Cross-Site Scripting

The Groundhogg - CRM, Newsletters, and Marketing Automation WordPress plugin before 4.5.13 does not validate or escape values submitted to some optional web form fields before storing them and outputting them back in an administrative area, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against high privilege users.

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admin.

The Customer Reviews for WooCommerce WordPress plugin before 5.118.0 does not sanitise and escape the content of customer reviews received via one of its endpoints, which could allow unauthenticated users to perform Stored Cross-Site Scripting attacks.

Stored XSS in Formwork through 2.3.14 allows unauthenticated remote attackers to inject persistent malicious markup into the Statistics panel by crafting HTTP requests with malicious Referer headers. The visit-tracking subsystem records the Referer host value without HTML escaping, storing attacker-controlled content in the statistics data. When an administrator opens the Statistics panel, the injected payload executes in their browser, enabling session hijacking, credential theft, or further compromise of the admin interface. No public exploit code or CISA KEV listing is identified at time of analysis.

Stored XSS in the silverstripe/versioned package allows a CMS user with content-creation rights to execute arbitrary JavaScript in an administrator's browser by embedding a malicious payload in a page title that is rendered without escaping during the ArchiveAdmin restore workflow. All versions prior to 3.2.1 are affected. No active exploitation or standalone public exploit has been identified, though the patch PR includes working test payloads confirming the mechanism.

Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.

Stored cross-site scripting in MongoDB's MongoSQL Transition Readiness Tool allows any authenticated BI Connector query issuer to inject arbitrary HTML markup into operator-generated reports by embedding script payloads in query strings that the BI Connector logs verbatim. When an operator later generates an HTML report from affected logs and opens it in a browser, the injected markup executes, potentially disclosing other users' logged query text and usernames to attacker-controlled infrastructure or presenting spoofed content to the operator. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; the required two-step operator interaction substantially limits opportunistic exploitation.

Stored cross-site scripting in the MongoDB BI Connector Transition Readiness Report tool allows a low-privileged MongoDB user with write access to inject malicious script payloads into database metadata. When a second user generates and opens the resulting HTML report, the embedded scripts execute in their browser context, potentially exposing report contents or manipulating the displayed output. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the stored delivery model increases reachability beyond typical reflected-XSS scenarios.

DOM-based cross-site scripting in Yamcs's /ext URL routing endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL - typically via phishing. The vulnerability exists in extension.component.ts, where URL path segments are inserted into the DOM via innerHTML without validation against legitimate custom element names, allowing injected HTML event handlers to fire. Vendor-released patches are available in yamcs-5.12.8 and yamcs-5.13.2; no public exploit code or CISA KEV listing has been confirmed at time of analysis.

Reflected XSS in Yamcs versions through 5.8.6 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a logged-in user's browser by delivering a specially crafted URL targeting the OAuth authorization endpoint. Exploitation exfiltrates the victim's session and refresh tokens to an attacker-controlled server, enabling complete account takeover. No public exploit identified at time of analysis independent of the advisory, though GHSA-rxpg-wjf8-qv9c includes a working reproduction payload with exact URL and netcat listener steps; vendor patch is available in 5.9.4 (CVSS 6.5, UI:R).

Stored cross-site scripting in E-Commerce Pack versions 4.5.001 through 28082026 (Akilli Ticaret Software Technologies Ltd.) allows an authenticated low-privilege attacker to inject persistent malicious scripts that execute in other users' browsers, with a confirmed scope change affecting victim browser sessions. The CVSS S:C flag indicates impact escapes the vulnerable application boundary, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No vendor patch is available - the vendor did not respond to TR-CERT's coordinated disclosure - and no public exploit or CISA KEV listing has been identified at time of analysis.

Reflected cross-site scripting in Crocoblock's JetEngine WordPress plugin (all versions through 3.8.14.2) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to follow a specially crafted URL. The scope-change component of the CVSS vector indicates that successful exploitation breaks out of the plugin's immediate context to affect the broader browser session, enabling session token theft or administrative action impersonation. No public exploit code or active exploitation has been confirmed at time of analysis; the flaw was disclosed by Patchstack.

Reflected XSS in Ceviz Informatics Inc.'s Web Design platform (versions through 25082026) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script crosses the application-browser trust boundary, enabling session hijacking, credential theft, or malicious redirects. No public exploit identified at time of analysis and no CISA KEV listing; the threat is opportunistic phishing-driven rather than mass exploitation.

Reflected XSS in Dayneks Software Industry and Trade Inc.'s E-Commerce Platform (all versions through 28082026) allows unauthenticated remote attackers to inject and execute malicious scripts in victim browsers by delivering crafted URLs. The vulnerability, rooted in CWE-79 unsanitized input reflection, enables session hijacking, credential theft, or malicious redirection within the e-commerce site's origin context. No vendor patch is available; the vendor did not respond to TR-CERT's coordinated disclosure, leaving operators without an official remediation path.

