XSS
Monthly
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Cross-site scripting in the BlackBerry UEM Management Console lets an attacker supply malformed input that is rendered without proper neutralization, so script executes in the browser of a logged-in administrator viewing the affected console page. The injection point is reachable without authentication (CVSS vector PR:N), but the payload only fires when a privileged console user actively interacts with the crafted content (UI:A), which is why the independent assessment rates real-world risk MODERATE rather than critical despite the vendor's 8.6 CVSS 4.0 score. Affected builds are UEM 12.23.0 QF8 and earlier plus 12.22.1 QF7 and earlier; EPSS is only 0.26 percent (17th percentile), SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis.
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p
Cross-site scripting in Pivotick via the per-node style.svgIcon property allows an attacker who can influence graph data to execute arbitrary JavaScript in the context of the embedding application. Affects Pivotick versions up to 1.4.0. No active exploitation or public exploit reported at time of analysis, but the CVSS 4.0 base score is 8.2.
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Reflected cross-site scripting in the WordPress plugin 'Database for Contact Form 7, WPForms, Elementor Forms' (Database for CF7) before version 1.5.3 allows an unauthenticated remote attacker to inject script into an administrative page via a request parameter that is echoed back without sanitisation or escaping. Exploitation is not automatic: the attacker must deliver a crafted URL and a logged-in WordPress administrator must click it, but because the CVSS vector assigns S:C the script executes in the admin's privileged context, enabling session abuse, malicious admin-side actions, or further compromise of the site. Publicly available exploit code exists and the vendor has released version 1.5.3 as the fix; EPSS is low at 0.15% (5th percentile), SSVC rates the issue as POC-based but non-automatable with partial technical impact, and it is not confirmed as actively exploited (not listed in CISA KEV).
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Stored cross-site scripting in Prospero Flow CRM before 5.4.4 allows low-privileged authenticated users to inject JavaScript into email bodies that execute when viewed by administrators, leading to session hijacking and account takeover. The vulnerability stems from unsanitized email content rendered unescaped via {!! ... !!}. A patch is available and no public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in SiYuan before v3.7.2 allows remote code execution. Attackers with editor permissions can inject a malicious `title-img` Individual Attribute List value, which is unescaped when rendering Gallery and Kanban cover images, executing arbitrary JavaScript in the Electron renderer with full Node.js access. This vendor-disclosed vulnerability is not known to be actively exploited, but exploitation is feasible with editor-level access.
Reflected cross-site scripting in SiYuan Desktop before v3.7.2 enables remote code execution by luring a user to open a malicious siyuan:// deep link. The vulnerability resides in the bazaar plugin readme handler, which uses insertAdjacentHTML to render unsanitized plugin names from the link, allowing injected JavaScript to run with full Node.js access in the insecure Electron renderer. Active exploitation is not confirmed, but a public proof-of-concept is available.
Stored and reflected cross-site scripting (XSS) in SiYuan versions prior to 3.7.3 allows authenticated attackers to execute arbitrary JavaScript in the application origin by embedding script payloads in SVG elements that evade the HTML
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Reflected cross-site scripting in XMLRPC-C Library versions 1.07 through 1.67.01 allows unauthenticated attackers to execute arbitrary JavaScript when a victim clicks a crafted link, as the error page component reflects unsanitized user input. This can lead to theft of sensitive session data or other browser-accessible information from affected services. No public exploit code or active exploitation has been reported at this time.
Command injection in NoteGen before 0.32.0 allows remote code execution when an attacker can execute JavaScript in the application webview. The default Tauri shell plugin capability permits execution of bash, python, and python3 with arbitrary arguments, enabling the webview to run OS commands with the app's privileges, typically leading to full host compromise via cross-site scripting.
Cross-site scripting in NoteGen before 0.32.0 allows malicious AI model responses to execute arbitrary JavaScript in the privileged Tauri webview. The application renders chat output with markdown-it configured to allow raw HTML and injects it unsanitized via dangerouslySetInnerHTML, so an attacker who controls the model prompt (e.g., through a weaponized skill file) can trigger script execution when the user views the response. No active exploitation is known, but a public proof of concept is available, and the vulnerability has a high severity CVSS score of 8.1.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Stored XSS in the OPC XML-DA server statistics endpoint of multiple Loytec building automation devices allows an unauthenticated remote attacker to inject and persistently store arbitrary JavaScript by supplying a crafted User-Agent header in a POST request to the /da endpoint. When an administrator subsequently views the statistics page, the payload executes in their browser, enabling session hijacking, credential theft, and unauthorized device reconfiguration. Affected products include LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware through 8.4.16 on the LINX-A64 platform; no public exploit or KEV listing has been identified as of this analysis.
Reflected XSS in Google Cloud Looker allows an unauthenticated remote attacker to execute arbitrary JavaScript in an authenticated user's browser via a specially crafted URL, with the worst-case consequence being full administrative account takeover. All Looker release branches prior to versions 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 are affected across both Looker-hosted and self-hosted deployments; Google has already applied mitigations to Looker-hosted instances, leaving self-hosted operators as the remaining exposure surface. No public exploit code or active exploitation has been identified at time of analysis, with EPSS at 0.27% and no CISA KEV listing, though SSVC rates technical impact as total given the admin-takeover potential.
Stored cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts through the 'vbfX' custom field via the publicly accessible saveorder task. Affected versions up to 1.8.13 enable code execution in the context of any user viewing the injected page, with potential for cookie theft or session hijacking. No known exploitation in the wild; EPSS indicates low probability of exploitation.
Cross-site-scripting-to-RCE in the SiYuan Desktop note-taking application (versions before v3.7.2) lets a remote attacker achieve arbitrary OS command execution when a victim opens a crafted siyuan://plugins/<name> link. Because the Electron renderer runs with nodeIntegration:true, an unescaped icon parameter injected via innerHTML escalates a reflected XSS into full command execution through Node's child_process. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable once a user is lured into clicking a malicious link (CVSS 4.0 base 9.4).
Stored cross-site scripting leading to remote code execution in SiYuan (self-hosted note-taking application) before v3.7.2 allows an attacker to run arbitrary OS commands when a victim views a database. A Template-column value in the Attribute View is rendered through Go's text/template without auto-escaping, and the EscapeHTML safeguard is bypassed by balanced self-closing tags like <img>, so a payload such as <img src=x onerror=...> is stored raw and later injected via innerHTML; because the Electron desktop renderer runs with nodeIntegration enabled, the script reaches require and escalates to command execution. No public exploit identified at time of analysis, and it is not listed in CISA KEV, though a detailed VulnCheck advisory and vendor GHSA describe the flaw.
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.
Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.
Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.
