit 6142d3b5 per Checkmarx's disclosure.
Reflected cross-site scripting in the Themify Folo WordPress theme (versions up to and including 1.9.6) allows remote attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw is reported by Patchstack with a CVSS 3.1 base score of 7.1 driven by scope change and user interaction; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Reflected or stored cross-site scripting in the Sonaar WordPress theme versions 4.27.4 and earlier allows remote unauthenticated attackers to inject malicious script into pages rendered to victims who follow a crafted link or interact with attacker-controlled content. The CVSS scope-change vector (S:C) indicates the injected script can impact resources beyond the vulnerable component, such as the WordPress admin session of a logged-in user. No public exploit identified at time of analysis, and the issue is not on CISA's KEV list.
Unauthenticated Cross Site Scripting (XSS) in my flatonica <= 0.0.8 versions. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Stored cross-site scripting in Teldat's Regesta Smart HD-PLC (TLDPH16D2, firmware 11.02.05.10.02) allows a privileged, authenticated attacker to inject arbitrary JavaScript into the device's 'Hostname' configuration field, which executes in the browser of any user who subsequently loads the `/upgrade/query.php?cmd=p+3%3Bversion` endpoint. The CVSS 4.0 score of 4.8 reflects meaningful constraints: high-privilege access (PR:H) is required to write the malicious configuration, and victim user interaction (UI:P) is needed to trigger execution. No public exploit identified at time of analysis and not listed in CISA KEV; a vendor patch is available.
Stored Cross-Site Scripting in the Permalink Manager Lite WordPress plugin (all versions through 2.5.3.3) allows authenticated contributors to inject persistent JavaScript into the admin URI Editor interface via crafted post titles. The payload executes in the browser of any administrator who subsequently visits the Permalink Manager page, enabling session hijacking or unauthorized admin-level actions. No active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis; vendor-released patch 2.5.3.4 is available.
Stored XSS in the myCred WordPress plugin (versions up to and including 3.1) allows authenticated attackers holding contributor-level access or above to inject persistent JavaScript payloads via the unsanitized 'wrap' shortcode attribute in the leaderboard shortcode handler. When any user - including administrators - visits a page containing the injected shortcode, the payload executes in their browser, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis; fix is available in version 3.1.1 as confirmed by WordPress plugin trac changeset 3572451.
Stored XSS in WP Magnific Popup WordPress plugin (versions through 1.0) enables authenticated attackers holding Author-level privileges or higher to persistently inject malicious scripts into WordPress pages by supplying unsanitized link URLs that the plugin renders unescaped in image load error messages. Any user visiting an affected page is silently targeted, making session hijacking, credential harvesting, or malicious redirects achievable without further attacker interaction after initial payload placement. A publicly available POC is confirmed by WPScan, though EPSS sits at only 0.19% (9th percentile), reflecting that opportunistic mass exploitation has not materialized despite exploit accessibility.
Universal Cross-Site Scripting (UXSS) in the Views component of Google Chrome on Linux (prior to 149.0.7827.155) enables an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML across security origins via a crafted HTML page, breaking Chrome's same-origin policy isolation. This is a post-renderer-compromise escalation step in a multi-stage attack chain, Linux-platform specific, requiring prior renderer RCE as a prerequisite. No public exploit code has been identified at time of analysis; EPSS sits at 0.29% (21st percentile), and CISA SSVC assesses exploitation status as none with partial technical impact.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Serial API implementation prior to version 149.0.7827.155 allows a remote, unauthenticated attacker to inject and execute arbitrary scripts or HTML across any browser origin by luring a user to a crafted HTML page. The Scope:Changed CVSS metric underscores the cross-origin nature of this flaw, which bypasses the Same-Origin Policy and can affect trusted co-loaded or previously visited sites. No active exploitation has been confirmed by CISA KEV, and EPSS at 0.27% (18th percentile) alongside SSVC 'exploitation: none' signal low real-world exploitation activity at time of analysis. Vendor-released patch: 149.0.7827.155.
Stored XSS in the HTML session export feature of pi-coding-agent allows script execution in an exported document when a user clicks a crafted Markdown link. Affected npm packages (@mariozechner/pi-coding-agent 0.27.5–0.73.1 and @earendil-works/pi-coding-agent 0.74.0–0.78.0) either omitted URL scheme validation entirely or implemented a blocklist that could be defeated by prepending C0 control characters (bytes 0x00–0x1F), which browsers silently strip before navigation. No public exploit is identified at time of analysis and this vulnerability is not in CISA KEV; the CVSS score of 2.5 and local attack vector reflect the multi-step, user-dependent exploitation chain discovered and responsibly disclosed by CrowdStrike researchers.
