XSS
Monthly
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.
Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.
Stored cross-site scripting in MyBB's Buddy/Ignore component prior to version 1.8.40 allows authenticated attackers to inject arbitrary JavaScript by registering usernames that survive the `htmlspecialchars_uni()` sanitization pass with unescaped single quotes intact. The payload fires in the victim's browser during two specific user interactions: clicking 'Yes' in the removal confirmation dialog within usercp.php, or selecting the crafted username via the onclick handler in the xmlhttp.php Private Messages Select Buddies popup. With a CVSS 8.7 rating reflecting a scope change (C:H, I:H), successful exploitation can yield full session hijacking or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis.
Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. A working proof-of-concept is publicly confirmed in GHSA-34pm-923j-7wf8; no active exploitation via CISA KEV is listed at time of analysis.
Stored XSS in Trilium Notes via the #iconClass note label escalates to full operating-system code execution due to the Electron runtime's enabled nodeIntegration and disabled contextIsolation. An attacker with note-write access (CVSS PR:H) can set a crafted #iconClass attribute value that auto-executes when any victim opens a new tab or invokes quick search (Ctrl+J), granting arbitrary OS command execution as the victim user. Fixed in v0.103.0; no active exploitation (KEV) or public POC identified at time of analysis.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attackers without credentials to inject arbitrary JavaScript that executes in the browser context of site visitors or authenticated administrators. The CVSS scope change (S:C) indicates the injected script breaks out of the plugin's trust boundary and operates under the victim's session, enabling session hijacking or unauthorized privileged actions. Reported by Patchstack under ENISA EUVD-2026-60782, no CISA KEV entry or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes this class of flaw a consistent target in mass WordPress scanning campaigns.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is not listed in CISA KEV.
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Pandora's URL observable rendering allows network-reachable attackers to inject arbitrary JavaScript that executes in the context of an authenticated victim's Pandora session when they interact with the Submit to Lookyloo control. The root cause is a JavaScript string injection context mismatch: attacker-controlled URLs extracted from submitted files were interpolated directly into inline onclick handlers, where the template engine's HTML entity encoding provides no protection. Successful exploitation enables session hijacking or unauthorized actions on behalf of the victim; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads inside PDF metadata fields (Title or Author) that execute in a victim's browser session when the user triggers the 'Get Info' workflow. The vulnerable template at get-info-on-pdf.html injects unsanitized metadata directly into the DOM via innerHTML, enabling session token theft and arbitrary page content manipulation against any user who processes a crafted PDF on a shared instance. No public exploit has been identified at time of analysis, and the vendor has shipped a complete fix in the major v2.0.0 release.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Stored/reflected cross-site scripting in Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 lets an unauthenticated attacker execute arbitrary JavaScript in a visitor's browser by supplying a crafted color_scheme_id or dark_scheme_id cookie. Because the cookie is rendered into a color-scheme tag without HTML escaping, an attacker can break out of the attribute context and inject markup that defeats Discourse's nonce-based Content Security Policy. A vendor patch exists and the flaw carries a critical CVSS of 9.3, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting (XSS) in OpenText Directory Services through version 22.2 allows network-based unauthenticated attackers to inject malicious scripts that execute in victims' browsers, yielding high confidentiality and integrity impact against the vulnerable system. A proof-of-concept exploit exists per the CVSS 4.0 E:P modifier, though this CVE does not appear in the CISA KEV catalog and user interaction is required to trigger the flaw. Because directory services platforms manage authentication credentials and identity data, successful exploitation can enable session hijacking or account takeover with downstream access implications across integrated systems.
Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.
