Cross-Site Scripting

Cross-site scripting in the embedded web management interfaces of Contec Co., Ltd. PC-HELPER Wireless I/O DIO-0404RY-LWF and DIO-0404RY-LWF-US industrial modules allows a low-privilege authenticated attacker to inject malicious script that executes in the browser session of another logged-in user. The CVSS 4.0 score of 4.8 (Medium) reflects mandatory prior authentication (PR:L) and required active victim interaction (UI:A), with impact confined to the subsequent browser context rather than the device itself. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Cross-site scripting in Contec FX5000, FX4000, and FX3000 series industrial data loggers allows a low-privileged authenticated attacker to inject arbitrary scripts that execute in a victim's web browser when viewing attacker-controlled content via the device web interface. The vulnerability was reported by JPCERT/CC and affects a broad range of OT/ICS field devices used in industrial monitoring and automation. No public exploit code or CISA KEV listing is present, and the CVSS 4.0 score of 4.8 reflects the constrained real-world impact.

Cross-site scripting in the embedded web management interface of Contec's CPSL-08P1EN industrial network device allows a remote unauthenticated attacker to inject malicious script that executes within an authenticated operator's browser session. The CVSS 4.0 score of 5.1 (AV:N/PR:N/UI:A) reflects that while no attacker credentials are required, active interaction from a logged-in user is necessary to trigger the payload. No public exploit code or confirmed active exploitation is identified at time of analysis.

Cross-site scripting in CONTEC's CONPROSYS nano Series industrial remote I/O coupler units allows an unauthenticated attacker to execute arbitrary JavaScript in the web browser of a logged-in operator. The affected products are OT/ICS edge devices (CPSN-MCB271, CPSN-EOB471EI, CPSN-PCB271-S1-041) used in industrial automation environments where their web management interfaces are the attack surface. If exploited, an attacker could steal session credentials, perform unauthorized device configuration changes, or pivot to broader OT network access through the operator's authenticated session. No public exploit code has been identified at time of analysis.

Cross-site scripting in Contec's CONPROSYS PAC Series industrial programmable automation controllers allows a remote unauthenticated attacker to inject arbitrary JavaScript that executes in the web browser of a logged-in management interface user. The flaw affects the Integrated Type CPS-PC341 and Configurable Type CPS-PCS341 product lines, with the attacker relying on social engineering to cause an authenticated operator to trigger the payload. No public exploit code or active exploitation has been identified at the time of analysis.

Cross-site scripting in the embedded web management interface of Contec CONPROSYS M2M Gateway and Controller Series devices (CPS-MG341, CPS-MGS341, CPS-MC341, CPS-MCS341) enables unauthenticated network attackers to inject arbitrary JavaScript that executes in the browser of a logged-in operator or administrator. The CVSS 4.0 vector scores 5.1 and confirms impact is entirely browser-side (SC:L/SI:L; VC:N/VI:N/VA:N), meaning the device itself is not directly compromised. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Contec's EC1000 series web interface allows a low-privileged authenticated attacker to inject arbitrary scripts that execute in the browser of another logged-in user. Affected models confirmed by JPCERT/CC include the ECE1000, ECE1020, and ECS1020. No public exploit code has been identified at time of analysis, and exploitation requires both attacker authentication and active victim interaction.

Cross-site scripting in the Contec RP-WAH-SR Series web management interface allows an authenticated low-privilege attacker to inject and execute arbitrary JavaScript in the browser of another logged-in user. The CVSS 4.0 vector (PR:L/UI:A) confirms exploitation requires both an authenticated session to plant the payload and a separate victim user who must actively interact with the affected page. Reported by JPCERT with no public exploit or KEV listing at time of analysis.

Cross-site scripting (XSS) in the Contec SGA1000 web management interface allows an adjacent-network attacker to inject and execute arbitrary JavaScript in the browser of an authenticated user who interacts with malicious content. The vulnerability is classified CWE-79 (Improper Neutralization of Input During Web Page Generation) and was disclosed via JPCERT/CC alongside a vendor security advisory from Contec. No public exploit code has been identified at time of analysis, and EPSS data was not provided in source intelligence.