Reflected XSS in n8n's Facebook (Meta), WhatsApp, and Microsoft Teams webhook trigger nodes allows an attacker to execute arbitrary JavaScript in an authenticated user's browser by luring them to a crafted URL targeting the vulnerable webhook verification endpoints. Affected are all n8n deployments running version < 2.24.0 with any of the four vulnerable trigger nodes active; the CVSS scope change (S:C) means successful exploitation extends beyond the n8n component itself, enabling session hijacking or theft of API credentials stored in workflows. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is confirmed in n8n 2.24.0.
The `stripHTML` template function in Caddy web server can be bypassed with malformed HTML input such as `<<>img src=x onerror=alert()>`, allowing injected HTML tags to survive sanitization and reach the browser as executable markup, resulting in client-side XSS. Affected versions are Caddy v2 <= 2.11.3 and Caddy v1 <= 1.0.5; exploitation requires the templates middleware to be active and untrusted input to be processed via `stripHTML` and rendered without further escaping. A publicly available proof-of-concept exists per the GitHub security advisory GHSA-vcc4-2c75-vc9v; no active exploitation is confirmed in CISA KEV at time of analysis.
Reflected/unauthenticated cross-site scripting in the ThemeGoods Grand Car Rental WordPress theme versions 3.7 and earlier lets remote attackers execute arbitrary JavaScript in a victim's browser session after the victim follows a crafted link or visits a malicious page. The flaw carries a CVSS 3.1 base score of 7.1 with scope change, indicating impact beyond the vulnerable component, and no public exploit identified at time of analysis. Disclosure is coordinated through Patchstack and tracked as EUVD-2025-210174.
Reflected/stored cross-site scripting in the Qreatix WordPress theme (versions 1.9.4 and earlier) allows remote unauthenticated attackers to inject arbitrary script that executes in a victim's browser after the victim interacts with a crafted link or page. The flaw is reported by Patchstack and tracked as EUVD-2025-210188; no public exploit identified at time of analysis and no CISA KEV listing. CVSS scope-change rating (7.1) reflects impact on a separate security authority - typically the WordPress admin session of a logged-in user lured to the payload.
Stored cross-site scripting in Hugo's content pipeline affects all versions prior to v0.162.0 when the site ingests HTML content from untrusted sources. Hugo emitted the body of any content file mapped to the text/html media type verbatim into the rendered output, making sites backed by CMS editors, external content adapters, or automated import pipelines potential XSS delivery vehicles to end users. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the risk is material for any Hugo deployment that does not fully trust every source populating the /content directory or content adapter pipeline.
Reflected cross-site scripting in PowerSchool Employee Access Center 23.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser context of any user who clicks a crafted login URL, with injected code evaluated directly via eval(). Reported by Palo Alto Networks Unit 42 (PANW-2026-0002), exploit code has been publicly released (CVSS 4.0 E:P), meaningfully lowering the barrier to exploitation. No active exploitation has been confirmed in CISA KEV at time of analysis, but the low-barrier phishing delivery path targeting an education-sector HR authentication page - with high subsequent-system impact - warrants treatment above the Medium CVSS 4.0 score of 5.7 implies.
Stored cross-site scripting in OpenClaw's session HTML export feature allows unsafe javascript: and data: URI schemes to survive into generated output files. All OpenClaw versions before 2026.5.12 are affected; exploitation requires a trusted operator to open an exported session HTML file and actively click a crafted link, at which point arbitrary JavaScript executes in their browser context. No public exploit has been identified at time of analysis and no CISA KEV listing exists; the CVSS 4.0 score of 2.1 reflects the narrow attack prerequisites and limited subsequent-system impact.
PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. This Cross-Site Scripting (XSS) vulnerability could allow attackers to inject malicious scripts into web pages viewed by other users.
Cross-site scripting in Astro's server-side rendering pipeline allows injection of arbitrary HTML attributes and event handlers when the spread syntax `{...props}` is used with untrusted object keys. All Astro deployments — SSR, SSG, and hybrid — are affected when application code spreads props sourced from external APIs, CMS responses, or URL parameters onto HTML elements. A functional public proof-of-concept demonstrates session cookie theft via injected `onmousemove` event handlers; no active exploitation has been confirmed in CISA KEV at time of analysis.
Reflected cross-site scripting in Astro framework (versions prior to 6.3.3) allows remote attackers to inject arbitrary HTML and execute JavaScript in victim browsers when an SSR-rendered page passes user-controlled input as a slot name to a component using a client:* directive. The flaw lives in the server renderer, which interpolates the slot name into a data-astro-template attribute without HTML escaping, enabling attribute-context breakout. No public exploit identified at time of analysis beyond the reporter's PoC in the GHSA advisory, and the issue is not listed in CISA KEV.