Stored cross-site scripting in the Customer Reviews for WooCommerce WordPress plugin (versions up to and including 5.106.0) enables unauthenticated attackers to inject persistent malicious scripts into WooCommerce product pages, where they execute in every subsequent visitor's browser. The flaw resides in the 'cr_local_forms_submit' AJAX handler, which stores unsanitized HTML review text via wp_insert_comment() without sanitization and later renders it through comment_text() without output escaping - a textbook inject-store-render CWE-79 chain. No active exploitation has been confirmed in the CISA KEV catalog and no public exploit code has been identified at time of analysis, though the attack requires only a review form URL that the plugin routinely distributes to customers via order-reminder emails, lowering the practical barrier to abuse.

Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.

Stored Cross-Site Scripting in the Envira Gallery WordPress plugin (versions ≤1.12.4) permits authenticated attackers holding Author-level privileges or higher to inject persistent JavaScript payloads through the gallery description configuration field. The injected script executes in the browsers of any site visitor who loads a page rendering an affected gallery with its description enabled, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix has been committed to the WordPress plugin repository trunk per changeset 3514026.

Stored XSS in DP Calendar for Joomla (versions 7.0.0 through 10.11.2) allows authenticated users holding the DPCalendar 'create' permission to inject persistent malicious script by submitting an unsanitized Location title, which is rendered into an HTML data attribute without output encoding. Any Joomla site visitor who subsequently loads a calendar page containing the poisoned entry will execute the attacker-controlled payload in their browser, enabling session hijacking or unauthorized actions on their behalf. No public exploit code and no active exploitation have been identified at time of analysis.

Reflected XSS in the All Video Share Joomla extension (versions 1.0.0 through 4.5.0) exposes site visitors to script injection attacks when they interact with attacker-crafted URLs. Multiple user-supplied input parameters are rendered in HTTP responses without HTML encoding, providing several distinct reflected XSS entry points. No public exploit code or active exploitation has been identified at time of analysis, and no KEV listing exists.

Stored Cross-Site Scripting in GiveWP (WordPress donation plugin by StellarWP, versions through 4.14.4) allows authenticated Contributor-level users to inject persistent JavaScript payloads into donation form pages via the give_form shortcode. The flaw arises because the continue_button_title and display_style shortcode attributes are sanitized with sanitize_text_field() - which strips HTML tags but does not encode special characters - and then written unescaped into HTML data attributes, leaving a standard XSS sink unguarded. No public exploit has been identified and active exploitation has not been confirmed by CISA KEV at time of analysis.

Stored cross-site scripting in All-in-One WP Migration Unlimited Extension (all versions up to and including 2.84) allows any authenticated WordPress user with Subscriber-level access to plant persistent JavaScript payloads via the ai1wm_backups_path parameter, which execute in the administrator's browser context when the plugin settings page is visited. Two compounding weaknesses drive the flaw: absent input sanitization on the parameter and missing authorization checks on the settings() function, permitting low-privileged users to write attacker-controlled data into plugin configuration. A partial fix was shipped in version 2.84 but a fully remediated release has not been confirmed, and no public exploit code has been identified at time of analysis.

Cross-site scripting in Synology Chat Server's extract domain feature allows authenticated remote users to inject malicious scripts that execute upon victim UI interaction, with impact extending beyond the Chat application into the broader DSM (DiskStation Manager) environment. The scope change captured in the CVSS vector (S:C) is the key risk amplifier: successful exploitation can result in reading or writing restricted DSM files and conducting limited denial-of-service against DSM. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.

Stored/reflected cross-site scripting in Synology Chat Server before 2.4.5-22148 lets a remote authenticated user who lures a victim into a UI interaction execute injected script that pivots into the underlying DSM platform to read or write arbitrary files and trigger denial-of-service. The vendor-assigned CVSS 9.0 reflects a scope change (S:C) where compromise of the chat add-on cascades into the host DiskStation Manager operating system. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV.

Cross-site scripting in Tangible Loops & Logic, a WordPress templating plugin by Tangible, allows network-accessible attackers to inject malicious scripts into web pages served to other users. The CVSS vector (PR:N/UI:N) suggests unauthenticated stored XSS where payloads execute without additional victim interaction beyond normal page visits, though this rating is atypical for XSS and warrants verification. No public exploit code and no CISA KEV listing were identified at time of analysis, but the low attack complexity and lack of authentication requirement make this straightforward to exploit once the injection vector is identified.

Stored XSS in the Amelia WordPress booking plugin (versions ≤ 2.2) allows unauthenticated attackers to persist malicious JavaScript that fires when a site administrator views the Calendar page. The attack chain exploits two compounding weaknesses: an explicit nonce-verification skip in AddBookingCommand (Command.php:186) that permits unauthenticated booking submissions, and unsafe interpolation of customer name fields into JavaScript template literals rendered via innerHTML in the FullCalendar eventContent callback (redesign/dist/index.js:199). No public exploit is confirmed at time of analysis, but the Wordfence disclosure provides sufficient technical detail for trivial weaponization.

