XSS
Monthly
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. A publicly available proof-of-concept exploit exists via HackerOne report #3830478; no confirmed active exploitation in CISA KEV at time of analysis.
Stored or reflected cross-site scripting in GitLab CE/EE's analytics dashboard allows an authenticated attacker with low privileges to inject malicious scripts into pagination controls, executing in the browser context of any user who views the affected page. Affected versions span 18.2 through 19.2.1 across all three supported release trains. A publicly available proof-of-concept exists via HackerOne report 3830061; the Changed scope (S:C) and High C/I impacts elevate real-world risk significantly beyond a typical low-privilege XSS.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Stored cross-site scripting in GitLab CE/EE 19.2 before 19.2.2 lets an authenticated user holding only developer-role permissions inject unsanitized HTML that executes in the browser of a higher-privileged user who opens a CI job modal, enabling privilege escalation. Publicly available exploit code exists (HackerOne report #3880796), though EPSS is modest at 0.30% (22nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 9.0 is driven by a scope change and total confidentiality/integrity/availability impact once the payload runs in a victim's session.
Persistent cross-site scripting in Progress Software's WhatsUp Gold network monitoring platform (all versions before 2026.0.2) allows an authenticated attacker on an adjacent network to bypass frontend input sanitization controls and inject stored malicious script content into the application. When a victim user - likely an administrator - views the poisoned page, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions with the victim's privilege level. No public exploit identified at time of analysis, and the adjacent-network attack vector limits internet-scale exposure, but the high C/I/A impact scores reflect the sensitivity of network monitoring credentials.
Stored cross-site scripting in Winter CMS's backend editor settings allows an authenticated backend user holding the `backend.manage_editor` permission to inject arbitrary JavaScript that executes in the browsers of all other backend users who load any backend page. The attack exploits LESS CSS's escape syntax (`~"..."`) to break out of the CSS context and embed script tags in compiled output served by `renderCss()`, which was previously returned unsanitized. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the class of vulnerability is well understood and the specific payload pattern is documented in the patch's test suite.
Stored XSS in Winter CMS backend allows a high-privileged user with the `backend.manage_branding` permission to inject malicious HTML/JavaScript via the LESS CSS compiler's output in Settings → Customize Backend → Styles, which is rendered unsanitized on every backend page. The same rendering flaw is present in the Editor Settings → Markup Styles panel (`backend.manage_editor` permission), addressed in the same patch. An attacker exploiting this could steal session tokens or perform actions as any other authenticated backend user who visits a backend page. No public exploit or KEV listing exists, but the issue is confirmed by the vendor and an identical CVE (CVE-2025-61676) affects the sister project October CMS.
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Stored XSS in telegram-search (versions ≤ 1.2.8) allows any group member to execute arbitrary JavaScript in co-members' browsers by sending crafted messages to a shared Telegram group. The highlightKeyword function in MessageList.vue returned attacker-controlled message text directly to Vue's v-html directive without HTML escaping, creating a persistent, cross-user sink that fires when victims browse or search the message archive - zero clicks required on the victim's side beyond opening the interface. No public exploit has been confirmed as actively exploited and no CISA KEV listing exists, but the public fix commit (PR #654) fully documents the vulnerable code path, making payload construction trivial for any XSS-proficient attacker with group access.
Stored Cross-Site Scripting in Adobe Commerce and Magento Open Source allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any privileged user who views the affected page. The changed scope (S:C) is the defining risk amplifier: a successful exploitation targets an administrator or session-holding user whose browser context becomes fully compromised, enabling session hijacking or unauthorized actions without ever requiring admin credentials. No public exploit code has been identified and this CVE is not listed in CISA KEV at the time of analysis.
Stored XSS in Adobe Commerce and Magento Open Source enables a low-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon page visit - with scope change allowing script execution beyond the vulnerable component's security boundary, potentially enabling full account or session takeover. The CVSS 8.7 High score reflects network accessibility, low complexity, changed scope, and high confidentiality and integrity impact. No active exploitation (KEV) or public POC has been identified at time of analysis; Adobe released patched August 2026 builds across all affected product lines per advisory APSB26-92.
Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.
Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker to inject and render malicious content within a target user's Teams client, achieving spoofing of interface elements or participants over the network. The scope-changed CVSS vector (S:C, C:H) indicates the vulnerability can expose data beyond the Teams application boundary - potentially including session tokens or cross-context information - when a victim views attacker-controlled content. No public exploit code has been identified and SSVC classifies exploitation as none, though the high confidentiality impact warrants prioritized patching for organizations reliant on Teams for sensitive communications.
Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capability on any of the site's own domains to invoke privileged backend routes and Install Tool endpoints using an authenticated victim's session. The regression was introduced in TYPO3 13.0.0 when both the backend and Install Tool were moved to serve from the site root entry point rather than the dedicated `/typo3/` subdirectory, causing the `ReferrerEnforcer` to accept any same-origin Referer header as legitimate backend traffic. Affected versions are TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Discourse's Chat plugin allows an authenticated user to inject arbitrary HTML and JavaScript into any viewer's browser session by embedding a malicious payload in the username field of a chat-transcript quote block. The Rich Text Editor rendered the username attribute via `innerHTML` without sanitization, meaning any authenticated Discourse member with chat access could craft a quote block that executes attacker-controlled script when a victim - potentially a moderator or administrator - views the transcript. Patch versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are confirmed released; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.
Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Stored XSS in SP Page Builder (Joomla extension by JoomShaper) prior to version 6.7.0 allows unauthenticated remote attackers to persist arbitrary JavaScript in a Joomla site's database via a single HTTP request to the Shapes API endpoint. When any administrator subsequently opens the SP Page Builder editor, the payload executes automatically in their browser session, enabling session hijacking, credential theft, or full backend site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection vector combined with automatic detonation on routine admin activity makes this a high-priority patch target for any Joomla installation running this extension.
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.
Reflected cross-site scripting in AIL Framework's /tag/add_tags endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of any authenticated AIL user who opens a specially crafted link. The flaw originates from the error-handling path in tags_ui.py, which returned raw Python string output via str(res[0]) directly as an HTML response without output encoding, permitting attacker-controlled content to be reflected and rendered by the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix has been committed to the GitHub repository.
Stored cross-site scripting in OpenReception appointment-booking-software prior to version 1.0.2 allows a TENANT_ADMIN to plant malicious `javascript:` URIs in tenant link fields (`website`, `imprint`, `privacyStatement`), which execute in patients' browsers when they click the rendered links on the public landing page. The critical impact is not merely XSS but a complete collapse of the platform's stated end-to-end encryption guarantee: JavaScript executing in the patient origin can intercept and exfiltrate plaintext form data before client-side encryption is applied, meaning a malicious tenant administrator can silently read patient health appointment data the product claims the server can never access. No confirmed active exploitation (no CISA KEV entry) and no public POC have been identified at time of analysis.
Arbitrary JavaScript execution in PDF.js (pdfjs-dist) allows an attacker to run unrestricted script in the context of any web application that renders attacker-controlled PDFs with default settings. The flaw stems from PDF.js's built-in scripting engine, which is enabled by default via the enableScripting flag, executing embedded JavaScript from PDFs without sandbox enforcement when no script-src CSP is present. Applications using pdfjs-dist versions 5.6.83 through 6.2.107 are affected; no public exploit or KEV listing is identified at time of analysis, but the default-on configuration makes real-world exposure broad.
Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.
Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.
Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.
Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.
Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in `resources/views/portal/ninja2020/invoices/includes/terms.blade.php`, with no HTML sanitization performed in `StoreInvoiceRequest.php`, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored cross-site scripting in Open WebUI 0.10.0-0.10.2 allows any authenticated user to craft a math block that causes a KaTeX RangeError (stack overflow from deeply nested braces), forcing the KatexRenderer.svelte error fallback to inject unescaped HTML directly into the DOM via Svelte's `{@html}` directive. Any user who subsequently views the message - including administrators - executes attacker-controlled JavaScript on the Open WebUI origin, enabling session token theft from localStorage and full account takeover. A detailed, weaponizable proof-of-concept is publicly documented in the vendor GHSA advisory, including demonstrated administrator session exfiltration; no CISA KEV listing has been identified at time of analysis.