Spoofing via CWE-1021 (UI layer restriction failure) in Mozilla Firefox's DOM Core & HTML component allows remote unauthenticated attackers to render deceptive UI content in a victim's browser when they interact with a malicious web page. All Firefox versions prior to 152 are affected. No public exploit has been identified at time of analysis, and CISA SSVC assessment classifies exploitation status as none with partial technical impact, placing real-world urgency below the moderate CVSS score suggests.
Clickjacking via the Widget: Gtk component in Mozilla Firefox allows a remote, unauthenticated attacker to deceive users on Linux desktop systems into unintended interactions with improperly restricted GTK-rendered browser UI layers. All Firefox versions prior to 152 on GTK-based Linux platforms are affected, with fixes confirmed in Mozilla Foundation Security Advisories MFSA2026-57 and MFSA2026-60. No public exploit is identified at time of analysis; SSVC rates exploitation as 'none' and EPSS sits at 0.17% (6th percentile), indicating negligible active exploitation pressure despite the network-accessible attack vector.
Stored Cross-Site Scripting in the WordPress 'File Sharing & Download Manager - User Private Files' plugin (all versions through 2.1.6) allows authenticated attackers with subscriber-level access to persistently inject malicious JavaScript via the 'fldr_ttl' (folder title) parameter. The payload is stored server-side and executes in the browsers of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit or CISA KEV listing exists at time of analysis, but low privilege requirements (subscriber-level) expand the attacker pool significantly on sites with open registration.
Reflected XSS in Slim PHP framework (versions 4.4.0 through 4.15.1) allows attackers to inject arbitrary HTML and JavaScript into HTML error pages when application code passes request-derived data into HttpException::setTitle() or setDescription(). The payload executes in a victim's browser upon rendering the crafted error page, and critically this occurs even when displayErrorDetails is set to false, since the unescaped values are rendered on a separate code path. No public exploit code or CISA KEV listing has been identified; exploitation is scoped to applications that explicitly feed untrusted input into these specific exception setter methods.
Stored Cross-Site Scripting in the FV Flowplayer Video Player WordPress plugin (versions below 7.5.51.7212) allows low-privileged authenticated users - specifically those with subscriber-level access - to inject persistent malicious JavaScript that executes in the browsers of other site visitors or administrators who view affected content. The Scope:Changed CVSS metric confirms the payload escapes the plugin's trust boundary and can target higher-privileged sessions. No public exploit identified at time of analysis, and SSVC signals no confirmed exploitation; a vendor-released patch is available at version 7.5.51.7212.
Stored Cross-Site Scripting in WP Job Portal WordPress plugin versions up to and including 2.5.2 allows authenticated Subscriber-level users to inject persistent malicious JavaScript payloads that execute in other users' browsers, including administrators. The CVSS S:C scope change confirms the injected script crosses the security boundary into victims' browser sessions, enabling session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement makes this realistic on open-registration WordPress job-board deployments.
Stored Cross-Site Scripting in the King Addons for Elementor WordPress plugin (versions up to and including 51.1.62) allows authenticated subscribers to inject and persist malicious JavaScript payloads within plugin-rendered content. The scope-changed CVSS vector (S:C) reflects that injected scripts execute in the browsers of other site users - including administrators - enabling session hijacking and privilege escalation via social engineering. No public exploit code and no CISA KEV listing have been identified at time of analysis, placing this in the moderate-priority tier despite the network-reachable attack surface.
Subscriber-level stored Cross-Site Scripting in the Modula Image Gallery WordPress plugin (versions up to and including 2.14.23) allows authenticated users with subscriber privileges to inject persistent malicious JavaScript into gallery content. When a higher-privileged user such as an administrator views the affected gallery, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low authentication barrier and scope change to admin sessions make this a meaningful risk for multi-user WordPress environments.
Cross-site scripting in the Simple Membership WordPress plugin (versions up to and including 4.7.2) allows injection of malicious scripts that execute in the context of other users' browsers. The official CVSS vector assigns PR:L (low privileges required), which directly contradicts the CVE description's claim of 'unauthenticated' exploitation - this discrepancy must be resolved with the vendor before accurate risk tiering. With a scope-changed impact (S:C), the primary concern is an attacker inducing a privileged user such as a WordPress administrator to trigger the payload, enabling session hijacking or unauthorized administrative actions. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.
Cross-site scripting in the Contest Gallery WordPress plugin (versions <= 28.1.6) can be triggered by a subscriber-level authenticated user, injecting malicious scripts that execute in the browsers of higher-privileged users such as administrators. The CVSS Scope:Changed metric confirms the payload escapes the subscriber's privilege boundary and impacts other user sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and broad WordPress ecosystem deployment surface make this a meaningful risk for any site accepting subscriber registrations.