Stored or reflected cross-site scripting in SOY Gallery, a web-based gallery application by Tsuyoshi Saito, allows an authenticated low-privilege attacker to inject arbitrary script that executes in the browser of any logged-in user who views the affected content. The CVSS scope-change metric (S:C) confirms the impact crosses from the attacker's session into the victim's browser context, enabling session hijacking or credential theft. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Cross-site scripting in SOY Calendar (by Tsuyoshi Saito) enables a remote attacker holding a low-privilege account to inject arbitrary JavaScript that executes within the browser session of other logged-in users. The CVSS scope-change indicator (S:C) confirms the injected script breaks out of the application's own security boundary, elevating the practical risk beyond the medium base score. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored or persistent cross-site scripting in SOY Calendar by Tsuyoshi Saito allows a low-privileged authenticated attacker to inject arbitrary JavaScript that executes in other logged-in users' browsers. The CVSS scope change (S:C) confirms the payload crosses a security boundary, targeting victim sessions rather than the attacker's own context. No public exploit code or CISA KEV listing has been identified at time of analysis; disclosure was coordinated through JPCERT/CC.

Stored Cross-Site Scripting in ElementsKit Pro for WordPress allows unauthenticated attackers to persistently inject arbitrary JavaScript via the Advanced Search REST endpoint, affecting all versions through 4.10.1. The flaw combines an authentication bypass (permission_callback set to __return_true) with inadequate output escaping: sanitize_text_field() permits double-quote characters to pass through, and stored keywords are later rendered into HTML attributes using sprintf() without esc_attr(), enabling attribute injection. Unlike reflected XSS, this stored variant poisons the site globally - every visitor who triggers the 'no results' state on any page using the Advanced Search widget executes the injected payload. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in the Avada (Fusion) Builder WordPress plugin through version 3.15.6 allows authenticated contributors to permanently embed malicious JavaScript in page content via the 'size' shortcode attribute. The root bypass is structural: WordPress's wp_kses_post filter only inspects HTML angle-bracket constructs, so payloads confined entirely to a shortcode attribute string pass the filter unchanged at save time and execute in any visitor's browser. No public exploit code or CISA KEV listing is confirmed at time of analysis, though the Scope:Changed CVSS designation reflects that successful injection escalates attacker influence from the contributor's own context into the browsers of higher-privileged users, including site administrators.

Remote code execution via unrestricted file upload in the One User Avatar WordPress plugin (all versions ≤ 2.5.4) is enabled by a flawed avatar upload handler that accepts DXFP files - bypassing only PHP and SVG blocks - while trusting the attacker-controlled client-supplied Content-Type header instead of a server-derived MIME type, and retaining uploaded files that fail post-write validation. Exploitation requires subscriber-level WordPress credentials and a non-default administrative decision to grant subscribers avatar upload capability. No public exploit has been identified at time of analysis; no EPSS data was provided.

Stored Cross-Site Scripting in LiteSpeed Cache for WordPress (all versions through 7.7) allows authenticated attackers holding Author-level access or higher to inject persistent malicious scripts via specially crafted `<img>` tag attributes. The defect lives in a flawed regular expression inside the plugin's media class that is invoked only when both the 'Lazy Load Images' and 'Add Missing Sizes' features are simultaneously active, causing attribute-embedded payloads to survive sanitization and be stored in page content. Injected scripts execute in the browser of any subsequent visitor, enabling session hijacking, credential theft, or unauthorized actions on their behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored Cross-Site Scripting in the Forminator Forms WordPress plugin (all versions through 1.57.0.1) enables unauthenticated attackers to inject persistent malicious scripts via Rich-Text Textarea fields, which execute in any visitor's or administrator's browser upon page access. The flaw originates from insufficient input sanitization at submission time and missing output escaping at render time, with vulnerable code paths confirmed across multiple plugin files including textarea.php, abstract-class-front-action.php, and admin-page-entries.php. A patched release (1.57.0.2) is confirmed available via the WordPress plugin repository changeset; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored XSS in the LiteSpeed Cache WordPress plugin (all versions through 7.8.1) allows unauthenticated attackers to permanently inject malicious JavaScript into comment-bearing pages by exploiting a bypass in WordPress's wp_kses sanitizer via decimal numeric character references inside permitted HTML elements. The payload persists in the database and executes in every subsequent visitor's browser, creating session-hijacking, credential-theft, and site-defacement opportunities at scale. No active exploitation is confirmed in CISA KEV, but the changeset between tags 7.8.1 and 7.9 on the WordPress plugin repository confirms a vendor-released fix is available.