Stored cross-site scripting in the FormCraft WordPress plugin (all versions through 3.9.14) lets unauthenticated attackers persist malicious JavaScript that executes in any user's browser when an affected page is rendered. The flaw stems from a two-sided sanitization gap: composite matrix sub-field keys (e.g. field2_0) are written raw via $wpdb->insert(), and the client-side DOMPurify guard is skipped because matrix values arrive as arrays rather than strings. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but its unauthenticated, network-reachable nature (CVSS 7.2) makes it a meaningful patch priority for exposed sites.
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. The CVSS 8.8 rating reflects the high impact of hijacking a privileged WordPress session despite the requirement that a victim open the crafted file.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Stored cross-site scripting in FOG Project's inventory reporting pipeline allows an unauthenticated network attacker to inject persistent JavaScript into the admin interface by submitting a crafted `sysproduct` field to the client-facing `/service/inventory.php` endpoint using any known registered host MAC address. The payload is persisted to the database and executes in an administrator's browser when they open Reports > Inventory, enabling session hijacking, credential theft, or admin-level actions including host manipulation and imaging pipeline control. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 12th percentile), but the stored nature of the payload and its execution in a privileged admin context make this a meaningful risk for any internet-exposed or internally accessible FOG deployment.
Stored XSS in FOG Project's unauthenticated inventory endpoint allows network-accessible attackers to inject persistent malicious scripts that execute in any administrator's browser session. Affecting fogproject versions prior to 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta), the flaw chains an unsanitized write path at /service/inventory.php with unencoded HTML rendering on the Host Management Inventory page, producing a scope-changing XSS condition with high confidentiality and integrity impact on the admin session. No public exploit has been identified at time of analysis, but the unauthenticated write vector combined with high-privilege execution context makes this a high-priority patch despite a low EPSS score of 0.20%.
Reflected cross-site scripting in the DHIS2 OpenAPI HTML documentation endpoint allows an attacker to execute arbitrary JavaScript in a victim's browser within the DHIS2 origin by luring an authenticated user to a crafted URL. The endpoint echoes the `scope` query parameter into the generated HTML page without sufficient sanitization (CWE-79), affecting DHIS2 core versions 2.42 and 2.43 prior to the 2026-06-09 security releases and the 2.44 development branch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but successful exploitation can hijack the victim's DHIS2 session and act with their privileges.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Stored cross-site scripting in the Free Theme Builder for Elementor WordPress plugin before 1.6.7 lets unauthenticated attackers inject malicious script through contact form field values, which are stored unsanitized and later rendered in the admin dashboard's form-submissions view. The payload executes in the browser of any logged-in administrator who reviews submissions, enabling session hijacking or actions in the admin's context. Publicly available exploit code exists (WPScan), but there is no evidence of active exploitation and EPSS probability is low (0.17%).
Cross-site scripting in DayuanJiang next-ai-draw-io 0.4.13 lets a remote unauthenticated attacker inject arbitrary script through the mcp parameter, executing in the victim's browser when they open a crafted link. The 'arbitrary code' claim and RCE tag in the source data most plausibly refer to arbitrary JavaScript in the browser (CWE-79 reflected XSS) rather than server-side code execution. EPSS is low (0.29%, 21st percentile), there is no CISA KEV listing, and no public exploit is confirmed, though third-party GitHub writeups referencing this CVE exist.
Stored and reflected cross-site scripting in ThemeXpert's JMedia media-manager extension for Joomla lets an attacker upload a malicious SVG file that, because it is served without an X-Content-Type-Options: nosniff header, is interpreted and executed as active script in the context of the site. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the attack is well-understood and trivially reproducible. The supplied CVSS 4.0 base score of 9.4 appears inflated for a script-injection issue, so treat the raw number with caution.
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated builder-level user persist malicious scripts - including unsanitised SVG payloads - that then execute in the browser of any visitor or administrator who renders the affected page. Because the payload fires against higher-privileged admins, it enables session/account takeover of the Joomla back end. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in Chamilo LMS 1.11.38 and earlier lets any unauthenticated attacker inject persistent JavaScript through the public user registration form, which then executes in an administrator's browser when they review registrations, enabling full admin account takeover. The flaw carries a CVSS 9.3 rating driven by its scope change and high confidentiality/integrity impact; no public exploit is identified at time of analysis, though the vendor GitHub Security Advisory (GHSA-gcjp-f7jm-rrrg) confirms the issue and a fix. Because the injection point is an anonymous, self-service form, mass or opportunistic abuse is realistic once a payload is planted.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team member persist malicious JavaScript that fires in the browser of a team owner who later views the affected form, yielding full account takeover through privilege escalation. The flaw stems from insufficient sanitization of rich-text/HTML block content, allowing event-handler attributes and dangerous URL protocols to survive serialization. No public exploit has been identified at time of analysis, but the underlying commit (cc97d27) and GHSA advisory clearly document the injection vector, and the CVSS 9.0 rating reflects the high blast radius of hijacking an owner session.
Reflected cross-site scripting in the WordPress plugin 'Tag Groups is the Advanced Way to Display Your Taxonomy Terms' before version 2.2.0 allows unauthenticated attackers to run arbitrary JavaScript in the browser of a logged-in Editor (or higher) who clicks a crafted link, because one AJAX parameter is reflected unescaped into an HTML-typed response. Publicly available exploit code exists (published by WPScan), but the flaw is not listed in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no evidence of widespread active exploitation. Successful exploitation can hijack an editorial session, letting the attacker act with the victim's WordPress capabilities.
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.
Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject a persistent payload through a geolocation value that fires when an administrator opens the analytics reports, enabling admin-session compromise. The flaw is only reachable when the plugin is configured to use the Cloudflare geolocation provider. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; no public exploit identified as actively exploited and it is not in CISA KEV.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an authenticated user inject persistent JavaScript through the voicemail notification template feature, which then executes in the browsers of other users who view the affected template. The payload is submitted via the template_text parameter to the submit_modify_voicemail_template endpoint, which fails to sanitize HTML. No public exploit identified at time of analysis, though the flaw was disclosed with a technical writeup by researchers at SRA; it is not listed in CISA KEV.
Reflected cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted link. The flaw stems from the application reflecting an unsanitized 'portal' parameter into JavaScript emitted by the invalid_browser and invalid_browser_login handlers. No public exploit is identified at time of analysis, though the reporting researcher (SRA) has published a technical writeup, and no evidence of active exploitation exists.
Stored cross-site scripting in the ChronoForms extension for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in the browser of anyone who later views the affected page. The flaw carries a CVSS 4.0 base score of 8.7 and requires no authentication (PR:N), though a victim must load the poisoned content (UI:P). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions through 2.4.18) lets fully unauthenticated attackers persist arbitrary JavaScript through the form's 'digitalSignature' field value, which is neither sanitized on input nor escaped on output. Because the form-submission nonce is exposed on any page rendering the form shortcode, the normal anti-CSRF barrier provides no protection, and the injected script executes in the browser of any user (including administrators) who later views the affected page. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a practical scan-and-spray candidate.