Cross-site scripting in ProfilePress WordPress plugin versions up to and including 4.16.13 allows authenticated subscribers to inject malicious JavaScript payloads that execute in the browsers of other users - including administrators - who view affected content. The CVSS scope change (S:C) indicator confirms this is a stored or reflected XSS that crosses privilege boundaries, enabling low-privilege users to target higher-privilege accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the Shipment Tracker for WooCommerce WordPress plugin (versions up to and including 1.5.3.2) allows authenticated subscriber-level users to inject malicious scripts that execute in a privileged user's browser session. The CVSS scope-change flag (S:C) indicates the injected payload crosses into the administrator's browser context, enabling session hijacking, credential theft, or unauthorized admin actions. Reported by Patchstack with no public exploit code identified at time of analysis and no CISA KEV listing.
Stored or reflected Cross-Site Scripting in the JupiterX Core WordPress plugin (versions up to and including 4.14.1) allows low-privilege authenticated users with Subscriber roles to inject malicious JavaScript that executes in the browser context of other users, including administrators. The scope change component (S:C in CVSS) confirms the payload crosses security boundaries, enabling session hijacking, credential theft, or unauthorized administrative actions against victims who view attacker-controlled content. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in the WP Google Review Slider WordPress plugin (versions up to and including 18.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any user who interacts with the affected page. Reported by Patchstack and tracked as EUVD-2026-36930, the vulnerability stems from improper input sanitization in a publicly accessible plugin component. No public exploit code or CISA KEV listing has been identified at the time of analysis, placing this in the medium-priority tier despite the unauthenticated attack vector.
Reflected cross-site scripting in Eli's WordCents adSense Widget with Analytics WordPress plugin (versions <= 1.3.03.27) allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser when the user is lured into clicking a crafted link. The flaw stems from improper neutralization of user-supplied input (CWE-79), and while no public exploit identified at time of analysis, the scope-changing CVSS vector indicates potential for session hijacking or administrative account takeover if a logged-in WordPress admin is targeted.
Reflected cross-site scripting in the Okay Toolkit WordPress plugin (versions ≤2.3) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw was reported by Patchstack and carries a CVSS 3.1 score of 7.1 with a scope-changed impact, but no public exploit identified at time of analysis and EPSS data was not provided. Successful exploitation can lead to session hijacking, credential theft, or administrative actions against the targeted WordPress site.
Reflected cross-site scripting in the iRobots.txt SEO WordPress plugin (versions 1.1.2 and earlier) allows remote unauthenticated attackers to inject malicious JavaScript that executes in a victim's browser when they interact with a crafted link. The flaw was disclosed by Patchstack and carries a CVSS 3.1 score of 7.1 driven by a scope change, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV. Exploitation requires user interaction, which limits mass-scale weaponization but makes it viable for targeted phishing against WordPress administrators.
DOMPurify's HTML sanitizer silently skips shadow DOM contents nested inside <template> elements, allowing stored or reflected XSS payloads to survive sanitization untouched in versions up to and including 3.4.6. When a consuming application clones and inserts the sanitized template into the live DOM - the standard and intended usage pattern for HTML templates - any attacker-controlled payload within the shadow root executes with full script privileges in the victim's browser context. A publicly available proof-of-concept (poc.html) has been released alongside the advisory; no confirmed active exploitation (CISA KEV) has been recorded at time of analysis, but the low attack complexity and broad deployment of DOMPurify across web applications make this a high-priority patching target.
Cross-site scripting in DOMPurify ≤ 3.4.5 allows attackers to preserve executable markup through the library's IN_PLACE sanitization path by exploiting JavaScript's per-realm constructor architecture. When `DOMPurify.sanitize(node, { IN_PLACE: true })` receives a DOM node constructed in a different same-origin realm (iframe, popup, `<iframe srcdoc>`), the internal security checks `_isClobbered`, `_sanitizeShadowDOM`, and `_sanitizeAttachedShadowRoots` each perform realm-bound `instanceof` comparisons that silently return false for foreign-realm objects, causing the library to skip DOM-clobbering protection, template-content recursion, and shadow-root sanitization. Three working proof-of-concept scripts demonstrating form-attribute bypass, template-content bypass, and shadow-DOM bypass have been published by the advisory authors; no active exploitation or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in DOMPurify ≤ 3.4.5 allows attacker-controlled event handlers, javascript: URIs, and template syntax to survive sanitization when the IN_PLACE: true API is used with an HTMLFormElement root. Two interacting bugs create the bypass: _forceRemove silently no-ops on detached (parent-less) nodes per WebIDL spec, and _sanitizeAttributes unconditionally early-returns on clobbered nodes under the now-broken assumption that _sanitizeElements already removed them. A publicly available working PoC has been verified against Chromium 148.0.7778.96 and DOMPurify 3.4.5 including the HEAD commit 89da34e, which addressed a related shadow-root traversal issue but left this main-pipeline path unpatched. No KEV listing is present at time of analysis.