Cross-site scripting in Mozilla's Pocket (read-it-later service) through version 8.33.0.0 lets attacker-controlled external HTML execute in the application DOM when a user's "Save to Pocket" action ingests a malicious page, and the injected JavaScript can then reach native bridge methods to manipulate application state. Publicly available exploit code exists, and the referenced proof-of-concept describes a zero-click Android chain, so the practical impact reaches well beyond a cosmetic script injection. No CISA KEV listing means there is no public exploit identified as actively exploited, but the combination of a working POC and native-bridge reach makes this high priority.

Cross-site scripting in the wallabag Android application (fr.gaulupeau.apps.InThePoche) through version 2.6.0 allows execution of attacker-controlled JavaScript within the app's WebView. Article content fetched from the /api/entries endpoint is rendered in a WebView without sanitization, meaning malicious markup embedded in saved articles executes in the application's security context. A publicly available proof-of-concept references the specific vulnerable source files in the upstream repository; no CISA KEV listing exists at time of analysis, but the CVSS 4.0 score of 8.8 with scope change indicators reflects elevated real-world risk.

Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows authenticated contributors to inject persistent JavaScript payloads via the Gutenberg 'slider' block attribute, targeting Editors and Administrators who subsequently open affected posts in the WordPress block editor. The flaw originates from insufficient input sanitization in the Gutenberg block integration and missing output escaping in the plugin's shortcode renderer. No public exploit code or CISA KEV listing has been identified; the primary real-world risk is insider-threat or compromised-contributor scenarios leading to privileged account takeover.

Stored Cross-Site Scripting in the Optimole image optimization plugin for WordPress (all versions through 4.2.10) allows unauthenticated network attackers to inject persistent JavaScript payloads via the 'above_fold_images' ('a') REST API parameter. Injected scripts execute in any visitor's browser upon accessing an affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence reported the issue and a patch was confirmed in version 4.2.11.

Stored Cross-Site Scripting in the TranslatePress WordPress plugin (all versions through 3.3.3) allows unauthenticated attackers to permanently inject arbitrary JavaScript into translated pages visible to all site visitors. The attack exploits a bypass of WordPress's native comment sanitization (KSES): a crafted payload using anchor and code tags is permitted by the allowlist, stored verbatim in the database, and later executed when the plugin's bundled simple_html_dom parser processes comments during page translation rendering. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in xipblog v2.0.1 and earlier for PrestaShop allows unauthenticated remote attackers to inject persistent JavaScript payloads through the name and content parameters of ajax.php, which are written to the database without sanitization and rendered unsafely in Smarty templates. When a store administrator subsequently reviews submitted comments in the PrestaShop back office, the payload executes within the admin's authenticated browser session, enabling full store compromise including session hijacking, unauthorized admin actions, and potential exfiltration of customer and payment data. A publicly available proof-of-concept exists per SSVC data and a GitHub Gist reference; exploitation is not currently confirmed in CISA KEV.

WordPress plugin (Spiffy Plugin) before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role (contributor) can exploit this to redirect user to malicious site or control the account.

Cross-site scripting via `javascript:` URI injection in Omeka S 4.2.0 allows an attacker who controls site navigation configuration to plant a malicious custom URL that executes arbitrary JavaScript in any visitor's browser when the navigation link is clicked. The flaw resides in the `Url.php` navigation link handler, which failed to reject URLs using the `javascript:` scheme. A researcher-published writeup exists, but no confirmed active exploitation or CISA KEV listing is present at time of analysis.

WordPress plugin (Bit Assist) before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role (admin) can exploit this to redirect user to malicious site or control the account.

Cross-Site Scripting (XSS) vulnerability in the DNS lookup/management component of oPanel before v1.20.25 allows remote attackers to execute arbitrary JavaScript and perform session hijacking via a crafted DNS TXT record

Stored XSS in WatchGuard Dimension's Trusted CA certificate configuration enables an authenticated administrator to inject persistent JavaScript that executes in the browser of other authenticated administrators. The attack requires high-privilege access to the management console to plant the payload and passive interaction from a victim administrator to trigger it, constraining the threat to insider abuse or compromised admin accounts. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 4.8 reflects the limited, intra-admin scope.

Stored cross-site scripting in WatchGuard Dimension's Backup Historical Data feature permits an authenticated administrator to inject arbitrary JavaScript that executes in the browser context of other users who view the affected data. The CVSS 4.0 vector (PR:H, SC:L/SI:L) confirms the attacker must hold admin credentials and that impact is confined to subsequent systems - other users' browser sessions - with no direct impact on the Dimension host itself. No public exploit code and no CISA KEV listing exist at time of analysis.

Reflected XSS in WatchGuard Dimension's report detail page allows arbitrary JavaScript execution in the browser of an authenticated victim when they follow a specially crafted URL. The vulnerability requires social engineering an already-authenticated Dimension user - likely an administrator, given the CVSS 4.0 PR:H rating - into clicking an attacker-controlled link, constraining the attack to targeted phishing scenarios against active sessions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog. EPSS data was not provided in the source intelligence.