Reflected cross-site scripting in Emlog 2.6.13 and earlier lets a remote attacker execute arbitrary JavaScript in an authenticated administrator's backend session by luring the admin to open a crafted link that hits the user-search feature in admin/user.php. The keyword parameter is sanitized with addslashes but never HTML-escaped before it is echoed into a value attribute in admin/views/user.php, so injected markup breaks out of the attribute and runs in the admin's browser. No public exploit identified at time of analysis, and no fixed version currently exists.
Stored cross-site scripting in the Breakdance WordPress page-builder plugin (versions through 2.7.1) lets unauthenticated attackers inject persistent JavaScript through the 'fields' parameter, which then runs in the browser of any user who views the affected page. The flaw carries a CVSS 3.1 score of 7.2, elevated by a scope change (S:C) because the payload executes in visitors' browser sessions rather than the server context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Wordfence discovered and reported it.
Reflected Cross-Site Scripting in the FunnelKit WordPress plugin before 3.15.0.6 lets unauthenticated attackers inject arbitrary JavaScript into a page-builder AJAX response, which executes in the browser of a logged-in user who opens an attacker-crafted link. The flaw is only reachable when the Divi builder integration is active, and publicly available exploit code exists though there is no public exploit identified as actively exploited at time of analysis. EPSS was not provided and the vulnerability is not on CISA KEV, so widespread exploitation is unconfirmed.
Stored cross-site scripting in the RPB Chessboard WordPress plugin (all versions through 8.1.2) lets unauthenticated attackers plant persistent JavaScript through comment content that executes in the browser of anyone who later views the affected page. The novel aspect, per Wordfence, is that WordPress's normal save-time kses sanitization is bypassed because the payload uses only kses-allowed tags/attributes (an <a> element with title and href) and the dangerous attribute-breaking markup is assembled entirely at render time by the plugin's own comment_text filter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-interaction entry point makes it a practical drive-by injection risk.
Stored/reflected XSS in the ViewComponent Rails gem (versions >= 4.0.0, < 4.12.0) arises because HTML-unsafe strings returned from a component's around_render hook bypass the automatic escaping applied to normal #call output, letting attacker-controlled data reach the browser as raw HTML. The flaw is amplified in collection rendering, where Collection#render_in joins per-item output and blindly marks it html_safe, laundering unsafe content into a trusted SafeBuffer. Publicly available exploit code exists (a detailed PoC in the GitHub advisory), but there is no public exploit identified as actively used in the wild; a vendor patch is available in v4.12.0.
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
Stored cross-site scripting in MantisBT (versions <= 2.28.3) lets an authenticated user inject arbitrary HTML/JavaScript through a crafted image-attachment filename that breaks out of an IMG tag's alt attribute. The payload executes when any user (including higher-privileged reviewers) renders the Word/HTML export view at print_all_bug_page_word.php?type_page=html&export=1, though real-world impact is constrained by MantisBT's Content Security Policy. There is no public exploit identified at time of analysis, and the flaw is fixed in 2.28.4.
Reflected cross-site scripting in MantisBT 2.28.3 and earlier lets remote attackers inject HTML into the unauthenticated /admin/install.php installer page through six user-supplied parameters echoed via an unescaped printf format string. Because the application ships a script-src 'self' Content Security Policy that lacks a form-action directive, an attacker cannot run inline JavaScript but can render fake credential-harvesting login forms, perform <meta>-based open redirects, and overlay attacker HTML via CSS injection on the legitimate admin page. There is no public exploit identified at time of analysis, no CISA KEV listing, and no CVSS/EPSS score in the provided data; the issue was reported by watchTowr and fixed in 2.28.4.
Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.
Cross-site scripting in the BlackBerry UEM Management Console lets an attacker supply malformed input that is rendered without proper neutralization, so script executes in the browser of a logged-in administrator viewing the affected console page. The injection point is reachable without authentication (CVSS vector PR:N), but the payload only fires when a privileged console user actively interacts with the crafted content (UI:A), which is why the independent assessment rates real-world risk MODERATE rather than critical despite the vendor's 8.6 CVSS 4.0 score. Affected builds are UEM 12.23.0 QF8 and earlier plus 12.22.1 QF7 and earlier; EPSS is only 0.26 percent (17th percentile), SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis.
We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p
Cross-site scripting in Pivotick via the per-node style.svgIcon property allows an attacker who can influence graph data to execute arbitrary JavaScript in the context of the embedding application. Affects Pivotick versions up to 1.4.0. No active exploitation or public exploit reported at time of analysis, but the CVSS 4.0 base score is 8.2.
Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.
Reflected cross-site scripting in the WordPress plugin 'Database for Contact Form 7, WPForms, Elementor Forms' (Database for CF7) before version 1.5.3 allows an unauthenticated remote attacker to inject script into an administrative page via a request parameter that is echoed back without sanitisation or escaping. Exploitation is not automatic: the attacker must deliver a crafted URL and a logged-in WordPress administrator must click it, but because the CVSS vector assigns S:C the script executes in the admin's privileged context, enabling session abuse, malicious admin-side actions, or further compromise of the site. Publicly available exploit code exists and the vendor has released version 1.5.3 as the fix; EPSS is low at 0.15% (5th percentile), SSVC rates the issue as POC-based but non-automatable with partial technical impact, and it is not confirmed as actively exploited (not listed in CISA KEV).
Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.
Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.
Cross-site scripting in the BackWPup WordPress plugin (version 5
Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.
Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of
Unauthenticated cross-site scripting in the WordPress plugin Ultimate Addons for Contact Form 7 (versions 3.5.45 and earlier) allows remote attackers to inject client-side script into pages rendered by a vulnerable site, with a CVSS 3.1 base score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). No authentication is needed to deliver the payload, but successful exploitation requires victim interaction - a user must be induced to click a crafted link or trigger rendering of attacker-influenced input that is reflected without proper sanitization - which keeps the impact confined to the victim's browser rather than the server. Only sites with the plugin installed and active at version 3.5.45 or below are exposed; there is no public exploit identified at time of analysis, CISA KEV does not list this CVE, EPSS is low at 0.15% (4th percentile), and CISA's SSVC assessment records Exploitation: none, Automatable: no, Technical Impact: partial.
Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.
Unauthenticated cross-site scripting vulnerability in the CleanTalk Anti-Spam WordPress plugin (versions up to 6.82) allows remote attackers to inject arbitrary web scripts. A successful attack requires a victim user to click a malicious link, enabling the attacker to execute JavaScript in the user's browser session, which can lead to session hijacking or defacement. No active exploitation or public exploit code has been identified.
Cross-site scripting in the miniorange otp verification WordPress plugin <=5.5.1 enables unauthenticated attackers to inject arbitrary web scripts, potentially compromising site visitors who interact with a crafted link. The vulnerability is high severity (CVSS 7.1) due to network attack vector and changed scope, but requires user interaction. No active exploitation or public exploit code has been confirmed from available sources.