DOM sanitization bypass in @angular/compiler allows client-side XSS in Angular applications that use two-way property binding syntax on security-sensitive native DOM properties. The Angular template compiler's sanitizer-resolution phase omitted a case for the TwoWayProperty IR operation, meaning compiled templates with [(innerHTML)], [(src)], [(href)], [(srcdoc)], [(data)], or [(sandbox)] bindings emit the runtime ɵɵtwoWayProperty() instruction without the required sanitizer function argument, while identical one-way [property] bindings are correctly protected. No active exploitation has been confirmed (not in CISA KEV), and no public exploit code has been identified at time of analysis, though the patch diff in PR #69107 fully characterizes the missing code path.
Cross-site scripting execution is possible in Angular applications (@angular/compiler and @angular/core) through a dual-bypass of the framework's template sanitization engine using XML namespace prefixes. The Angular template preparser used a simple string comparison for 'script' that failed to match namespaced representations such as ':svg:script', allowing those elements to survive template compilation unstripped. Concurrently, the security context schema mappings for namespaced SVG and MathML attributes were incomplete, allowing malicious attribute bindings to evade both compile-time and runtime sanitizers. No public exploit has been identified at time of analysis, and exploitation requires the specific non-default deployment condition of runtime JIT template compilation with user-controlled input.
Dynamic component mounting in @angular/core permits client-side XSS by failing to reject script elements as valid host targets for `createComponent`. Angular applications that pass user-supplied selectors or host element references to the `createComponent` API without prior sanitization are vulnerable to namespace bypass, allowing an attacker to mount Angular components onto `<script>` or `<svg:script>` elements and execute arbitrary JavaScript in the victim's browser. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept has been identified at time of analysis, but vendor-released patches are available across multiple supported major versions.
Stored XSS in the Symfony HtmlSanitizer component (symfony/html-sanitizer) allows injection of javascript: scheme URLs through HTML attributes not covered by the library's URL sanitization allow-list. The UrlAttributeSanitizer hardcodes a fixed set of URL-bearing attributes to sanitize, omitting data (on object), codebase and archive (on applet), and longdesc (on iframe/img); a related gap allows javascript: URLs embedded in meta http-equiv=refresh content values to pass through unchanged. Only non-default configurations that explicitly opt in to those element-attribute combinations via allowElement() or allowAttribute() are affected - default Symfony configurations are confirmed safe. No public exploit code has been identified at time of analysis, though the vendor advisory includes functional proof-of-concept payloads; the issue was reported by Scott Arciszewski of Trail of Bits.
Reflected XSS in Valhalla's JSONP endpoint allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing payload in the callback parameter. All versions through 3.6.3 are affected, and the CVSS scope change (S:C) reflects that execution occurs in the serving origin's context rather than a sandboxed one, enabling session theft and unauthorized actions on authenticated victims. No patch was available at time of publication, and no public exploit code has been identified at time of analysis.
Stored Cross-Site Scripting in the Elizaibots WordPress chatbot plugin (versions <= 1.0.2) allows authenticated Contributor-level users to inject malicious scripts that execute in the browser context of higher-privileged users - including site administrators - when they visit affected pages. The CVSS scope-change indicator (S:C) confirms the payload escapes the contributor's privilege boundary and can compromise admin sessions, enabling privilege escalation or site takeover. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Stored Cross-Site Scripting in the WP Emmet WordPress plugin (by rewish) versions 0.3.4 and earlier allows an administrator-level user to inject persistent malicious scripts through the plugin interface, which then execute in the browsers of other users who visit affected pages. The CVSS scope-change metric (S:C) confirms the injected payload crosses trust boundaries beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized actions against victims. No public exploit has been identified at time of analysis, and the vulnerability has not appeared in CISA KEV.
WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored Cross-Site Scripting in the Form Builder CP WordPress plugin (all versions before 1.2.47) allows authenticated users holding Editor-level access or above to inject persistent malicious scripts via unsanitized form configuration values, which execute in every visitor's browser upon rendering the affected form. Critically, this attack succeeds even when WordPress's `unfiltered_html` capability has been revoked - a control that multisite administrators commonly rely on to prevent exactly this class of injection from Editor-level roles. A publicly available exploit exists per WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and the EPSS score of 0.19% (9th percentile) reflects limited automated mass exploitation at time of analysis.