Stored XSS in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject persistent JavaScript into scheduling fields, which silently executes in the browser session of any other user who subsequently views the affected interface. Unlike reflected XSS, the stored nature of this vulnerability means a single injection can compromise multiple sessions without further attacker interaction, including those of higher-privileged administrators. No public exploit code or active exploitation has been identified at the time of analysis.

Clickjacking vulnerability in the Ebyte NE2-D11 industrial IoT device web management interface enables a remote unauthenticated attacker to embed the administrative UI within a crafted external webpage. By luring an authenticated administrator to visit the malicious page, an attacker can trick that administrator into submitting unintended configuration changes or triggering disruptive actions against the device. Reported by CISA ICS-CERT under advisory ICSA-26-237-06; no public exploit identified at time of analysis.

Stored XSS in Frappe's workspace link description feature (versions 15.11.0-16.32.0) allows any user holding the Workspace Manager role to inject arbitrary JavaScript into a public workspace card, which executes in the browser session of any desk user who opens the workspace and hovers over the card description. The attack path reaches higher-privileged users through shared public workspaces, enabling session token theft and impersonation via authenticated API requests as the victim. No released version carries the fix; the upstream correction exists only on the development branch per commit 9f65e5ceca71aae91dcfd9bb3c0904afd386a01a, leaving all 15.x and 16.x deployments exposed.

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium versions up to and including 0.103.0, where the default-on "Safe import" filter sanitizes HTML for text notes but omits the 'book' note type. Because book-note content is rendered through the same HTML path as text notes and injected via jQuery's html() in grid-view preview cards, an attacker-supplied import archive can smuggle an executable payload past sanitization; on the Electron desktop client with Node integration enabled this becomes full RCE. No public exploit identified at time of analysis, though the upstream fix commit ships a proof-style test payload, and it is not listed in CISA KEV.

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where the default-on "Safe import" filter sanitizes HTML only for text notes and skips the mindMap note type entirely. An attacker who gets a victim to import a crafted note archive can embed a dangerouslySetInnerHTML payload in the mind map's unsanitized JSON, which Mind Elixir assigns directly to a node's innerHTML when the map is opened; on the Electron desktop client, Node integration turns that XSS into full RCE. No public exploit has been identified at time of analysis, and it is not listed in CISA KEV; the issue is fixed in version 0.104.0.

Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.

Reflected XSS in Spring Framework's MVC and WebFlux data-binding error rendering exposes users of vulnerable applications to arbitrary HTML and JavaScript injection. All active Spring Framework release trains are affected - versions 5.2.x through 7.0.8 - making the exposure surface extremely broad across enterprise Java deployments. An unauthenticated attacker (per CVSS PR:N) can craft a malicious URL containing injected script payloads that, when a victim clicks it, execute in the victim's browser context via reflected field-error output. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating limited observed exploitation activity at time of analysis.

Stored cross-site scripting escalating to remote code execution affects TriliumNext Trilium through version 0.103.0, where an attacker-supplied import archive can carry a note whose title contains an HTML event-handler payload. The default-on "Safe import" filter strips scripts but never escapes titles, and the GeoMap view interpolates the marker note's title directly into innerHTML, so the payload fires the moment the victim opens the map; on the desktop Electron client, Node integration turns that XSS into full RCE on the victim's host. No public exploit identified at time of analysis, and it is not listed in CISA KEV; the flaw is fixed in version 0.104.0.

Reflected XSS in doggo's Phoenix date field component (versions 0.1.0 through 0.14.7) allows network-accessible, unauthenticated attackers to inject HTML into the rendered page when a form validation failure re-renders a user-supplied date value. The root cause is `Doggo.normalize_value/2` wrapping the raw user input in Phoenix.HTML's `{:safe, ...}` marker - bypassing the framework's built-in escaping - before emitting it verbatim into the `value` attribute of the generated `<input>` element. Payloads are constrained to ten bytes by the original truncation logic, which prevents full inline script injection but still permits attribute-breaking strings (e.g., `" onload=x`) sufficient to attach short event handlers. No public exploit has been identified and the vulnerability is not listed in CISA KEV; a vendor patch is available in doggo 0.14.8.

Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.

Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.

Reflected XSS in Netron desktop application versions ≤9.1.2 executes attacker-controlled JavaScript when a victim opens a crafted neural network model file containing malicious node names, type labels, or value descriptions. Because Netron runs on Electron (a Chromium-based runtime), the injected script operates within a privileged renderer process capable of port-scanning local networks and, with a separately-acquired Chrome n-day, achieving full remote code execution on the host machine. HiddenLayer reported the vulnerability and a vendor fix is available via GitHub commit cd14bad8c91; no public standalone exploit has been confirmed and this CVE does not appear in CISA KEV.