Stored cross-site scripting in SiYuan before v3.7.4 lets an authenticated user upload an HTML file through the asset-serving endpoint, which the server returns without Content-Disposition or X-Content-Type-Options headers, so the browser renders it inline instead of downloading it. When the workspace owner clicks the malicious asset link, the injected script runs in the app's origin with full kernel API access, enabling account and data compromise. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Cross-site scripting leading to arbitrary code execution in SiYuan (self-hosted note-taking / knowledge-management app) before v3.7.4 lets an attacker embed hex-encoded markup inside a document icon that the vulnerable unicode2Emoji function renders without sanitization; because the Electron renderer runs with Node integration enabled, the injected script escapes the browser context and executes OS commands on the victim's host. Any user who opens or imports a crafted document is affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor GitHub security advisory (GHSA-vx5w-qrvp-mmcq) and a VulnCheck advisory document the flaw.
Stored cross-site scripting in SiYuan's desktop note-taking client (versions before 3.7.4) allows an attacker who can rename an attribute-view (database) field to inject HTML that executes when a victim opens the sort menu, and because the Electron desktop client runs with Node integration enabled, that script achieves arbitrary code execution on the victim's machine. The flaw is authenticated/low-privilege and requires the victim to open the affected menu; no public exploit has been identified at time of analysis, though a vendor security advisory (GHSA-g3jx-227v-x2x4) and VulnCheck advisory document the issue.
Stored cross-site scripting in SiYuan before v3.7.4 lets a workspace user with edit rights persist JavaScript by injecting event-handler attributes through the unescaped color field of an attribute-view (database) select option. The payload fires whenever any user renders a database containing the malicious select field, across eight distinct render sites that all fail to escape the value. No public exploit or CISA KEV listing has been identified at time of analysis, but the flaw is trivially triggerable and carries a high CVSS 4.0 base score of 9.4.
Stored cross-site scripting escalating to remote code execution affects SiYuan, an Electron-based personal knowledge-management/note-taking application, in all versions before v3.7.4. Because table column-width values passed to the setAttrViewColWidth API are neither validated nor escaped before being written into HTML style attributes, an attacker can break out of the style attribute and attach event handlers to every table cell; when the victim renders the table, the payload executes in the Electron renderer, which runs with Node integration enabled, turning a web-layer injection into arbitrary code execution on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in SiYuan before v3.7.4 lets an authenticated attacker who can author Template calculation operators inject HTML and JavaScript that runs in the Electron desktop renderer with Node integration enabled, turning a stored cross-site scripting flaw into full arbitrary code execution when a victim opens the shared notebook/database. The Go template output is stored verbatim without sanitization, so payloads persist and fire on document render. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck published an advisory and the vendor issued a GitHub security advisory (GHSA-rwh7-gm74-67h6).
Stored cross-site scripting in SiYuan before v3.7.4 escalates to remote code execution because the desktop client renders database menu metadata (group, view, and field-edit menus) through unsafe HTML interpolation. An attacker who can set a database field name or description injects markup that closes the containing element and fires an event handler; when a victim opens the affected menu, the script runs with Node.js built-ins available due to Electron being configured without sandboxing/context isolation. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting leading to remote code execution in SiYuan (a self-hosted personal knowledge-management notebook) before v3.7.4 lets an attacker with write access poison PDF annotation fields via the setFileAnnotation endpoint; because SiYuan is an Electron application, the injected markup runs as JavaScript in the PDF renderer with full Node.js privileges when a victim opens the annotated PDF, escalating a web injection into host-level code execution. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-79 root cause combined with Node.js integration makes this a full-compromise primitive rather than a benign script injection.
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.
OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by
Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The `text` and `name` query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript `window.status` assignment, and multiple `document.getElementById()` calls - confirmed by the patch commit diff. No public exploit has been identified at time of analysis, but an upstream fix is available as a merged GitHub commit and a vendor patch is listed as available.