Reflected cross-site scripting in regularlabs.com's Articles Anywhere (versions before 20.0.0) and Users Anywhere (versions before 2.1.0) extensions for Joomla allows unauthenticated remote attackers to inject executable JavaScript into victims' browsers. The extensions expose a data-tag templating system that pulls values from visitor-controlled request parameters and renders them in output without context-sensitive encoding - Joomla's built-in string input filter does not distinguish between safe-for-HTML-text, safe-for-attribute, and safe-for-URL contexts, so a malicious request value can materialize as an event handler attribute or a javascript: URL wherever a site author has placed a data tag. No public exploit identified at time of analysis.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `subject` parameter of `/subject1.php`. A public proof-of-concept exploit has been disclosed via a GitHub issue. No active exploitation (CISA KEV) is recorded, and the CVSS 4.0 base score of 2.1 reflects the passive user interaction requirement and limited integrity-only impact on the vulnerable system.

Stored Cross-Site Scripting in the web backend of Repetico 1.9.7.31 for Android allows an authenticated remote user to inject and execute arbitrary JavaScript in other users' app contexts by embedding a malicious payload in a multiple-choice question text field. The CVSS Scope:Changed metric confirms the injected script can affect victim users beyond the attacker's own session, enabling session hijacking, credential theft, or unauthorized in-app actions. A researcher-published PoC writeup on GitHub confirms the attack path. No vendor patch or advisory has been identified at this time.

Cross-site scripting in the Anchor Tag Handler of Totolink A3002MU firmware version Hh-B20211125.1046 allows network-accessible attackers with low-privilege credentials to inject malicious scripts into the router's web management interface, which execute in a victim's browser upon interaction. A public proof-of-concept exploit has been published on GitHub, lowering the technical barrier for exploitation. No vendor-released patch has been identified in the available intelligence, and the firmware timestamp (November 2021) suggests this is a long-unsupported build unlikely to receive a security update.

Stored cross-site scripting in Open-Generative-AI's studio history components (ImageStudio.js, CinemaStudio.js, LipSyncStudio.js, VideoStudio.js) allows an authenticated low-privileged user to inject arbitrary HTML and JavaScript into the history panel by crafting a malicious generation prompt or URL, which then executes in any victim's browser session when the history panel is viewed. Versions up to 1.0.11 and 2.0.0 are affected per CPE and VulDB reporting. No public exploit has been identified at time of analysis, and no KEV listing exists, but the technique is trivially reproducible given the unguarded innerHTML interpolation pattern visible in the patch diff.

Reflected XSS in Kagi Smallweb's query string rendering allows injection of JavaScript into HTML form action attributes across three server-rendered templates. Jinja2's |safe filter was applied to the raw Werkzeug request.query_string value in flag_panel.html, mobile_more.html, and reactions.html, bypassing auto-escaping when unencoded double-quote characters appear in the query string. Exploitation is technically feasible but practically constrained: standard browsers percent-encode double-quotes as %22, so delivery requires raw HTTP clients such as curl or netcat rather than crafted URLs sent to victims. No public exploit or active exploitation (CISA KEV) has been identified; the fix is patch commit 00b68144.

Reflected or stored cross-site scripting in the Order Printing component of Exrick xmall allows remote attackers to inject malicious scripts into victim browsers via the order-print.jsp template. The affected file is xmall-manager-web/src/main/webapp/WEB-INF/jsp/order-print.jsp, which fails to sanitize user-controlled input before rendering it in HTML context. Successful exploitation requires victim interaction (e.g., a privileged user viewing or printing a crafted order), making this a realistic attack against administrative personnel in e-commerce deployments using this platform.