Stored cross-site scripting in Lookyloo (versions up to and including 1.40.0) lets an attacker inject arbitrary HTML/JavaScript into the capture tree visualization page. Because the serialized capture tree was rendered directly into an inline <script> block via the Jinja `safe` filter, attacker-controlled content captured from a target website can break out of the script element and execute in the browser of any analyst who later views that capture tree. No public exploit identified at time of analysis; EPSS is low (0.28%, 20th percentile), consistent with the SSVC assessment of no observed exploitation, but the impact rating is total.
Stored cross-site scripting in Prospero Flow CRM before 5.4.4 allows low-privileged authenticated users to inject JavaScript into email bodies that execute when viewed by administrators, leading to session hijacking and account takeover. The vulnerability stems from unsanitized email content rendered unescaped via {!! ... !!}. A patch is available and no public exploit or active exploitation has been identified.
Stored cross-site scripting (XSS) in SiYuan before v3.7.2 allows remote code execution. Attackers with editor permissions can inject a malicious `title-img` Individual Attribute List value, which is unescaped when rendering Gallery and Kanban cover images, executing arbitrary JavaScript in the Electron renderer with full Node.js access. This vendor-disclosed vulnerability is not known to be actively exploited, but exploitation is feasible with editor-level access.
Reflected cross-site scripting in SiYuan Desktop before v3.7.2 enables remote code execution by luring a user to open a malicious siyuan:// deep link. The vulnerability resides in the bazaar plugin readme handler, which uses insertAdjacentHTML to render unsanitized plugin names from the link, allowing injected JavaScript to run with full Node.js access in the insecure Electron renderer. Active exploitation is not confirmed, but a public proof-of-concept is available.
Stored and reflected cross-site scripting (XSS) in SiYuan versions prior to 3.7.3 allows authenticated attackers to execute arbitrary JavaScript in the application origin by embedding script payloads in SVG elements that evade the HTML
Cross-site scripting in the Booking Calendar WordPress plugin through version 11.4.2 allows unauthenticated attackers to inject script code, leading to data theft or action execution on behalf of a victim who clicks a crafted link. The vulnerability is a reflected XSS requiring user interaction; no public exploit code or active exploitation has been identified at the time of analysis.
Reflected cross-site scripting in the Acowebs "Dynamic Pricing With Discount Rules for WooCommerce" WordPress plugin (versions up to and including 4.5.11) lets unauthenticated remote attackers inject arbitrary script that executes in a victim's browser when they follow a crafted link. The scope-changed CVSS 3.1 score of 7.1 reflects that injected script runs in the WordPress/WooCommerce site context, potentially reaching authenticated admin sessions. There is no public exploit identified at time of analysis, and the low EPSS score (0.18%, 8th percentile) plus SSVC "exploitation: none" indicate no observed exploitation to date.
Cross-site scripting (XSS) vulnerability in the Product Feed Manager WordPress plugin (<= 7.6.1) allows unauthenticated attackers to inject arbitrary web scripts via a crafted request. When a victim user (e.g., administrator) interacts with the malicious link, the script executes in the browser with the site's privileges, potentially leading to session hijacking, defacement, or data theft. No active exploitation or public exploit code has been observed.
Reflected Cross-Site Scripting (XSS) in MPG WordPress plugin before 4.1.8 allows unauthenticated attackers to inject scripts into a victim's browser by tricking them into visiting a crafted URL. Successful exploitation can lead to session hijacking or defacement. Public exploit code exists, but no active exploitation has been confirmed by CISA KEV.
Reflected cross-site scripting in XMLRPC-C Library versions 1.07 through 1.67.01 allows unauthenticated attackers to execute arbitrary JavaScript when a victim clicks a crafted link, as the error page component reflects unsanitized user input. This can lead to theft of sensitive session data or other browser-accessible information from affected services. No public exploit code or active exploitation has been reported at this time.
Command injection in NoteGen before 0.32.0 allows remote code execution when an attacker can execute JavaScript in the application webview. The default Tauri shell plugin capability permits execution of bash, python, and python3 with arbitrary arguments, enabling the webview to run OS commands with the app's privileges, typically leading to full host compromise via cross-site scripting.
Cross-site scripting in NoteGen before 0.32.0 allows malicious AI model responses to execute arbitrary JavaScript in the privileged Tauri webview. The application renders chat output with markdown-it configured to allow raw HTML and injects it unsanitized via dangerouslySetInnerHTML, so an attacker who controls the model prompt (e.g., through a weaponized skill file) can trigger script execution when the user views the response. No active exploitation is known, but a public proof of concept is available, and the vulnerability has a high severity CVSS score of 8.1.
Reflected Cross-Site Scripting in Loytec LWEB-802 versions prior to 5.0.8 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by enticing them to click a crafted link containing malicious project or mspParams parameters. No active exploitation has been observed in the wild and EPSS indicates a low probability of exploitation (0.36%). Vendor has released a fix in version 5.0.8.
Stored XSS in the OPC XML-DA server statistics endpoint of multiple Loytec building automation devices allows an unauthenticated remote attacker to inject and persistently store arbitrary JavaScript by supplying a crafted User-Agent header in a POST request to the /da endpoint. When an administrator subsequently views the statistics page, the payload executes in their browser, enabling session hijacking, credential theft, and unauthorized device reconfiguration. Affected products include LIP-ME20xC, L-INX, L-GATE, L-ROC, L-IOB, L-DALI, L-VIS, and L-PAD running firmware through 8.4.16 on the LINX-A64 platform; no public exploit or KEV listing has been identified as of this analysis.
Reflected XSS in Google Cloud Looker allows an unauthenticated remote attacker to execute arbitrary JavaScript in an authenticated user's browser via a specially crafted URL, with the worst-case consequence being full administrative account takeover. All Looker release branches prior to versions 25.6.103, 25.12.65, 25.18.68, 26.0.66, 26.2.47, 26.4.36, 26.6.28, and 26.8.7 are affected across both Looker-hosted and self-hosted deployments; Google has already applied mitigations to Looker-hosted instances, leaving self-hosted operators as the remaining exposure surface. No public exploit code or active exploitation has been identified at time of analysis, with EPSS at 0.27% and no CISA KEV listing, though SSVC rates technical impact as total given the admin-takeover potential.
Stored cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress allows unauthenticated attackers to inject arbitrary web scripts through the 'vbfX' custom field via the publicly accessible saveorder task. Affected versions up to 1.8.13 enable code execution in the context of any user viewing the injected page, with potential for cookie theft or session hijacking. No known exploitation in the wild; EPSS indicates low probability of exploitation.