Cross-site scripting in Intelliants Subrion CMS up to version 4.0.3 allows an authenticated high-privilege attacker to inject malicious JavaScript via the CSS class name argument in the Blocks Endpoint, executing in a victim user's browser upon viewing the manipulated block. Publicly available exploit code exists (disclosed on HackMD), and the vendor did not respond to responsible disclosure, leaving no patch available at time of analysis. Exploitation is constrained by a high-privilege authentication requirement and mandatory user interaction, limiting opportunistic mass exploitation but posing meaningful insider-threat and compromised-credential risk.
Cross-site scripting in PublicCMS V5.202506.d allows unauthenticated network-accessible attackers to inject malicious scripts via the site configuration management module, which execute in the browser of any user who subsequently views the affected page. The CVSS scope change (S:C) indicates injected code escapes the vulnerable component's security context, making administrator session hijacking the primary realistic impact. A proof-of-concept is publicly available on GitHub Gist per SSVC classification, though EPSS remains very low at 0.15% (4th percentile) and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog.
Cross-site scripting in RuoYi 4.8.2 enables script injection via the /system/notice/add endpoint, executing malicious payloads in the browsers of users who subsequently view the injected notice content. The CVSS Scope:Changed designation confirms the impact escapes the originating component's trust boundary, affecting victim sessions across the application. A proof-of-concept is available per SSVC data; however, no CISA KEV listing exists and the EPSS score of 0.15% (4th percentile) reflects negligible observed exploitation probability at time of analysis.
Cross-site scripting in Deck9 Input v2.0.1 enables authenticated attackers to inject arbitrary JavaScript or HTML via crafted input payloads that execute within other users' browser sessions. The CVSS scope-changed vector (S:C, PR:L, UI:R) confirms the impact crosses user boundaries - a single low-privileged attacker can affect multiple victims - though account access and victim interaction are prerequisites. EPSS at 0.15% (4th percentile) and SSVC Exploitation: none indicate no current active exploitation; no CISA KEV listing is present.
Cross-site scripting in SourceCodester CET Automated Grading System with AI Predictive Analytics 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser via the unsanitized `action` parameter in `/index.php`. Publicly available exploit code exists (CVSS 4.0 E:P), and the attack requires no authentication, only that a victim interact with a crafted URL or request. No vendor-released patch has been identified at time of analysis.
Stored Cross-Site Scripting in the Canvas plugin for WordPress (versions ≤ 2.5.2) allows an authenticated attacker holding contributor-level access or above to inject persistent JavaScript via the unsanitized 'tag' parameter in the block-section-heading Gutenberg block. The payload is stored in the database and executes in the browser of any user who subsequently loads the compromised page, enabling session hijacking, credential theft, or malicious redirects at scale. No active exploitation is confirmed (not listed in CISA KEV), but the low privilege bar makes this a realistic threat on multi-author WordPress installations; a fix is available in version 2.5.3.
Stored cross-site scripting in the Pagelayer Drag and Drop website builder plugin for WordPress (versions up to and including 2.0.9) allows authenticated contributors to inject persistent malicious scripts via the Anchor block component. Any site visitor - including privileged administrators - who loads an injected page will execute the attacker-supplied script in their browser, enabling session token theft, credential harvesting, or privilege escalation. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; however, the low authentication barrier (contributor-level) makes it realistically accessible on multi-author WordPress sites.
Stored Cross-Site Scripting in FooGallery WordPress plugin versions through 3.1.31 allows authenticated contributors to inject persistent JavaScript via the 'custom_attribute_key' shortcode parameter, executing against any visitor who views an affected page. The flaw combines a bypass-prone event-handler blacklist in foogallery_sanitize_javascript() - which omits handlers like 'onmouseenter' - with unescaped attribute key output in foogallery_build_container_attributes_safe(), together enabling DOM-level script injection. A patched version 3.1.32 is confirmed released; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject persistent malicious scripts via unsanitized store logo metadata, which executes when the admin page is rendered in another user's browser. The vulnerability is especially significant in WordPress multisite networks because it bypasses the `unfiltered_html` capability restriction - a control specifically intended to prevent administrators from injecting raw HTML and scripts. A public POC is documented by WPScan; no active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% indicates low current exploitation probability.
Cross-site scripting in Allegra's downloadAttachment method enables authenticated remote attackers to inject and execute arbitrary JavaScript within a victim user's browser session. Exploitation requires an authenticated low-privilege attacker account and mandatory victim interaction - the target must visit a malicious page or open a crafted file - limiting the realistic attack surface. Reported by Zero Day Initiative (ZDI-CAN-28236 / ZDI-26-358), patched in Allegra 9.0.0. No public exploit code and no active exploitation (CISA KEV) identified at time of analysis.