Reflected XSS in Seres Software syWEB through version 27082026 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by inducing them to click a crafted URL. The vulnerability is compounded by the vendor's confirmation that syWEB is end-of-life and unsupported, meaning no patch will ever be released. No public exploit code has been identified at time of analysis, and the product has no CISA KEV listing.

Stored cross-site scripting in Flowintel's MISP timeline renderer allows an authenticated low-privileged attacker to inject arbitrary HTML into case timelines by supplying malicious content in MISP object fields - including UUID, object name, attribute values, types, comments, first/last seen timestamps, and IDS flags. These fields were concatenated directly into HTML strings without escaping; although DOMPurify was present, the upstream commit explicitly acknowledges it blocked script-based XSS vectors but still permitted other HTML elements such as forms to pass through. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Cross-site scripting (Cross Zone Scripting variant) in BilPark Informatics Technologies' DoXBASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser, affecting all versions through 27082026. The CVSS 3.1 score of 6.1 reflects network-based exploitation requiring victim interaction, with a changed scope indicating the injected script executes across browser security zones. No patch is available and the vendor did not respond to TR-CERT's disclosure, leaving organizations with no official remediation path.

Stored cross-site scripting in Flowintel's calendar view (versions >= 3.3.0) allows an authenticated user with case-creation or case-editing privileges to inject arbitrary HTML or JavaScript into case titles, which is then executed in the browser of any user who views the calendar. The root cause is unsanitized assignment of user-controlled strings to titleEl.innerHTML. No public exploit has been identified at time of analysis, but the fix is available as an upstream commit and the vulnerability is straightforward to reproduce by any authenticated user.

Stored cross-site scripting in Flowintel case notes allows an authenticated low-privileged user to inject malicious JavaScript via crafted Mermaid diagram blocks, which executes in the browser of any user who subsequently views the affected note. Affected are Flowintel deployments running version 3.3.0 and later; the CVSS 4.0 score of 5.1 reflects that exploitation requires both an authenticated session with note-edit rights and passive victim interaction. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Reflected cross-site scripting in Siemens Element maps-ng allows a network-accessible attacker with low privileges to execute arbitrary JavaScript in a victim's browser session by crafting a malicious URL containing an unsanitized payload in the si-map component's points property. Affected are all V47 builds prior to V47.12.3, all V48 builds prior to V48.11.3, and all V49 builds prior to V49.16.1. Exploitation requires the victim to load the crafted URL and hover over a map pin to trigger tooltip rendering, at which point the injected script executes with full access to the victim's browser session context. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Softtr E-Commerce Pack (all versions before 5.03.01.49) allows unauthenticated remote attackers to inject malicious script-related HTML tags into rendered web pages, requiring victim interaction to trigger execution. The flaw is rooted in CWE-80 (Improper Neutralization of Script-Related HTML Tags), enabling integrity abuse such as session hijacking, credential phishing, or checkout-flow manipulation within affected storefronts. No public exploit code or active exploitation has been identified at time of analysis.

Unauthenticated XSS in the WP w3all phpBB WordPress plugin (versions 3.0.6 and earlier) allows remote unauthenticated attackers to inject malicious scripts into pages served to victims, with scope change confirmed by the CVSS vector. Any WordPress site running this plugin at or below version 3.0.6 is exposed: no login or elevated privileges are required to craft a malicious payload, though successful exploitation requires victim interaction (UI:R), limiting opportunistic mass compromise. No public exploit code or active exploitation has been identified at time of analysis, but the low complexity and zero-authentication barrier make this straightforward to exploit once a target is identified.

Unauthenticated Cross-Site Scripting in the CozyStay WordPress theme (versions 1.10.0 and earlier) by Loftocean allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims, crossing the security boundary into the victim's browser (S:C per CVSS vector). Exploitation requires social engineering a target into visiting a crafted URL, making phishing a prerequisite step. No public exploit code and no active exploitation via CISA KEV have been identified at time of analysis.

Cross-site scripting in Music Player for WooCommerce plugin version 1.8.9 and earlier allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers when they interact with a crafted link or page. The flaw targets WooCommerce stores running the Codepeople plugin and could enable session hijacking, credential theft, or malicious redirects against store customers or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated cross-site scripting in the CP Media Player WordPress plugin (versions 1.3.0 and earlier, by Codepeople) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into visiting a crafted URL. Because the CVSS vector indicates a scope change (S:C), successful exploitation affects the victim's browser context beyond the plugin itself - enabling session hijacking, credential theft, or redirection to malicious infrastructure. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored Cross-Site Scripting in Fluent Boards Pro (WordPress plugin by WP Manage Ninja) versions up to and including 2.0.11 allows a subscriber-level authenticated attacker to inject persistent malicious scripts into board content. Because the scope changes (S:C in the CVSS vector), the injected payload executes in the browser context of other users - most critically administrators - who subsequently view the compromised content, enabling session hijacking or privilege escalation. No public exploit code or active exploitation has been identified at time of analysis, but the low privilege requirement (subscriber account) broadens the realistic attacker population on multi-user WordPress sites.