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Cross-site scripting in JupyterLab 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1 enables arbitrary code execution in a victim's browser session through a crafted overrides.json settings file. The sideBySideLeftMarginOverride and sideBySideRightMarginOverride notebook extension settings are inserted unsanitized into CSS style content, allowing a payload to execute with full JupyterLab API access - enabling notebook reads/writes and arbitrary kernel command execution under the victim's credentials. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the CVSS 4.0 score of 8.6 with high confidentiality and integrity impact reflects meaningful real-world risk, particularly in multi-user JupyterHub deployments.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affecting all versions through 1.6.1, allows remote unauthenticated attackers to inject and execute arbitrary JavaScript within a victim's browser session. The scope change (S:C) in the CVSS vector confirms the payload escapes the plugin's component boundary and executes in the authenticated WordPress session context of the targeted user, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.
Reflected Cross-Site Scripting in the MultiParcels Shipping For WooCommerce WordPress plugin (versions ≤ 1.30.36) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The changed-scope vector (S:C) means the injected script runs within the victim's authenticated WordPress origin, enabling session hijacking, credential harvesting, or unauthorized administrative actions if an admin-level user is targeted. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated cross-site scripting in Local Delivery Drivers for WooCommerce 3.0.0 and below allows remote, unauthenticated attackers to inject persistent malicious scripts that execute in the browser context of authenticated site administrators or other privileged users. The changed scope (S:C) in the CVSS vector signals that successful exploitation crosses security boundaries beyond the plugin itself, enabling attacker access to administrator browser sessions. No public exploit code has been identified at time of analysis, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to inject arbitrary JavaScript into pages rendered for site visitors without any prior authentication. With a scope-changed CVSS vector (S:C) and a score of 7.1, successful exploitation crosses the browser security boundary, enabling session hijacking, credential theft, or malicious redirects against victims who interact with affected content. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.
Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who visits an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity network exploitation requiring no credentials, with the scope change indicating the injected script crosses into the victim's browser security context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the WP Full Stripe Free WordPress plugin version 8.5.0 and below allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users, including administrators. Because the vulnerability carries a Changed scope (S:C in the CVSS vector), successful exploitation can affect browser sessions beyond the vulnerable plugin's own context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a meaningful risk for any WordPress site running the affected plugin.
Unauthenticated cross-site scripting in the Echo Knowledge Base WordPress plugin (versions <= 17.211.0) allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability requires no authentication to exploit but does require a victim to interact with the affected content, as reflected in the CVSS UI:R metric and scope change (S:C). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers targeting WordPress deployments running this plugin.
Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to visit a crafted URL - no account or privilege on the target site is required from the attacker. The CVSS scope-change indicator (S:C) confirms that successfully executed scripts operate beyond the plugin's own boundary, giving an attacker access to the broader WordPress session context, enabling session hijacking, credential harvesting, or administrative account takeover. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Cross-site scripting in Maspik - Spam Blacklist WordPress plugin (versions ≤ 2.9.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted URL or page. The plugin, designed to intercept spam submissions in contact forms, fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Unauthenticated cross-site scripting in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.31) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking an admin or authenticated customer into interacting with a crafted URL. The changed scope in the CVSS vector (S:C) confirms the payload executes outside the application's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this accessible to broad attacker populations.
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.
JupyterLab's ImageViewer component escalates a blob URL lifecycle bug into server-side remote code execution - a specially crafted SVG opened in the ImageViewer retains an executable same-origin context after its blob URL is prematurely revoked, and when the victim opens that image in a new browser tab, embedded JavaScript executes within the JupyterLab server's origin. That same-origin privilege grants direct access to JupyterLab's kernel execution API, turning a browser-side XSS into full RCE on the JupyterLab server. All versions prior to 4.5.10 and 4.6.2 are affected; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the two-step user interaction required is realistic in data-science workflows where images are routinely inspected.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.
Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.
Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.
Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.
Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.
Stored cross-site scripting in MyBB's Buddy/Ignore component prior to version 1.8.40 allows authenticated attackers to inject arbitrary JavaScript by registering usernames that survive the `htmlspecialchars_uni()` sanitization pass with unescaped single quotes intact. The payload fires in the victim's browser during two specific user interactions: clicking 'Yes' in the removal confirmation dialog within usercp.php, or selecting the crafted username via the onclick handler in the xmlhttp.php Private Messages Select Buddies popup. With a CVSS 8.7 rating reflecting a scope change (C:H, I:H), successful exploitation can yield full session hijacking or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis.
Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. A working proof-of-concept is publicly confirmed in GHSA-34pm-923j-7wf8; no active exploitation via CISA KEV is listed at time of analysis.
Stored XSS in Trilium Notes via the #iconClass note label escalates to full operating-system code execution due to the Electron runtime's enabled nodeIntegration and disabled contextIsolation. An attacker with note-write access (CVSS PR:H) can set a crafted #iconClass attribute value that auto-executes when any victim opens a new tab or invokes quick search (Ctrl+J), granting arbitrary OS command execution as the victim user. Fixed in v0.103.0; no active exploitation (KEV) or public POC identified at time of analysis.
Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.
Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse.
Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.
Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.
Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.
Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attackers without credentials to inject arbitrary JavaScript that executes in the browser context of site visitors or authenticated administrators. The CVSS scope change (S:C) indicates the injected script breaks out of the plugin's trust boundary and operates under the victim's session, enabling session hijacking or unauthorized privileged actions. Reported by Patchstack under ENISA EUVD-2026-60782, no CISA KEV entry or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes this class of flaw a consistent target in mass WordPress scanning campaigns.
Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.
Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.
Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.
Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.
Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.
Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept exploit code has been identified at time of analysis.
Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.
Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.
Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.
Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.
Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.
Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.
Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.
Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is not listed in CISA KEV.
Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.
Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.
Stored cross-site scripting in Pandora's URL observable rendering allows network-reachable attackers to inject arbitrary JavaScript that executes in the context of an authenticated victim's Pandora session when they interact with the Submit to Lookyloo control. The root cause is a JavaScript string injection context mismatch: attacker-controlled URLs extracted from submitted files were interpolated directly into inline onclick handlers, where the template engine's HTML entity encoding provides no protection. Successful exploitation enables session hijacking or unauthorized actions on behalf of the victim; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads inside PDF metadata fields (Title or Author) that execute in a victim's browser session when the user triggers the 'Get Info' workflow. The vulnerable template at get-info-on-pdf.html injects unsanitized metadata directly into the DOM via innerHTML, enabling session token theft and arbitrary page content manipulation against any user who processes a crafted PDF on a shared instance. No public exploit has been identified at time of analysis, and the vendor has shipped a complete fix in the major v2.0.0 release.
Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.
Stored/reflected cross-site scripting in Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 lets an unauthenticated attacker execute arbitrary JavaScript in a visitor's browser by supplying a crafted color_scheme_id or dark_scheme_id cookie. Because the cookie is rendered into a color-scheme tag without HTML escaping, an attacker can break out of the attribute context and inject markup that defeats Discourse's nonce-based Content Security Policy. A vendor patch exists and the flaw carries a critical CVSS of 9.3, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting (XSS) in OpenText Directory Services through version 22.2 allows network-based unauthenticated attackers to inject malicious scripts that execute in victims' browsers, yielding high confidentiality and integrity impact against the vulnerable system. A proof-of-concept exploit exists per the CVSS 4.0 E:P modifier, though this CVE does not appear in the CISA KEV catalog and user interaction is required to trigger the flaw. Because directory services platforms manage authentication credentials and identity data, successful exploitation can enable session hijacking or account takeover with downstream access implications across integrated systems.
Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.
Stored cross-site scripting in SiYuan before v3.7.4 lets an authenticated user upload an HTML file through the asset-serving endpoint, which the server returns without Content-Disposition or X-Content-Type-Options headers, so the browser renders it inline instead of downloading it. When the workspace owner clicks the malicious asset link, the injected script runs in the app's origin with full kernel API access, enabling account and data compromise. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis.
Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.
Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.
Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.