Cross-site scripting in Fabric.js (npm: fabric) versions prior to 7.4.0 is triggered when applications export canvas content via `canvas.toSVG()` and render the result into the DOM using `innerHTML`. The `color` field within `colorStops` of a `fabric.Gradient` object is inserted into SVG `<stop>` elements without escaping `"`, `<`, or `>`, allowing crafted input to break attribute context and inject arbitrary HTML. A working proof-of-concept is publicly confirmed against v7.2.0; no active exploitation appears in CISA KEV, and the EPSS score of 0.04% reflects low observed exploitation breadth consistent with the chained conditions required.
Cross-site scripting in sanitize-html prior to 2.17.5 allows low-privileged attackers to inject executable `javascript:` URIs through HTML attributes that the library's scheme-blocking logic never inspects. The `naughtyHref()` function gates dangerous URI schemes only for attributes listed in `allowedSchemesAppliedToAttributes` (defaulting to `href`, `src`, and `cite`), leaving attributes such as `action`, `formaction`, `data`, `poster`, `background`, `ping`, `xlink:href`, `dynsrc`, and `lowsrc` entirely unchecked. Applications that explicitly permit any of these attributes in their sanitize-html configuration are vulnerable; no public exploit code has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.
Stored cross-site scripting in ApostropheCMS up to and including version 4.29.0 allows an attacker who controls a user account to inject malicious script into the draft version tooltip via an unsanitized display name field. Any editor or administrator who subsequently views that tooltip in the CMS backend will execute the attacker's payload in their browser, enabling session hijacking or unauthorized action execution. No public exploit has been identified at time of analysis and no patched version is available per the vendor advisory.
Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 allows an authenticated low-privilege user to inject persistent malicious script via the `protitle` argument on the `/Projects/Add_Projects` endpoint. When any other authenticated user (e.g., an HR administrator) subsequently views the Projects Management Page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on their behalf. A public proof-of-concept exploit is hosted on GitHub, lowering the bar for exploitation, though KEV listing is absent and the CVSS 4.0 score of 2.0 reflects the constrained impact scope.
Reflected XSS in MISP's UiBeta event index view allows an authenticated attacker to execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a specially encoded searcheventinfo parameter. The vulnerability exploits a double-encoding flaw: the PHP template applies only HTML escaping (h()) to the urlparams value placed inside a single-quoted JavaScript string in an onclick attribute, but browsers HTML-decode attribute values before JavaScript parsing - restoring encoded quote characters (' → ') and enabling string breakout. No public exploit code has been identified at time of analysis, and the fix has been committed upstream by the MISP maintainers at CIRCL.
Stored cross-site scripting in CodeAstro Human Resource Management System 1.0 allows an authenticated remote attacker to inject persistent malicious scripts via the `todo_data` parameter at the `/dashboard/add_tod` endpoint. When a higher-privileged user subsequently views the to-do list in the dashboard, the stored payload executes silently in their browser context, enabling session hijacking or unauthorized privileged actions. A public proof-of-concept exploit is available on GitHub; no CISA KEV listing exists at time of analysis, but the low barrier to exploitation for any authenticated user elevates practical risk above the CVSS 4.0 score of 2.0 implies.
Stored cross-site scripting in MISP's setHomePage endpoint allows an authenticated user to persist an arbitrary JavaScript payload as their homepage setting when the Overmind theme is active, which later executes in any victim's browser upon viewing the News page and clicking the "Continue to homepage" link. The root cause is a theme-conditional code path in UserSettingsController that called setSettingInternal() directly, bypassing the validate_homepage validator that enforces a leading slash on path values, combined with an unescaped output sink in app/View/News/index.ctp. No public exploit has been identified at time of analysis; exploitation is bounded by the Overmind-theme-only precondition and mandatory victim interaction.
Stored XSS in Parse Server is achievable by authenticated users who bypass the file upload extension blocklist by appending a trailing dot to a blocked filename (e.g., `poc.svg.`), causing the extension parser to return an empty string and skip the block check. The attacker-supplied Content-Type is forwarded unchanged to cloud storage adapters (S3, GCS), which persist and serve the file under that active MIME type - enabling script execution in a victim's browser when the file URL is opened. No active exploitation is confirmed (not in CISA KEV, EPSS 0.05% at 15th percentile), but the attack mechanism is low-complexity and fully documented in the vendor's fix PRs. Patches are available in versions 8.6.79 and 9.9.1-alpha.4.
Stored XSS in Frappe's Report and List View components allows injection of persistent JavaScript payloads that execute in the browsers of any user who subsequently accesses the affected views. All Frappe deployments on the v15 branch prior to 15.107.2 and v16 branch prior to 16.17.4 are affected per the GitHub security advisory GHSA-rx63-c3fh-8926. No public exploit has been identified at time of analysis and the EPSS score of 0.02% (7th percentile) reflects low current exploitation probability, though the network-accessible nature of Frappe instances keeps this relevant for organizations running unpatched versions.