Cross-site scripting in the Realtyna Organic IDX WordPress plugin (versions 5.4.1 and below) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers. The plugin, used by real estate agencies for MLS/IDX property listing integration on WordPress sites, fails to properly sanitize or encode attacker-controlled input before reflecting it in HTML output. With scope change (S:C in the CVSS vector), successful exploitation can compromise the victim's session, harvest credentials, or perform unauthorized actions on the site on the victim's behalf. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Client-metadata injection in Spring Security's OAuth2 Authorization Server module (7.0.0 through 7.0.4) lets an attacker holding a valid Initial Access Token register a malicious OAuth2 client whose insufficiently validated metadata can yield Stored XSS, Privilege Escalation, or SSRF. Exploitation requires that the optional Dynamic Client Registration (DCR) endpoint be explicitly enabled, and the concrete impact depends on how the server later renders or consumes the stored metadata. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor-rated CVSS of 9.6 reflects a scope-changing, high-confidentiality/high-integrity outcome.

Stored Cross-Site Scripting in the 12 Step Meeting List WordPress plugin (versions 3.17 through before 3.19.17) allows unauthenticated remote users to inject persistent JavaScript payloads via unsanitized input that is stored in the plugin's activity log and rendered in the WordPress admin area. When a privileged user such as a site administrator views the activity log, the injected script executes in their browser session, enabling potential account takeover, unauthorized admin actions, or credential theft. No public exploit has been identified at time of analysis, and EPSS is very low (0.17%, 7th percentile), though SSVC assesses technical impact as total if exploitation is achieved.

Reflected XSS in Joomla Events Manager versions prior to 5.0.1 allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser via a crafted PDF export URL. The root cause is in `buildCurrentPdfLink`, which blindly copies the raw HTTP request query string into a PDF button URL, and `pdfbutton()` subsequently renders that value in HTML without any output escaping. Exploitation requires social engineering to lure an authenticated or unauthenticated Joomla site visitor into clicking a malicious link; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.

Reflected cross-site scripting (XSS) in Spring Security's built-in OAuth2 Authorization Server consent page allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted authorization request URL. Affected versions include Spring Security 7.1.0 and 7.0.0 through 7.0.6; the consent page reflects user-controlled values (such as client name or scope parameters) directly into the HTML response without encoding. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog, but the changed-scope CVSS vector reflects the elevated risk of token and session theft in OAuth2 flows.

Stored cross-site scripting in CMP WordPress plugin before version 4.1.18 allows Editor-role users - only when an administrator has explicitly delegated CMP admin-bar control access to them - to persist malicious scripts in the coming-soon page settings field. Any visitor who subsequently loads the coming-soon page executes the injected script in their browser. No public exploit code exists, EPSS stands at 0.15% (5th percentile), and SSVC marks exploitation as none, confirming this as a low-probability risk that is inert on standard WordPress installations lacking the non-default Editor delegation.

Stored cross-site scripting in Penpot versions through 2.14.3 allows an authenticated team member to execute arbitrary JavaScript in collaborators' browsers by uploading a custom font whose family name contains HTML markup. The backend accepted arbitrary font-family strings and the frontend injected the resulting @font-face rule into the page via innerHTML without sanitization, enabling style-element breakout via a crafted closing tag. The attack is passive — any teammate who opens a file referencing the poisoned font silently triggers execution, enabling session cookie theft, unauthorized actions as the victim, and access to shared files. No public exploit has been identified at time of analysis; vendor-released patch is available in version 2.15.3.

Stored cross-site scripting in Penpot's comments panel allows any authenticated team member to inject and persistently store arbitrary HTML or JavaScript that executes in collaborators' browsers upon viewing the comments panel. Affected are all Penpot instances running version 2.14.3 and earlier. Because the attack is passive - victims trigger payload execution merely by opening the comments panel as part of normal collaboration - an attacker can silently steal session cookies, hijack accounts, and access victims' files and projects. No public exploit identified at time of analysis; however, the attack mechanism is technically trivial and the fix commit is publicly visible.

Reflected Cross-Site Scripting in LimeSurvey Community Edition 7.0.5+260623 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the browser of an authenticated user by crafting a malicious URL targeting the user activation confirmation endpoint. The `action` query parameter is inserted unsanitized into a hidden HTML input attribute, enabling attribute context breakout and script injection. No public exploit has been identified at time of analysis; the issue was disclosed by Fluid Attacks.