Stored cross-site scripting in linlinjava litemall versions 1.4.0 through 1.8.0 allows a high-privileged attacker to inject malicious scripts via the `detail` argument processed by `AdminGoodsService.validate` in the Product Detail admin component. Exploitation requires admin-level credentials to write the payload and passive interaction from a second user viewing the poisoned product detail page. No public exploit has been identified at time of analysis, and the project maintainer has not responded to the responsible disclosure issue filed on Gitee.

Stored cross-site scripting in linlinjava litemall's admin topic management panel allows a high-privileged attacker to inject malicious scripts via the AdminTopicController.validate function, which are then executed in the browsers of other users who view the affected topic page. Versions 1.5.0 through 1.8.0 are affected. No vendor patch is available; the project has not responded to the responsible disclosure filed in Gitee issue IK5SUU. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in shiyi-blog's search component allows an authenticated attacker to inject malicious scripts via crafted post titles or summaries, which execute in the browsers of other users who trigger search results containing the poisoned content. The `highlightKeyword` function in `blog-web/src/components/Search/index.vue` renders the title and summary fields without sanitization, making DOM injection trivial for any low-privilege content creator. No public exploit code has been identified at time of analysis; the vendor was notified via responsible disclosure through a Gitee issue report.

Stored cross-site scripting in Mogu Blog v2 through version 5.2 allows authenticated low-privileged users to inject arbitrary JavaScript via the `sortName` parameter of the `BlogSortServiceImpl.addBlogSort` function, rendered unsanitized through the FreeMarker template `info.ftl`. Any user who subsequently views the affected blog sort page becomes a victim of the injected script. No patch exists at the time of analysis; the project was notified via a Gitee issue but has not responded.

Cross-site scripting in shiyi-blog 1.0.0-1.2.1 allows authenticated remote attackers to inject arbitrary JavaScript through the `chat_msg` argument of the chat sendMsg endpoint, with execution triggered when another user loads the chat history via `SysChatMsgMapper.getChatMsgList`. The vulnerability resides in the Vue.js frontend component `blog-web/src/views/chat/index.vue` due to improper output encoding of user-supplied chat content. No vendor patch is available; the project has not responded to the responsible disclosure filed on Gitee.

Stored cross-site scripting in the comment rendering layer of bbs-springboot 3.0.0 allows an authenticated low-privileged user to inject arbitrary HTML and JavaScript that executes in the browsers of other users who view the affected comment sections. The root cause, confirmed by the patch diff, is the Vue.js frontend's use of the `v-html` directive in `ChildComment.vue` and `LatestComment.vue`, which renders comment content as raw HTML rather than escaped text. No public exploit code has been identified and the vulnerability is not listed in CISA KEV.

Stored cross-site scripting in DataEase up to version 2.10.26 allows an authenticated attacker to inject arbitrary JavaScript through the `tooltip.backgroundColor` parameter of the Symbolic Map chart component, executing in the browser of any user who views the affected visualization. The injection point is the `buildTooltip` function in `symbolic-map.ts`, where user-controlled chart styling attributes are rendered without sanitization. No patch has been released; the vendor had not responded to the responsible disclosure issue at time of reporting, and no public exploit code has been identified.

Cross-site scripting in TDuckApp tduck-platform affects the Form Write View component (tduck-front/src/views/form/write/index.vue) through the unsanitized submitShowCustomPageContent parameter in all versions up to and including 5.3. An authenticated remote attacker can inject malicious script content into form submission custom page configurations, which then executes in victims' browsers when they load the affected form view. No vendor patch has been released; the project maintainers were notified via Gitee issue IK5RJD but have not responded.

Stored cross-site scripting in quequnlong shiyi-blog up to version 1.2.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the body.content parameter of the Add Message API, which executes in the browser of any administrator who later views submitted messages in the blog-admin panel. The affected file blog-admin/src/views/message/message/index.vue fails to sanitize message body content before rendering it, meaning a crafted submission persists until an admin reviews it. No vendor patch exists - the maintainer has not responded to the Gitee issue report (IK5RF6), and no public exploit has been identified at time of analysis.