Cross-site-scripting-to-RCE in the SiYuan Desktop note-taking application (versions before v3.7.2) lets a remote attacker achieve arbitrary OS command execution when a victim opens a crafted siyuan://plugins/<name> link. Because the Electron renderer runs with nodeIntegration:true, an unescaped icon parameter injected via innerHTML escalates a reflected XSS into full command execution through Node's child_process. No public exploit has been identified at time of analysis, but the flaw is trivially exploitable once a user is lured into clicking a malicious link (CVSS 4.0 base 9.4).
Stored cross-site scripting leading to remote code execution in SiYuan (self-hosted note-taking application) before v3.7.2 allows an attacker to run arbitrary OS commands when a victim views a database. A Template-column value in the Attribute View is rendered through Go's text/template without auto-escaping, and the EscapeHTML safeguard is bypassed by balanced self-closing tags like <img>, so a payload such as <img src=x onerror=...> is stored raw and later injected via innerHTML; because the Electron desktop renderer runs with nodeIntegration enabled, the script reaches require and escalates to command execution. No public exploit identified at time of analysis, and it is not listed in CISA KEV, though a detailed VulnCheck advisory and vendor GHSA describe the flaw.
Reflected/stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress theme (pixelacehq) affects all versions up to and including 7.5.4, allowing unauthenticated attackers to inject malicious script that executes in a victim's browser when they interact with a crafted link or page. Because the CVSS scope is changed (S:C), successful exploitation can impact resources beyond the theme itself, such as the WordPress admin session context. This is a Patchstack-reported issue with no public exploit identified at time of analysis and no evidence of active exploitation.
Reflected/unauthenticated Cross-Site Scripting in the PeproDev Ultimate Invoice WordPress plugin (versions 2.2.6 and earlier) allows a remote attacker to inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link or load a malicious request. No authentication is required (PR:N) but user interaction is (UI:R), and the scope-changed CVSS 7.1 reflects that injected script runs in the security context of the WordPress site rather than the plugin alone. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Dokan Pro WordPress multivendor marketplace plugin (versions up to and including 5.0.0) lets remote unauthenticated attackers inject JavaScript that executes in a victim's browser session, with no public exploit identified at time of analysis. Because the CVSS scope is marked Changed (S:C), successful execution can affect resources beyond the vulnerable component - e.g. hijacking an authenticated admin or vendor session in the surrounding WordPress site. The flaw was reported by Patchstack and requires victim user interaction (UI:R) to trigger.
Reflected/unauthenticated Cross-Site Scripting in the Form Vibes - Database Manager for Forms WordPress plugin (versions <= 1.5.2) lets a remote attacker inject script that executes in a victim's browser after they follow a crafted link or interact with attacker-controlled input. Because the CVSS scope is changed (S:C), successful execution can affect the wider WordPress session/DOM context, and with PR:N no authentication is required to launch the attack. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV; risk hinges on user interaction (UI:R).
Reflected/stored Cross-Site Scripting in the Bookly WordPress appointment-booking plugin (versions 27.7 and earlier) lets unauthenticated remote attackers inject browser-executable script that runs in a victim's session after they interact with a crafted link or booking element. Because the CVSS scope is changed (S:C), the injected payload escapes the plugin's context to impact the wider WordPress site, though impact is bounded (C:L/I:L/A:L) rather than full site takeover. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the flaw is unauthenticated and network-reachable, making it a practical phishing/session-abuse vector on high-traffic booking sites.
Stored/reflected Cross-Site Scripting in the Easy Form Builder WordPress plugin (versions 4.0.12 and earlier) allows remote unauthenticated attackers to inject malicious scripts that execute in a victim's browser when they view an affected page. Because PR:N and no authentication is required, an attacker only needs to lure a user (UI:R) into triggering the payload, and the scope-changed vector (S:C) means the injected script can affect the broader WordPress session context. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Unauthenticated cross-site scripting in the Product Enquiry for WooCommerce WordPress plugin (versions <= 2.2.34.43) lets a remote attacker inject arbitrary JavaScript that executes in a victim's browser when they view attacker-influenced content. The flaw is exploitable without authentication but requires the victim to interact (e.g., visit a crafted link or page), and the CVSS scope-change metric reflects that injected script runs in the trusted site context. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the issue was reported through Patchstack.
Reflected cross-site scripting in the AffiliateWP WordPress plugin (versions 2.34.0 and earlier) lets unauthenticated remote attackers inject browser-executed script by luring a victim to a crafted link, with the CVSS 3.1 scope-change flag indicating the payload can affect resources beyond the vulnerable component. No public exploit identified at time of analysis, and the vulnerability is not listed in CISA KEV; risk is driven by the plugin's affiliate-marketing footprint on WordPress sites and the low bar for triggering reflected XSS. EPSS data was not provided in the source intelligence.
Reflected Cross-Site Scripting in the ThemeGoods 'Grand Photography' WordPress theme (versions 5.7.8 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. The CVSS 3.1 score is 7.1 (scope-changed) and the flaw was disclosed by Patchstack under CWE-79. There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the WP Google Maps Pro WordPress plugin (all versions up to and including 10.1.02) lets an unauthenticated attacker inject browser-executed script that runs in the context of any user who views the affected page. Rated CVSS 7.1 with a scope-changed vector, the flaw requires victim interaction (UI:R) but no authentication (PR:N), meaning a crafted link or poisoned map component is enough to fire the payload. No public exploit identified at time of analysis and it is not listed in CISA KEV.
Cross-site scripting in the Breakdance WordPress page-builder plugin (soflyy) affects all versions up to and including 2.7.1, letting a remote unauthenticated attacker inject script that executes in a victim's browser after they interact with a crafted request or link. The CVSS 3.1 base score is 7.1 (scope change) and the flaw carries no authentication requirement (PR:N), though it does require user interaction (UI:R). There is no public exploit identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored/reflected Cross-Site Scripting in the Smart Manager (smart-manager-for-wp-e-commerce) WordPress plugin by StoreApps affects all versions up to and including 8.90.0, allowing unauthenticated attackers to inject browser-executed script that runs in the context of a victim who follows a crafted link or triggers the vulnerable flow. Because the CVSS scope is changed (S:C), successful exploitation can impact the broader WordPress site beyond the plugin's own boundary, potentially leading to admin session theft or actions performed as a logged-in operator. Reported by Patchstack; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected Cross-Site Scripting in the WebCodingPlace 'Real Estate Manager Pro' WordPress plugin (all versions through 12.8.5) lets an unauthenticated remote attacker inject arbitrary JavaScript that executes in a victim's browser when they follow a crafted link. Because CVSS marks a scope change (S:C), successful exploitation can affect resources beyond the plugin - typically hijacking the authenticated WordPress session/admin context of whoever clicks. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; the CVSS base score is 7.1 (High).
Stored/reflected Cross-Site Scripting in the bqworks Slider Pro WordPress plugin (versions 4.8.13 and earlier) allows a low-privileged Subscriber-level user to inject malicious script that executes in another user's browser. The flaw was reported by Patchstack and carries a CVSS 7.1 driven by a scope change (S:C). There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so exploitation is unproven in the wild.