Cross-site scripting leading to arbitrary code execution in SiYuan (self-hosted note-taking / knowledge-management app) before v3.7.4 lets an attacker embed hex-encoded markup inside a document icon that the vulnerable unicode2Emoji function renders without sanitization; because the Electron renderer runs with Node integration enabled, the injected script escapes the browser context and executes OS commands on the victim's host. Any user who opens or imports a crafted document is affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor GitHub security advisory (GHSA-vx5w-qrvp-mmcq) and a VulnCheck advisory document the flaw.
Stored cross-site scripting in SiYuan's desktop note-taking client (versions before 3.7.4) allows an attacker who can rename an attribute-view (database) field to inject HTML that executes when a victim opens the sort menu, and because the Electron desktop client runs with Node integration enabled, that script achieves arbitrary code execution on the victim's machine. The flaw is authenticated/low-privilege and requires the victim to open the affected menu; no public exploit has been identified at time of analysis, though a vendor security advisory (GHSA-g3jx-227v-x2x4) and VulnCheck advisory document the issue.
Stored cross-site scripting in SiYuan before v3.7.4 lets a workspace user with edit rights persist JavaScript by injecting event-handler attributes through the unescaped color field of an attribute-view (database) select option. The payload fires whenever any user renders a database containing the malicious select field, across eight distinct render sites that all fail to escape the value. No public exploit or CISA KEV listing has been identified at time of analysis, but the flaw is trivially triggerable and carries a high CVSS 4.0 base score of 9.4.
Stored cross-site scripting escalating to remote code execution affects SiYuan, an Electron-based personal knowledge-management/note-taking application, in all versions before v3.7.4. Because table column-width values passed to the setAttrViewColWidth API are neither validated nor escaped before being written into HTML style attributes, an attacker can break out of the style attribute and attach event handlers to every table cell; when the victim renders the table, the payload executes in the Electron renderer, which runs with Node integration enabled, turning a web-layer injection into arbitrary code execution on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in SiYuan before v3.7.4 lets an authenticated attacker who can author Template calculation operators inject HTML and JavaScript that runs in the Electron desktop renderer with Node integration enabled, turning a stored cross-site scripting flaw into full arbitrary code execution when a victim opens the shared notebook/database. The Go template output is stored verbatim without sanitization, so payloads persist and fire on document render. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck published an advisory and the vendor issued a GitHub security advisory (GHSA-rwh7-gm74-67h6).
Stored cross-site scripting in SiYuan before v3.7.4 escalates to remote code execution because the desktop client renders database menu metadata (group, view, and field-edit menus) through unsafe HTML interpolation. An attacker who can set a database field name or description injects markup that closes the containing element and fires an event handler; when a victim opens the affected menu, the script runs with Node.js built-ins available due to Electron being configured without sandboxing/context isolation. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Stored cross-site scripting leading to remote code execution in SiYuan (a self-hosted personal knowledge-management notebook) before v3.7.4 lets an attacker with write access poison PDF annotation fields via the setFileAnnotation endpoint; because SiYuan is an Electron application, the injected markup runs as JavaScript in the PDF renderer with full Node.js privileges when a victim opens the annotated PDF, escalating a web injection into host-level code execution. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-79 root cause combined with Node.js integration makes this a full-compromise primitive rather than a benign script injection.
Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.
Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.
Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.
OpenAM Community Edition through 16.0.6 ships its iPlanetDirectoryPro SSO session cookie with HttpOnly disabled and no SameSite attribute by default, and reuses that same cookie value as the CSRF token for the OAuth/OIDC consent flow. When chained with any other same-origin XSS in the OpenAM console, a single clicked attacker link lets a remote, unauthenticated attacker read the cookie from document.cookie, hijack a logged-in console user's full SSO session, and simultaneously submit attacker-controlled OAuth consent grants using the stolen cookie as the anti-CSRF token. The issue is fixed by
Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The `text` and `name` query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript `window.status` assignment, and multiple `document.getElementById()` calls - confirmed by the patch commit diff. No public exploit has been identified at time of analysis, but an upstream fix is available as a merged GitHub commit and a vendor patch is listed as available.
Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.