Stored cross-site scripting in stilleshan ServerStatus 1.0 and 2.0 allows a remote authenticated attacker to inject malicious JavaScript via the `custom` argument processed in the Stats Generation component (server/src/main.cpp). When an administrator or other user subsequently views the affected stats page, the stored payload executes in their browser session, enabling session hijacking or credential theft. A public proof-of-concept exploit exists as a documented PDF on GitHub; the vendor did not respond to coordinated disclosure.

Cross-site scripting in Fengoffice Feng Office up to version 3.11.13.11 allows an authenticated low-privilege user to inject malicious JavaScript via the og_objects.name argument processed by the getTitle() function in the Task Title Output component. When a victim user subsequently views the affected task, the unsanitized payload executes in their browser. No vendor patch exists - the vendor did not respond to coordinated disclosure - and a public proof-of-concept exploit is available.

Stored cross-site scripting in Xuxueli xxl-job up to version 3.5.0 permits an authenticated low-privileged user to inject malicious script content via the name or author parameters of the /jobinfo/insert endpoint, which is later rendered unsanitized to other users who view the job listing interface. The CVSS 4.0 score of 2.0 reflects the constrained real-world impact: exploitation requires a valid account and passive victim interaction, with impact limited to low integrity effect and no confidentiality or availability consequence. A public proof-of-concept is available, but no vendor patch exists as the vendor did not respond to coordinated disclosure.

Stored JavaScript injection through the Home Page editor in Grav 1.7.50.2 permits an authenticated administrator to embed script content that executes in a victim's browser when the page is viewed. However, NVD's own description includes a formal dispute: Grav's administrator role already grants unfettered access to modify templates, install plugins, and upload arbitrary executable content, meaning this JavaScript injection path adds no incremental attack capability beyond what the role inherently permits. NVD assigned a base score of 1.8 (AV:L/AC:H/PR:H/UI:R), and no active exploitation or public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in the Amelia Booking WordPress plugin (≤2.4.9) enables authenticated Contributor-level users with Elementor access to inject persistent JavaScript into booking-related pages via the unsanitized `load_manually` parameter across multiple Elementor widget render() methods. The injected payload executes in every subsequent visitor's browser session, producing cross-user, scope-changed impact. No public exploit has been identified at time of analysis, but the partial-then-full patch history across two separate changesets indicates the vendor required multiple iterations to close all affected widgets.

Stored Cross-Site Scripting in the WP Highlight Box WordPress plugin (through version 1.0) allows authenticated users with the contributor role or higher to inject persistent malicious scripts via unescaped shortcode attributes. When a page containing the crafted shortcode is viewed by higher-privileged users such as editors or administrators, the injected script executes in their browser context, enabling session hijacking, privilege escalation, or unauthorized administrative actions. No vendor-released patch has been identified at time of analysis, leaving all known deployments exposed.

Stored cross-site scripting in the Custom Menu Wizard Widget WordPress plugin (≤3.3.1) allows authenticated users holding contributor-level access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes. The payload persists in post content and executes in the browser of any visitor - including administrators - who subsequently views the compromised page, enabling session hijacking or unauthorized privilege escalation within the WordPress site. No public exploit code or CISA KEV listing is associated with this CVE, and EPSS is negligible at 0.15% (5th percentile).

Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (versions before 3.4.1) allows authenticated users with the instructor role to inject persistent malicious scripts into course editor fields, targeting higher-privileged users such as site administrators. When an admin opens the affected course in the editor, the stored payload executes in their browser context, enabling session hijacking and full administrative account takeover. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and EPSS remains low at 0.15%, suggesting opportunistic exploitation is not yet prevalent.