Cross-Site Scripting in the BoldGrid Sprout Clients WordPress plugin (versions 3.2.3 and earlier) lets an unauthenticated attacker inject browser-executed script that runs in the context of a user who loads a crafted request or page. Because the CVSS vector shows PR:N with UI:R and a scope change (S:C), no account is needed but a victim must interact with a malicious link or page, after which script executes across a trust boundary into the victim's session. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Reflected/unauthenticated Cross-Site Scripting in the Download Monitor - WPForms Lock add-on for WordPress (versions ≤ 1.0.4) allows an attacker to inject arbitrary JavaScript that executes in a victim's browser session. Exploitation requires no authentication but does require the victim to interact with an attacker-supplied link or request (UI:R), and the changed scope (S:C) reflects that script runs in the browser security context rather than the plugin itself. There is no public exploit identified at time of analysis and the issue is not in CISA KEV, so this is a disclosed-but-not-yet-weaponized web flaw rather than an active-exploitation emergency.
Cross-site scripting in the ThimPress "Coaching" WordPress theme (versions <= 3.9.2) lets remote unauthenticated attackers inject arbitrary script that executes in a victim's browser after they interact with a crafted link or page. Reported by Patchstack under CWE-79, the flaw carries a CVSS 3.1 score of 7.1 with a scope change, but there is no public exploit identified at time of analysis and no active-exploitation (KEV) or EPSS signal in the provided data. Impact is primarily session/account compromise of users who view attacker-controlled content within a site running the theme.
Reflected/unauthenticated cross-site scripting affects Funnel Kit Funnel Builder PRO (WordPress plugin by Wisetr Inc.) in all versions up to and including 3.15.0.7, letting a remote attacker inject arbitrary JavaScript that executes in a victim's browser after they follow a crafted link or interact with malicious input. No authentication is required (PR:N), but victim interaction is (UI:R), and the CVSS scope change (S:C) reflects that injected script runs in the site's security context. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score was provided.
Reflected cross-site scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions 11.9.1 and earlier) allows an unauthenticated attacker to inject arbitrary JavaScript that executes in a victim's browser when a crafted link is opened. Disclosed by Patchstack, the flaw carries a CVSS 7.1 due to a scope change (S:C) into the browser context; there is no public exploit identified at time of analysis and it is not on the CISA KEV list. Impact is limited by the requirement for victim interaction (clicking a malicious link).
Stored cross-site scripting in the ARforms WordPress form-builder plugin (all versions through 7.2.1) lets unauthenticated attackers persist arbitrary JavaScript through submitted 'password' field values, which later executes in the browser of any user who loads the affected page. Because the injection point is a public-facing form and no authentication is required, the flaw is well-suited to opportunistic, automated abuse against WordPress sites running the plugin. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the CVSS 7.2 (scope-changed) rating and unauthenticated vector make it a meaningful patch priority.
Stored cross-site scripting in the FormCraft WordPress plugin (all versions through 3.9.14) lets unauthenticated attackers persist malicious JavaScript that executes in any user's browser when an affected page is rendered. The flaw stems from a two-sided sanitization gap: composite matrix sub-field keys (e.g. field2_0) are written raw via $wpdb->insert(), and the client-side DOMPurify guard is skipped because matrix values arrive as arrays rather than strings. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but its unauthenticated, network-reachable nature (CVSS 7.2) makes it a meaningful patch priority for exposed sites.
Unauthenticated stored cross-site scripting in the SUMO Reward Points for WooCommerce WordPress plugin (versions up to and including 32.7.0) lets any anonymous visitor inject persistent JavaScript through the `/wp-json/wc-srp/v1/earning` REST endpoint. A broken `user_has_cap` filter hands the `rs_earning_read` capability to everyone, so an attacker can write an unsanitized `reason` value that later executes in an administrator's browser when the Master Log or User Reward Points pages are viewed. There is no public exploit identified at time of analysis and the plugin is not on CISA KEV, but the flaw is trivially reachable and Wordfence-confirmed.
Full takeover of Oracle Platform Security for Java (OPSS), a security framework bundled with Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0, is possible via its Centralized Thirdparty Jars component. A low-privileged attacker with HTTP network access can compromise confidentiality, integrity, and availability, though the attack is rated difficult to execute (high attack complexity). No public exploit identified at time of analysis and the flaw is not in CISA KEV, but it was disclosed by Oracle in the July 2026 Critical Patch Update.
DOM-based cross-site scripting in Unblu Spark, reachable via an open-redirect flaw (CWE-601), lets remote attackers execute arbitrary JavaScript in a victim's browser after luring them to a crafted link. When Spark runs with com.unblu.identifier.siteEmbeddedSetup=true it shares the host application's origin, so injected script inherits full access to the host app's cookies, DOM, and same-origin APIs, expanding the blast radius well beyond Unblu itself and driving the CRITICAL 9.3 (CVSS 4.0) rating for on-prem embedded deployments. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
DOM-based cross-site scripting in n8n's HTML preview lets an authenticated global:member user execute JavaScript in the editor's same origin when a victim opens the preview. Because execution output is rendered into an iframe srcdoc without the sandbox attribute and a sanitizer bypass defeats the filtering, injected script runs same-origin and can invoke authenticated APIs using the victim's session, enabling account and workflow takeover. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is fixed in n8n 1.123.64, 2.29.8, and 2.30.1.
Stored DOM cross-site scripting in n8n's Resource Locator component allows a low-privileged workflow author to execute arbitrary JavaScript in another user's browser session. The flaw stems from the workflow-persisted cachedResultUrl value being passed to window.open() without scheme validation, letting a javascript: URI fire when a victim opens the crafted workflow and clicks an external link. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV, but exploitation is realistic in shared/multi-tenant n8n instances.
Stored cross-site scripting in the Product Addons and Product Options With Custom Fields WordPress plugin (all versions before 1.6.15) lets an unauthenticated attacker abuse an unrestricted file-upload endpoint to plant a malicious SVG that is stored and served inline; its embedded script then runs in the browser session of any user who opens it, including administrators, enabling account takeover. Publicly available exploit code exists and WPScan disclosed the issue, but no public exploit has been identified as used in active attacks. The CVSS 8.8 rating reflects the high impact of hijacking a privileged WordPress session despite the requirement that a victim open the crafted file.