Stored cross-site scripting in LimeSurvey Community Edition 7.0.5 allows an authenticated low-privileged user with survey creation rights to persist malicious JavaScript via the survey quota message field, which executes in the browser of any user who subsequently views that quota. The CVSS 4.0 score of 7.2 reflects high confidentiality and integrity impact on the vulnerable system (VC:H/VI:H), with realistic escalation to administrator-level session compromise if an admin reviews attacker-controlled quota messages. No public exploit code has been identified and this CVE is not listed in CISA KEV at time of analysis.

Stored cross-site scripting in LimeSurvey Community Edition 7.0.5 allows a low-privileged authenticated user to inject persistent malicious scripts through the replacement-fields dialog in the administrative question editor. When a higher-privileged user - such as an administrator - subsequently views or edits the affected question, the payload executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though Fluid Attacks has published a dedicated advisory.

Stored XSS in LimeSurvey Community Edition 7.0.5 allows an authenticated user holding the global settings:read permission to plant a persistent JavaScript payload in the Survey Menu Entries administration page. The malicious value is written to the surveymenu_entries.data field and reflected unsanitized into a single-quoted HTML title attribute, creating a durable attack surface that fires against any higher-privileged administrator who subsequently browses that page. No public exploit or CISA KEV listing has been identified at time of analysis, but the stored nature of the vulnerability means a single write by a low-footprint attacker can target multiple privileged users over time.

HTML injection in OpenSTAManager versions 2.10.1 and earlier allows an authenticated high-privilege user to embed arbitrary HTML - including redirect anchor tags - into the user group name field, which is then rendered unsanitized to all users who view the group assignment interface in modules/utenti/edit.php. The attack enables phishing and open-redirect scenarios targeting other application users without requiring any special server configuration. Publicly available exploit code exists (documented in GHSA-crx4-7mmq-j74j with screenshots); this CVE is not in CISA KEV, and EPSS data was not provided.

Stored cross-site scripting in FiftyOne (all versions before v1.21.0) allows a dataset contributor to execute arbitrary JavaScript in the browser of any user who opens a poisoned dataset and hovers over a field with a malicious description. The payload persists in the dataset schema across exports, publications, and shares, giving it a supply-chain propagation vector common in ML/data-science workflows. When the script fires, it runs in the FiftyOne application origin, where it can leverage the open-source server's unauthenticated media route to read arbitrary local files from the victim's machine and interact with dataset and operator APIs as the authenticated user. No public exploit identified at time of analysis; a vendor-released patch exists in v1.21.0.

DOM-based XSS in SunEditor's Embed plugin (npm/suneditor <= 3.1.3) allows an authenticated user with editor access to execute arbitrary JavaScript in another user's browser by submitting crafted embed HTML containing an iframe followed by an external script element. The Embed plugin's node-processing loop recreates the attacker-controlled script element and appends it to the live DOM rather than discarding it, bypassing sanitization. A working proof-of-concept is publicly documented in GHSA-w93q-cq9w-58p7; no KEV listing is present, but stored-XSS scenarios targeting higher-privilege users (administrators, editors) compound the impact significantly.

Stored Cross-Site Scripting in the Greenshift animation and page builder blocks WordPress plugin (versions up to and including 12.8.9) allows authenticated attackers holding at minimum Contributor-level access to inject persistent malicious JavaScript via the plugin's customapi action handler. The root cause is unsanitized API response content written directly to the DOM through innerHTML in two JavaScript modules within the plugin. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in the Reviews and Rating - Google Reviews WordPress plugin (all versions through 5.10) allows authenticated Contributors to inject arbitrary JavaScript via the wp_display() shortcode handler's unsanitized html_tags parameter. The malicious script persists server-side and executes in the browsers of any users who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. No confirmed active exploitation or public exploit code has been identified at time of analysis; the primary risk driver is the low privilege bar required - Contributor-level access - which is commonly available on multi-author or open-registration WordPress sites.

Stored cross-site scripting in the Betheme theme for WordPress (all versions through 28.4) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts into pages via unsanitized attributes of the 'icon_box_2' shortcode. The injected payload executes in the browser of any user who subsequently loads the affected page, including administrators, enabling session hijacking or privilege escalation. No public exploit code has been identified and the vulnerability carries no CISA KEV listing at time of analysis, but the low access barrier in multi-author WordPress environments elevates practical risk.

Stored Cross-Site Scripting in the Formidable Forms WordPress plugin through version 6.33.1 enables unauthenticated attackers to inject persistent malicious scripts that execute automatically in the WordPress admin interface. The attack exploits the plugin's frm_user_id parameter: by forging it to match an administrator's user ID - obtainable from the public WordPress REST API - the attacker routes input through the permissive wp_kses_post() filter rather than strict sanitization, allowing the payload to survive storage intact. The plugin's own admin JavaScript then decodes and executes the payload automatically on page load, requiring no explicit admin interaction beyond normal panel navigation. No public exploit code or CISA KEV listing was identified at time of analysis.