Cross-site scripting in JupyterLab 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1 enables arbitrary code execution in a victim's browser session through a crafted overrides.json settings file. The sideBySideLeftMarginOverride and sideBySideRightMarginOverride notebook extension settings are inserted unsanitized into CSS style content, allowing a payload to execute with full JupyterLab API access - enabling notebook reads/writes and arbitrary kernel command execution under the victim's credentials. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the CVSS 4.0 score of 8.6 with high confidentiality and integrity impact reflects meaningful real-world risk, particularly in multi-user JupyterHub deployments.
Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.
Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.
Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affecting all versions through 1.6.1, allows remote unauthenticated attackers to inject and execute arbitrary JavaScript within a victim's browser session. The scope change (S:C) in the CVSS vector confirms the payload escapes the plugin's component boundary and executes in the authenticated WordPress session context of the targeted user, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.
Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.
Reflected Cross-Site Scripting in the MultiParcels Shipping For WooCommerce WordPress plugin (versions ≤ 1.30.36) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The changed-scope vector (S:C) means the injected script runs within the victim's authenticated WordPress origin, enabling session hijacking, credential harvesting, or unauthorized administrative actions if an admin-level user is targeted. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.
Unauthenticated cross-site scripting in Local Delivery Drivers for WooCommerce 3.0.0 and below allows remote, unauthenticated attackers to inject persistent malicious scripts that execute in the browser context of authenticated site administrators or other privileged users. The changed scope (S:C) in the CVSS vector signals that successful exploitation crosses security boundaries beyond the plugin itself, enabling attacker access to administrator browser sessions. No public exploit code has been identified at time of analysis, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to inject arbitrary JavaScript into pages rendered for site visitors without any prior authentication. With a scope-changed CVSS vector (S:C) and a score of 7.1, successful exploitation crosses the browser security boundary, enabling session hijacking, credential theft, or malicious redirects against victims who interact with affected content. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.
Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.
Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.
Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.
Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who visits an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity network exploitation requiring no credentials, with the scope change indicating the injected script crosses into the victim's browser security context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the WP Full Stripe Free WordPress plugin version 8.5.0 and below allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users, including administrators. Because the vulnerability carries a Changed scope (S:C in the CVSS vector), successful exploitation can affect browser sessions beyond the vulnerable plugin's own context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a meaningful risk for any WordPress site running the affected plugin.
Unauthenticated cross-site scripting in the Echo Knowledge Base WordPress plugin (versions <= 17.211.0) allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability requires no authentication to exploit but does require a victim to interact with the affected content, as reflected in the CVSS UI:R metric and scope change (S:C). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers targeting WordPress deployments running this plugin.
Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.
Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.
Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to visit a crafted URL - no account or privilege on the target site is required from the attacker. The CVSS scope-change indicator (S:C) confirms that successfully executed scripts operate beyond the plugin's own boundary, giving an attacker access to the broader WordPress session context, enabling session hijacking, credential harvesting, or administrative account takeover. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.
Cross-site scripting in Maspik - Spam Blacklist WordPress plugin (versions ≤ 2.9.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted URL or page. The plugin, designed to intercept spam submissions in contact forms, fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.
Unauthenticated cross-site scripting in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.31) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking an admin or authenticated customer into interacting with a crafted URL. The changed scope in the CVSS vector (S:C) confirms the payload executes outside the application's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this accessible to broad attacker populations.
Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.
Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.
JupyterLab's ImageViewer component escalates a blob URL lifecycle bug into server-side remote code execution - a specially crafted SVG opened in the ImageViewer retains an executable same-origin context after its blob URL is prematurely revoked, and when the victim opens that image in a new browser tab, embedded JavaScript executes within the JupyterLab server's origin. That same-origin privilege grants direct access to JupyterLab's kernel execution API, turning a browser-side XSS into full RCE on the JupyterLab server. All versions prior to 4.5.10 and 4.6.2 are affected; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the two-step user interaction required is realistic in data-science workflows where images are routinely inspected.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.