Full compromise of Oracle WebCenter Content (Content Server component) versions 12.2.1.4.0 and 14.1.2.0.0 is possible over HTTP by an unauthenticated remote attacker who lures a legitimate user into interacting with malicious content. Rated CVSS 3.1 8.8 with high confidentiality, integrity and availability impact, the flaw can lead to full takeover of the WebCenter Content instance. Disclosed via Oracle's July 2026 Critical Patch Update; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full compromise of Oracle WebCenter Content (Fusion Middleware, Web Content Management component) is possible in versions 12.2.1.4.0 and 14.1.2.0.0, where a low-privileged, network-authenticated attacker who lures a victim into a triggering action can achieve complete takeover of the product with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.0). Oracle rates the flaw as easily exploitable over HTTP but conditions it on human interaction from a second party. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Full takeover of Oracle WebCenter Content (Content Server component) is possible when an unauthenticated remote attacker over HTTP lures a legitimate user into interacting with malicious content, per Oracle's July 2026 Critical Patch Update. Affected supported releases are 12.2.1.4.0 and 14.1.2.0.0, and the CVSS 3.1 base score of 8.8 reflects high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so risk is currently theoretical but rated high due to the complete-compromise outcome.
Stored cross-site scripting in FOG Project's inventory reporting pipeline allows an unauthenticated network attacker to inject persistent JavaScript into the admin interface by submitting a crafted `sysproduct` field to the client-facing `/service/inventory.php` endpoint using any known registered host MAC address. The payload is persisted to the database and executes in an administrator's browser when they open Reports > Inventory, enabling session hijacking, credential theft, or admin-level actions including host manipulation and imaging pipeline control. No public exploit has been identified at time of analysis and EPSS is low (0.22%, 12th percentile), but the stored nature of the payload and its execution in a privileged admin context make this a meaningful risk for any internet-exposed or internally accessible FOG deployment.
Stored XSS in FOG Project's unauthenticated inventory endpoint allows network-accessible attackers to inject persistent malicious scripts that execute in any administrator's browser session. Affecting fogproject versions prior to 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta), the flaw chains an unsanitized write path at /service/inventory.php with unencoded HTML rendering on the Host Management Inventory page, producing a scope-changing XSS condition with high confidentiality and integrity impact on the admin session. No public exploit has been identified at time of analysis, but the unauthenticated write vector combined with high-privilege execution context makes this a high-priority patch despite a low EPSS score of 0.20%.
Reflected cross-site scripting in the DHIS2 OpenAPI HTML documentation endpoint allows an attacker to execute arbitrary JavaScript in a victim's browser within the DHIS2 origin by luring an authenticated user to a crafted URL. The endpoint echoes the `scope` query parameter into the generated HTML page without sufficient sanitization (CWE-79), affecting DHIS2 core versions 2.42 and 2.43 prior to the 2026-06-09 security releases and the 2.44 development branch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but successful exploitation can hijack the victim's DHIS2 session and act with their privileges.
Stored cross-site scripting in the Ninja Forms WordPress plugin (versions 3.10.4 through 3.14.9) lets unauthenticated visitors persist script payloads through the Repeatable Fieldset feature that later execute in an administrator's browser when they review form submissions. Because it requires no authentication and fires inside a privileged admin session, a successful hit can lead to admin-account takeover, malicious plugin installation, and full site compromise. No public exploit identified at time of analysis, though the flaw was reported by VulnCheck and a vendor patch is available; the CVSS 4.0 base score is 9.3 (Critical).
Stored cross-site scripting in the Free Theme Builder for Elementor WordPress plugin before 1.6.7 lets unauthenticated attackers inject malicious script through contact form field values, which are stored unsanitized and later rendered in the admin dashboard's form-submissions view. The payload executes in the browser of any logged-in administrator who reviews submissions, enabling session hijacking or actions in the admin's context. Publicly available exploit code exists (WPScan), but there is no evidence of active exploitation and EPSS probability is low (0.17%).
Cross-site scripting in DayuanJiang next-ai-draw-io 0.4.13 lets a remote unauthenticated attacker inject arbitrary script through the mcp parameter, executing in the victim's browser when they open a crafted link. The 'arbitrary code' claim and RCE tag in the source data most plausibly refer to arbitrary JavaScript in the browser (CWE-79 reflected XSS) rather than server-side code execution. EPSS is low (0.29%, 21st percentile), there is no CISA KEV listing, and no public exploit is confirmed, though third-party GitHub writeups referencing this CVE exist.
Stored and reflected cross-site scripting in ThemeXpert's JMedia media-manager extension for Joomla lets an attacker upload a malicious SVG file that, because it is served without an X-Content-Type-Options: nosniff header, is interpreted and executed as active script in the context of the site. There is no public exploit identified at time of analysis and the flaw is not on CISA KEV, but the attack is well-understood and trivially reproducible. The supplied CVSS 4.0 base score of 9.4 appears inflated for a script-injection issue, so treat the raw number with caution.
Stored cross-site scripting in the Quix Page Builder Pro extension for Joomla (by ThemeXpert) lets an authenticated builder-level user persist malicious scripts - including unsanitised SVG payloads - that then execute in the browser of any visitor or administrator who renders the affected page. Because the payload fires against higher-privileged admins, it enables session/account takeover of the Joomla back end. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Stored cross-site scripting in Chamilo LMS 1.11.38 and earlier lets any unauthenticated attacker inject persistent JavaScript through the public user registration form, which then executes in an administrator's browser when they review registrations, enabling full admin account takeover. The flaw carries a CVSS 9.3 rating driven by its scope change and high confidentiality/integrity impact; no public exploit is identified at time of analysis, though the vendor GitHub Security Advisory (GHSA-gcjp-f7jm-rrrg) confirms the issue and a fix. Because the injection point is an anonymous, self-service form, mass or opportunistic abuse is realistic once a payload is planted.
Stored cross-site scripting in HeyForm's form builder (all versions prior to 3.0.0-rc.7) lets a low-privileged team member persist malicious JavaScript that fires in the browser of a team owner who later views the affected form, yielding full account takeover through privilege escalation. The flaw stems from insufficient sanitization of rich-text/HTML block content, allowing event-handler attributes and dangerous URL protocols to survive serialization. No public exploit has been identified at time of analysis, but the underlying commit (cc97d27) and GHSA advisory clearly document the injection vector, and the CVSS 9.0 rating reflects the high blast radius of hijacking an owner session.
Reflected cross-site scripting in the WordPress plugin 'Tag Groups is the Advanced Way to Display Your Taxonomy Terms' before version 2.2.0 allows unauthenticated attackers to run arbitrary JavaScript in the browser of a logged-in Editor (or higher) who clicks a crafted link, because one AJAX parameter is reflected unescaped into an HTML-typed response. Publicly available exploit code exists (published by WPScan), but the flaw is not listed in CISA KEV and carries a low EPSS score (0.17%, 7th percentile), indicating no evidence of widespread active exploitation. Successful exploitation can hijack an editorial session, letting the attacker act with the victim's WordPress capabilities.
Reflected Cross-Site Scripting in the LearnPress WordPress plugin before 4.4.1 lets a remote attacker execute arbitrary JavaScript in the browser of a logged-in instructor or administrator who opens a crafted link, because a search parameter is reflected into an HTML attribute without escaping. Publicly available exploit code exists (published by WPScan), but there is no public exploit identified as being used in active attacks; EPSS is low at 0.15% (5th percentile). A vendor patch is available in version 4.4.1.