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a file with an attacker-controlled Content-Type header; CVAT then serves the asset with that header intact, causing a victim's browser to render the file as an HTML page and execute any embedded JavaScript. The attack targets collaborative annotation workflows where guides are shared across users or teams, enabling session hijacking, credential theft, or unauthorized actions within the victim's browser context. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. The vendor-released fix is version 2.67.0.
The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The `serveUrl` iframe branch unconditionally combined `allow-same-origin` with `allow-scripts` for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or `workspace.functions`, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.
Cross-site scripting in the Angular compiler's i18n pipeline allows arbitrary JavaScript injection into localized application builds when event-handler attributes such as `onerror` or `onclick` are marked for translation using `i18n-on*` template directives. Angular's standard `validateAttribute()` and `validateProperty()` guards block binding to event-handler attributes at runtime, but the `I18nMetaVisitor` code path in `packages/compiler/src/render3/view/i18n/meta.ts` contained no equivalent restriction, enabling a lower-trust translation file to replace a benign handler with executable JavaScript at compile time. Patched versions 22.0.1, 21.2.19, and 20.3.27 are available; no public exploit has been identified at time of analysis.
Cross-site scripting in @angular/platform-server's domino DOM emulation library allows attackers to inject executable script blocks into SSR-rendered HTML by supplying closing-tag sequences inside user-controlled data bound to <iframe>, <noembed>, <noframes>, or <noscript> Angular template elements. Angular 20.x through 22.x applications using Server-Side Rendering that reflect user input into these specific fallback raw-content elements are affected; Angular 19.x and earlier receive no backport patch. No public exploit has been identified at time of analysis, though the mechanism is straightforward once the vulnerable application pattern is present, and patches are available across three supported Angular branches.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.
Stored Cross-Site Scripting in the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin (all versions through 4.3.3) allows unauthenticated network attackers to plant arbitrary JavaScript via form field values submitted to the plugin's form endpoints. The payload is persisted to the database and fires in any authenticated or unauthenticated user's browser upon visiting the injected page, with scope change confirmed by CVSS S:C. No active exploitation has been confirmed by CISA KEV, but Wordfence's disclosure includes direct references to the vulnerable source lines, effectively providing a functional roadmap to exploitation. The EPSS probability is not provided in the source data.
Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
Stored cross-site scripting in OpenClaw Dashboard 1.1.0 lets unauthenticated remote attackers plant JavaScript in agent transcript messages that later executes in the administrator's authenticated browser session. Because the malicious message is submitted through the unauthenticated sessions API and rendered unsanitized via innerHTML on the default landing page, an attacker can steal admin session tokens and invoke privileged endpoints, including modifying agent instruction files. Publicly available exploit details exist in a dedicated advisory writeup; there is no evidence of active exploitation (not in CISA KEV), and the CVSS 4.0 base score is 8.8.
Stored cross-site scripting in OpenClaw Dashboard v3.0.0 lets an unauthenticated remote attacker seed a malicious payload simply by submitting a crafted username in a failed login attempt, which the audit log stores verbatim. When an administrator later opens the notification panel, the log entry is rendered through innerHTML under a permissive CSP that permits inline event handlers, executing the payload in the admin's authenticated session and enabling full account takeover. No public exploit was identified at time of analysis, though a dedicated write-up advisory exists; the CVSS 4.0 base score is 9.3 (Critical), reflecting the account-takeover impact.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.
Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.
Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. A publicly available proof-of-concept exploit exists via HackerOne report #3830478; no confirmed active exploitation in CISA KEV at time of analysis.