Reflected XSS in QloApps back-office (through version 1.7.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an administrator's browser session by inducing an authenticated admin to submit a specially crafted POST request to back-office list controller endpoints. The root cause, confirmed by the GitHub patch diff, is the Smarty template `list_header.tpl` interpolating `$smarty.post` filter parameters directly into HTML input `value` attributes without the `|escape:'html':'UTF-8'` modifier - affecting at minimum five distinct interpolation points across date-range and text-filter inputs. Successful exploitation enables session-scoped impact including administrative credential harvesting and unauthorized back-office actions; no public exploit code or active exploitation has been identified at time of analysis.

Reflected cross-site scripting and open redirect in an ICS inventory management web interface allows unauthenticated network attackers to craft malicious URLs that, when clicked by a legitimate user, execute arbitrary JavaScript within the application's browser context. The vulnerable endpoint reflects a URL segment into both a JavaScript execution sink and an anchor href attribute without output encoding, enabling both script injection and browser hijacking from a single crafted request. Successful exploitation yields session-level access to the application on behalf of the victim, as disclosed in ICS-CERT advisory ICSA-26-254-01.

Stored DOM-based XSS in Dobase prior to 2026.06.03 allows any authenticated workspace member to persist an executable JavaScript payload in the public, unauthenticated shared-folder image gallery by crafting a malicious file name. The public-gallery Stimulus controller reads the filename from a data-name HTML attribute via el.dataset.name (which HTML-decodes it) and injects the raw value into innerHTML without sanitization, converting a server-side ERB-escaped attribute back into an executable sink. Critically, the application's Content-Security-Policy is deployed in report-only mode rather than enforcement, so inline onerror handlers execute freely against any unauthenticated visitor who opens the public share link. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in Concrete CMS versions below 9.5.3 allows an authenticated user with edit_page_contents permissions to inject malicious script payloads via the Date Format field in the Page Attribute Display block. Any site visitor who subsequently loads a page containing the poisoned block will execute the attacker's script in their browser, enabling session-token theft or malicious redirects. A vendor-released patch is available (9.5.3), no public exploit has been identified, and no CISA KEV listing exists at time of analysis.

Reflected cross-site scripting in the p.rfihub.com tracking component of the Zeta Marketing Platform (ZMP) v1.0 allows an attacker to inject a crafted URL into the 'ca' parameter and execute arbitrary JavaScript in a victim's browser when the link is opened. The flaw requires victim interaction (UI:R) but no authentication (PR:N), and because the script runs in the origin of a Zeta-controlled marketing domain, it can be used for session/token theft, credential phishing, or defacement of the trusted brand context. No CISA KEV listing is present and EPSS is only 0.15% (5th percentile), so the near-term mass-exploitation risk is low, but a public researcher disclosure with technical detail exists for this issue.

Stored cross-site scripting in Concrete CMS below 9.5.3 allows an authenticated user holding file-property edit permissions to inject persistent script payloads via the Document Library block's description and tags fields, executing against any visitor - including unauthenticated users - who loads a page rendering those columns. The block controller returned description and tags values without the h() output-escaping helper already applied to the title column, and the view template wrote these raw values directly into the HTML results table. Successful exploitation can result in session token theft or unauthorized browser-side actions against visitors. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting (CWE-79) in Microsoft Edge (Chromium-based) allows unauthenticated remote attackers to perform content spoofing by injecting malicious scripts that execute in a victim's browser after user interaction. The scope-changed vector (S:C) indicates injected scripts can affect resources beyond the immediate page context, enabling session manipulation or UI redirection. Microsoft has released an official patch via MSRC; temporal metrics (E:U) confirm no public exploit code has been observed at time of analysis.

Stored XSS in Concrete CMS 9.0.0-9.5.2 allows a user with board-editing permissions to inject arbitrary JavaScript into the description field of a summary object via the Board Custom Slot's `save_template` endpoint, which accepts the raw client-supplied `selectedTemplateOption[collection]` parameter without server-side validation or sanitization. The default summary template renders the description field without output encoding, so the stored payload fires in the browser of every subsequent visitor to the affected board slot - including unauthenticated front-end users and dashboard administrators. Successful exploitation enables session hijacking or forced CSRF actions, potentially escalating to full administrative compromise. No public exploit has been identified and the vulnerability is not listed in CISA KEV.