Stored cross-site scripting in the SlimStat Analytics WordPress plugin before 5.5.0 lets unauthenticated visitors inject a persistent payload through a geolocation value that fires when an administrator opens the analytics reports, enabling admin-session compromise. The flaw is only reachable when the plugin is configured to use the Cloudflare geolocation provider. Publicly available exploit code exists (reported by WPScan) and a vendor patch is available; no public exploit identified as actively exploited and it is not in CISA KEV.
Stored cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (all versions before 2.0.11) lets an unauthenticated attacker plant a malicious Google review on a targeted business's Google listing that, once fetched via the Serp API and rendered unescaped in the Google Reviews widget, executes JavaScript in the browser of every visitor — including logged-in administrators — of any page showing that Place ID's reviews. Publicly available exploit code exists and the vendor has shipped a fix, but there is no public exploit identified as being used in active attacks. The injection is delivered through third-party review content rather than a direct request to the WordPress site, making it a supply-chain-style stored XSS.
Stored/reflected cross-site scripting in IBM Engineering AI Hub 1.0.0 through 1.2.0 lets a remote unauthenticated attacker inject arbitrary scripts into generated web pages that execute in a victim's authenticated browser session. Because the CVSS scope is marked changed (S:C), successful exploitation can impact resources beyond the vulnerable component - such as the user's session with adjacent applications. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.
Stored cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an authenticated user inject persistent JavaScript through the voicemail notification template feature, which then executes in the browsers of other users who view the affected template. The payload is submitted via the template_text parameter to the submit_modify_voicemail_template endpoint, which fails to sanitize HTML. No public exploit identified at time of analysis, though the flaw was disclosed with a technical writeup by researchers at SRA; it is not listed in CISA KEV.
Reflected cross-site scripting in Sangoma Switchvox SMB Edition 8.3 (build 104997) lets an unauthenticated remote attacker execute arbitrary JavaScript in a victim's browser by luring them to a crafted link. The flaw stems from the application reflecting an unsanitized 'portal' parameter into JavaScript emitted by the invalid_browser and invalid_browser_login handlers. No public exploit is identified at time of analysis, though the reporting researcher (SRA) has published a technical writeup, and no evidence of active exploitation exists.
Stored cross-site scripting in the ChronoForms extension for Joomla lets unauthenticated attackers persist malicious JavaScript that executes in the browser of anyone who later views the affected page. The flaw carries a CVSS 4.0 base score of 8.7 and requires no authentication (PR:N), though a victim must load the poisoned content (UI:P). There is no public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.
Stored cross-site scripting in the Kali Forms - Contact Form & Drag-and-Drop Builder plugin for WordPress (all versions through 2.4.18) lets fully unauthenticated attackers persist arbitrary JavaScript through the form's 'digitalSignature' field value, which is neither sanitized on input nor escaped on output. Because the form-submission nonce is exposed on any page rendering the form shortcode, the normal anti-CSRF barrier provides no protection, and the injected script executes in the browser of any user (including administrators) who later views the affected page. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the low attack complexity and lack of authentication make it a practical scan-and-spray candidate.
Reflected cross-site scripting in Emlog 2.6.13 and earlier lets a remote attacker execute arbitrary JavaScript in an authenticated administrator's backend session by luring the admin to open a crafted link that hits the user-search feature in admin/user.php. The keyword parameter is sanitized with addslashes but never HTML-escaped before it is echoed into a value attribute in admin/views/user.php, so injected markup breaks out of the attribute and runs in the admin's browser. No public exploit identified at time of analysis, and no fixed version currently exists.
Stored cross-site scripting in the Breakdance WordPress page-builder plugin (versions through 2.7.1) lets unauthenticated attackers inject persistent JavaScript through the 'fields' parameter, which then runs in the browser of any user who views the affected page. The flaw carries a CVSS 3.1 score of 7.2, elevated by a scope change (S:C) because the payload executes in visitors' browser sessions rather than the server context. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; Wordfence discovered and reported it.
Reflected Cross-Site Scripting in the FunnelKit WordPress plugin before 3.15.0.6 lets unauthenticated attackers inject arbitrary JavaScript into a page-builder AJAX response, which executes in the browser of a logged-in user who opens an attacker-crafted link. The flaw is only reachable when the Divi builder integration is active, and publicly available exploit code exists though there is no public exploit identified as actively exploited at time of analysis. EPSS was not provided and the vulnerability is not on CISA KEV, so widespread exploitation is unconfirmed.
Stored cross-site scripting in the RPB Chessboard WordPress plugin (all versions through 8.1.2) lets unauthenticated attackers plant persistent JavaScript through comment content that executes in the browser of anyone who later views the affected page. The novel aspect, per Wordfence, is that WordPress's normal save-time kses sanitization is bypassed because the payload uses only kses-allowed tags/attributes (an <a> element with title and href) and the dangerous attribute-breaking markup is assembled entirely at render time by the plugin's own comment_text filter. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the unauthenticated, no-interaction entry point makes it a practical drive-by injection risk.
Stored/reflected XSS in the ViewComponent Rails gem (versions >= 4.0.0, < 4.12.0) arises because HTML-unsafe strings returned from a component's around_render hook bypass the automatic escaping applied to normal #call output, letting attacker-controlled data reach the browser as raw HTML. The flaw is amplified in collection rendering, where Collection#render_in joins per-item output and blindly marks it html_safe, laundering unsafe content into a trusted SafeBuffer. Publicly available exploit code exists (a detailed PoC in the GitHub advisory), but there is no public exploit identified as actively used in the wild; a vendor patch is available in v4.12.0.
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
Stored cross-site scripting in MantisBT (versions <= 2.28.3) lets an authenticated user inject arbitrary HTML/JavaScript through a crafted image-attachment filename that breaks out of an IMG tag's alt attribute. The payload executes when any user (including higher-privileged reviewers) renders the Word/HTML export view at print_all_bug_page_word.php?type_page=html&export=1, though real-world impact is constrained by MantisBT's Content Security Policy. There is no public exploit identified at time of analysis, and the flaw is fixed in 2.28.4.
Reflected cross-site scripting in MantisBT 2.28.3 and earlier lets remote attackers inject HTML into the unauthenticated /admin/install.php installer page through six user-supplied parameters echoed via an unescaped printf format string. Because the application ships a script-src 'self' Content Security Policy that lacks a form-action directive, an attacker cannot run inline JavaScript but can render fake credential-harvesting login forms, perform <meta>-based open redirects, and overlay attacker HTML via CSS injection on the legitimate admin page. There is no public exploit identified at time of analysis, no CISA KEV listing, and no CVSS/EPSS score in the provided data; the issue was reported by watchTowr and fixed in 2.28.4.