Stored or reflected cross-site scripting in GitLab CE/EE's analytics dashboard allows an authenticated attacker with low privileges to inject malicious scripts into pagination controls, executing in the browser context of any user who views the affected page. Affected versions span 18.2 through 19.2.1 across all three supported release trains. A publicly available proof-of-concept exists via HackerOne report 3830061; the Changed scope (S:C) and High C/I impacts elevate real-world risk significantly beyond a typical low-privilege XSS.
Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.
Stored cross-site scripting in GitLab CE/EE 19.2 before 19.2.2 lets an authenticated user holding only developer-role permissions inject unsanitized HTML that executes in the browser of a higher-privileged user who opens a CI job modal, enabling privilege escalation. Publicly available exploit code exists (HackerOne report #3880796), though EPSS is modest at 0.30% (22nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 9.0 is driven by a scope change and total confidentiality/integrity/availability impact once the payload runs in a victim's session.
Persistent cross-site scripting in Progress Software's WhatsUp Gold network monitoring platform (all versions before 2026.0.2) allows an authenticated attacker on an adjacent network to bypass frontend input sanitization controls and inject stored malicious script content into the application. When a victim user - likely an administrator - views the poisoned page, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions with the victim's privilege level. No public exploit identified at time of analysis, and the adjacent-network attack vector limits internet-scale exposure, but the high C/I/A impact scores reflect the sensitivity of network monitoring credentials.
Stored cross-site scripting in Winter CMS's backend editor settings allows an authenticated backend user holding the `backend.manage_editor` permission to inject arbitrary JavaScript that executes in the browsers of all other backend users who load any backend page. The attack exploits LESS CSS's escape syntax (`~"..."`) to break out of the CSS context and embed script tags in compiled output served by `renderCss()`, which was previously returned unsanitized. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the class of vulnerability is well understood and the specific payload pattern is documented in the patch's test suite.
Stored XSS in Winter CMS backend allows a high-privileged user with the `backend.manage_branding` permission to inject malicious HTML/JavaScript via the LESS CSS compiler's output in Settings → Customize Backend → Styles, which is rendered unsanitized on every backend page. The same rendering flaw is present in the Editor Settings → Markup Styles panel (`backend.manage_editor` permission), addressed in the same patch. An attacker exploiting this could steal session tokens or perform actions as any other authenticated backend user who visits a backend page. No public exploit or KEV listing exists, but the issue is confirmed by the vendor and an identical CVE (CVE-2025-61676) affects the sister project October CMS.
Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.
Stored XSS in telegram-search (versions ≤ 1.2.8) allows any group member to execute arbitrary JavaScript in co-members' browsers by sending crafted messages to a shared Telegram group. The highlightKeyword function in MessageList.vue returned attacker-controlled message text directly to Vue's v-html directive without HTML escaping, creating a persistent, cross-user sink that fires when victims browse or search the message archive - zero clicks required on the victim's side beyond opening the interface. No public exploit has been confirmed as actively exploited and no CISA KEV listing exists, but the public fix commit (PR #654) fully documents the vulnerable code path, making payload construction trivial for any XSS-proficient attacker with group access.
Stored Cross-Site Scripting in Adobe Commerce and Magento Open Source allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any privileged user who views the affected page. The changed scope (S:C) is the defining risk amplifier: a successful exploitation targets an administrator or session-holding user whose browser context becomes fully compromised, enabling session hijacking or unauthorized actions without ever requiring admin credentials. No public exploit code has been identified and this CVE is not listed in CISA KEV at the time of analysis.
Stored XSS in Adobe Commerce and Magento Open Source enables a low-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon page visit - with scope change allowing script execution beyond the vulnerable component's security boundary, potentially enabling full account or session takeover. The CVSS 8.7 High score reflects network accessibility, low complexity, changed scope, and high confidentiality and integrity impact. No active exploitation (KEV) or public POC has been identified at time of analysis; Adobe released patched August 2026 builds across all affected product lines per advisory APSB26-92.
Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.
Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker to inject and render malicious content within a target user's Teams client, achieving spoofing of interface elements or participants over the network. The scope-changed CVSS vector (S:C, C:H) indicates the vulnerability can expose data beyond the Teams application boundary - potentially including session tokens or cross-context information - when a victim views attacker-controlled content. No public exploit code has been identified and SSVC classifies exploitation as none, though the high confidentiality impact warrants prioritized patching for organizations reliant on Teams for sensitive communications.
Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).
Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.
Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capability on any of the site's own domains to invoke privileged backend routes and Install Tool endpoints using an authenticated victim's session. The regression was introduced in TYPO3 13.0.0 when both the backend and Install Tool were moved to serve from the site root entry point rather than the dedicated `/typo3/` subdirectory, causing the `ReferrerEnforcer` to accept any same-origin Referer header as legitimate backend traffic. Affected versions are TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5; no public exploit code has been identified at time of analysis.
Stored cross-site scripting in Discourse's Chat plugin allows an authenticated user to inject arbitrary HTML and JavaScript into any viewer's browser session by embedding a malicious payload in the username field of a chat-transcript quote block. The Rich Text Editor rendered the username attribute via `innerHTML` without sanitization, meaning any authenticated Discourse member with chat access could craft a quote block that executes attacker-controlled script when a victim - potentially a moderator or administrator - views the transcript. Patch versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are confirmed released; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.
Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.
Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.
Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.
Stored XSS in SP Page Builder (Joomla extension by JoomShaper) prior to version 6.7.0 allows unauthenticated remote attackers to persist arbitrary JavaScript in a Joomla site's database via a single HTTP request to the Shapes API endpoint. When any administrator subsequently opens the SP Page Builder editor, the payload executes automatically in their browser session, enabling session hijacking, credential theft, or full backend site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection vector combined with automatic detonation on routine admin activity makes this a high-priority patch target for any Joomla installation running this extension.
Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.
Reflected cross-site scripting in AIL Framework's /tag/add_tags endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of any authenticated AIL user who opens a specially crafted link. The flaw originates from the error-handling path in tags_ui.py, which returned raw Python string output via str(res[0]) directly as an HTML response without output encoding, permitting attacker-controlled content to be reflected and rendered by the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix has been committed to the GitHub repository.
Stored cross-site scripting in OpenReception appointment-booking-software prior to version 1.0.2 allows a TENANT_ADMIN to plant malicious `javascript:` URIs in tenant link fields (`website`, `imprint`, `privacyStatement`), which execute in patients' browsers when they click the rendered links on the public landing page. The critical impact is not merely XSS but a complete collapse of the platform's stated end-to-end encryption guarantee: JavaScript executing in the patient origin can intercept and exfiltrate plaintext form data before client-side encryption is applied, meaning a malicious tenant administrator can silently read patient health appointment data the product claims the server can never access. No confirmed active exploitation (no CISA KEV entry) and no public POC have been identified at time of analysis.
Arbitrary JavaScript execution in PDF.js (pdfjs-dist) allows an attacker to run unrestricted script in the context of any web application that renders attacker-controlled PDFs with default settings. The flaw stems from PDF.js's built-in scripting engine, which is enabled by default via the enableScripting flag, executing embedded JavaScript from PDFs without sandbox enforcement when no script-src CSP is present. Applications using pdfjs-dist versions 5.6.83 through 6.2.107 are affected; no public exploit or KEV listing is identified at time of analysis, but the default-on configuration makes real-world exposure broad.
Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.
Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.
Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.
Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.
Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.
Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.
Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.
Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.
Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.
Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.
Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.
Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.
Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.
Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.
Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.
Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.
Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.
Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.
Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.
Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.
Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.
Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.
Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.
Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.
Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.
Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.
Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.
Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in `resources/views/portal/ninja2020/invoices/includes/terms.blade.php`, with no HTML sanitization performed in `StoreInvoiceRequest.php`, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.
Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.
Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.
Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.