Stored cross-site scripting in Frappe's user profile image section enables script injection that executes in the browsers of any user who views the compromised profile. Affected versions are all Frappe releases prior to 15.106.0. No public exploit code or CISA KEV listing exists at time of analysis; EPSS of 0.02% (7th percentile) reflects low observed exploitation activity, though stored XSS in a shared framework carries inherent persistence risk across all applications built on Frappe.
Stored cross-site scripting in the Frappe framework's Note feature allows a low-privileged attacker to persist malicious JavaScript that executes in the browsers of users who subsequently view the poisoned note. All Frappe deployments on the v15 branch prior to 15.106.0 and the v16 branch prior to 16.16.0 are affected. No public exploit or CISA KEV listing exists at time of analysis; vendor-confirmed patches are available and should be applied promptly given the ease of exploitation once an attacker holds any valid user account.
Reflected DOM-based XSS in Nuxt's built-in <NuxtLink> component allows an unauthenticated attacker to inject script-capable URLs (javascript:, vbscript:) that execute in the application's origin when a victim clicks a crafted link, affecting all Nuxt v3 versions prior to 3.21.7 and v4 versions prior to 4.4.7. Exploitation is contingent on application code that binds attacker-controlled input - such as query parameters, CMS link fields, or user-supplied profile URLs - directly to the component's to or href props without prior sanitization. No public exploit code has been identified and the EPSS score of 0.06% (20th percentile) indicates low observed exploitation probability; vendor-released patches are available in versions 3.21.7 and 4.4.7.
Stored Cross-Site Scripting in the Secure Copy Content Protection and Content Locking WordPress plugin (all versions before 5.1.5) enables high-privilege users such as administrators to inject persistent malicious scripts through unsanitized plugin settings fields. This is particularly impactful in WordPress multisite environments, where the unfiltered_html capability is typically revoked from administrators, making this bypass noteworthy - the plugin fails to enforce its own output escaping independently of WordPress core capabilities. A publicly available proof-of-concept exists per WPScan, though no confirmed active exploitation (CISA KEV) has been recorded and EPSS places this at the 9th percentile for exploitation probability.
Stored XSS in the Presto Player WordPress plugin (versions ≤ 4.2.0) lets authenticated contributors persist arbitrary JavaScript payloads by supplying a javascript: URI as the link_url parameter of the [presto_player_overlay] shortcode. The getOverlays() function in Shortcodes.php copies the attribute into overlay configuration without scheme validation, causing the URI to survive into the href attribute rendered by the presto-dynamic-overlay-ui Stencil.js web component; any visitor who loads the injected page triggers execution. No public exploit or CISA KEV listing has been identified at time of analysis, but the low attack complexity within the contributor-access constraint makes this a realistic risk on multi-author or membership-based WordPress installations.
HTTP header injection in IBM DevOps Plan 3.0.0 through 3.0.6 allows unauthenticated remote attackers to inject arbitrary HTTP headers by supplying a malicious HOST header value that the application fails to sanitize. The vulnerability (CWE-644) can be leveraged to mount cross-site scripting attacks against users, poison intermediate caches with attacker-controlled content, or hijack authenticated sessions. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, though the low-complexity, no-authentication-required attack surface makes this a meaningful risk for any internet-facing deployment.
Denial of service on the GitLab CI/CD Catalog page is achievable by any authenticated user across a broad version range (17.0 through pre-patch releases of 18.10, 18.11, and 19.0) due to improper sanitization of user-supplied content. The low-privilege, network-accessible attack vector means any GitLab account holder can trigger the condition without elevated permissions or complex setup. No public exploit code or CISA KEV listing has been identified at time of analysis, and the limited availability impact (A:L) constrains real-world severity, though the wide version exposure across three concurrent release branches broadens organizational risk.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS.0.2. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected XSS in Spring Web Flow's JavaScript RemotingHandler allows an authenticated attacker to inject and execute arbitrary scripts in a victim's browser by embedding malicious content in input that the server reflects within error response bodies. The RemotingHandler renders these error bodies as HTML regardless of the declared Content-Type, bypassing MIME-type enforcement. Affected versions span the 2.5.x, 3.0.x, and 4.0.0 release lines; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Stored Cross-Site Scripting in the Open User Map PRO WordPress plugin (versions ≤ 1.4.31) via the 'oum_location_notification' parameter enables unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages. The injected payload executes in any visitor's browser upon accessing the affected page, with scope extending beyond the originating application context (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection surface lowers the barrier for mass exploitation against unpatched sites.