Stored cross-site scripting in Open WebUI 0.10.0-0.10.2 allows any authenticated user to craft a math block that causes a KaTeX RangeError (stack overflow from deeply nested braces), forcing the KatexRenderer.svelte error fallback to inject unescaped HTML directly into the DOM via Svelte's `{@html}` directive. Any user who subsequently views the message - including administrators - executes attacker-controlled JavaScript on the Open WebUI origin, enabling session token theft from localStorage and full account takeover. A detailed, weaponizable proof-of-concept is publicly documented in the vendor GHSA advisory, including demonstrated administrator session exfiltration; no CISA KEV listing has been identified at time of analysis.
Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a file with an attacker-controlled Content-Type header; CVAT then serves the asset with that header intact, causing a victim's browser to render the file as an HTML page and execute any embedded JavaScript. The attack targets collaborative annotation workflows where guides are shared across users or teams, enabling session hijacking, credential theft, or unauthorized actions within the victim's browser context. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. The vendor-released fix is version 2.67.0.
The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The `serveUrl` iframe branch unconditionally combined `allow-same-origin` with `allow-scripts` for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or `workspace.functions`, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.
Cross-site scripting in the Angular compiler's i18n pipeline allows arbitrary JavaScript injection into localized application builds when event-handler attributes such as `onerror` or `onclick` are marked for translation using `i18n-on*` template directives. Angular's standard `validateAttribute()` and `validateProperty()` guards block binding to event-handler attributes at runtime, but the `I18nMetaVisitor` code path in `packages/compiler/src/render3/view/i18n/meta.ts` contained no equivalent restriction, enabling a lower-trust translation file to replace a benign handler with executable JavaScript at compile time. Patched versions 22.0.1, 21.2.19, and 20.3.27 are available; no public exploit has been identified at time of analysis.
Cross-site scripting in @angular/platform-server's domino DOM emulation library allows attackers to inject executable script blocks into SSR-rendered HTML by supplying closing-tag sequences inside user-controlled data bound to <iframe>, <noembed>, <noframes>, or <noscript> Angular template elements. Angular 20.x through 22.x applications using Server-Side Rendering that reflect user input into these specific fallback raw-content elements are affected; Angular 19.x and earlier receive no backport patch. No public exploit has been identified at time of analysis, though the mechanism is straightforward once the vulnerable application pattern is present, and patches are available across three supported Angular branches.
Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.
Stored Cross-Site Scripting in the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin (all versions through 4.3.3) allows unauthenticated network attackers to plant arbitrary JavaScript via form field values submitted to the plugin's form endpoints. The payload is persisted to the database and fires in any authenticated or unauthenticated user's browser upon visiting the injected page, with scope change confirmed by CVSS S:C. No active exploitation has been confirmed by CISA KEV, but Wordfence's disclosure includes direct references to the vulnerable source lines, effectively providing a functional roadmap to exploitation. The EPSS probability is not provided in the source data.
Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.
Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.
Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.
Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.
Stored cross-site scripting in OpenClaw Dashboard 1.1.0 lets unauthenticated remote attackers plant JavaScript in agent transcript messages that later executes in the administrator's authenticated browser session. Because the malicious message is submitted through the unauthenticated sessions API and rendered unsanitized via innerHTML on the default landing page, an attacker can steal admin session tokens and invoke privileged endpoints, including modifying agent instruction files. Publicly available exploit details exist in a dedicated advisory writeup; there is no evidence of active exploitation (not in CISA KEV), and the CVSS 4.0 base score is 8.8.
Stored cross-site scripting in OpenClaw Dashboard v3.0.0 lets an unauthenticated remote attacker seed a malicious payload simply by submitting a crafted username in a failed login attempt, which the audit log stores verbatim. When an administrator later opens the notification panel, the log entry is rendered through innerHTML under a permissive CSP that permits inline event handlers, executing the payload in the admin's authenticated session and enabling full account takeover. No public exploit was identified at time of analysis, though a dedicated write-up advisory exists; the CVSS 4.0 base score is 9.3 (Critical), reflecting the account-takeover impact.
Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.
Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.
Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).
Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.
Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.
Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.
Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.