Stored Cross-Site Scripting in Visual Composer Website Builder WordPress plugin (versions up to and including 45.16.1) allows an authenticated Contributor-role user to inject malicious scripts into page builder content. When a higher-privileged user such as an Editor or Administrator subsequently views or reviews that content, the injected script executes in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in the Simple Payment WordPress plugin (≤2.5.4) allows authenticated contributors to inject malicious scripts into content that executes in the browsers of higher-privileged users - including administrators - who view the affected content. The vulnerability stems from insufficient output encoding (CWE-79) and carries a scope-changed CVSS vector (S:C), indicating the injected payload escapes the contributor context to affect admin sessions. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in Bold Page Builder (WordPress plugin by BoldThemes) versions up to and including 5.9.9 allows authenticated attackers holding the Contributor role to inject persistent malicious scripts into page content. When an administrator or higher-privileged user views the affected content, the injected script executes in their browser session, potentially enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation has been identified at time of analysis, but the low barrier to exploitation (any registered Contributor account suffices) makes this a meaningful risk for multi-author WordPress sites.

Stored cross-site scripting in Concrete CMS's RSS Displayer block (versions below 9.5.3) allows an external attacker who controls a syndicated feed to inject arbitrary JavaScript into any page that renders that feed, executing in the site origin for all visitors including authenticated administrators. The attack requires no account on the vulnerable site; the malicious payload persists across all page loads until the feed content changes or the block is removed. Concrete CMS assigned a CVSS 4.0 score of 6.0 reflecting high attack complexity, and no public exploit has been identified at time of analysis.

Reflected cross-site scripting in IdeaSoft Smart E-Commerce through version 11092026 allows remote unauthenticated attackers to inject malicious JavaScript into HTTP responses delivered to victim browsers. Exploitation requires social engineering a user into clicking a crafted URL, after which the injected script executes in the context of the e-commerce application's origin, enabling session hijacking, credential theft, or unauthorized actions. Vendor-released patch is not available - IdeaSoft did not respond to TR-CERT's coordinated disclosure attempt, leaving all deployments on the affected version without an official fix.

Stored cross-site scripting in Chamilo LMS allows unauthenticated remote attackers to inject persistent malicious scripts into survey reporting views by exploiting deterministic invitation codes to bypass the survey submission authorization check. Affected versions are Chamilo LMS before 1.11.42 (1.x branch) and before 3.0.0 (3.x branch). When a teacher or administrator subsequently views the survey reporting interface, the stored payload executes in their browser session, enabling session hijacking and - per the description - automated creation of backdoor administrative accounts. No public exploit identified at time of analysis, but VulnCheck has published a dedicated advisory.

Reflected XSS in WWBN AVideo's Gallery plugin allows unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers by supplying a malicious payload in the `getBackURL` GET parameter targeting `plugin/Gallery/view/Category.php`. The injected value is echoed directly into an href attribute without HTML encoding, enabling `javascript:` URI injection that fires when a visitor interacts with the Back navigation control while the SubCategorys feature is active. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 base score of 5.3 appropriately reflects the mandatory user-interaction step that constrains mass exploitation.

Reflected XSS in WWBN AVideo's confirmLivePassword.php allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The vulnerability arises because the PHP script copies REQUEST_URI verbatim into an HTML form action attribute - a quote character in the URL path breaks attribute context and enables injection of arbitrary event handlers executing within the site's origin. No public exploit code or active exploitation has been identified at time of analysis, but the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms low-complexity unauthenticated exploitation gated only on passive victim interaction.

Reflected XSS in WWBN AVideo's Live plugin (plugin/Live/confirmLivePassword.php) allows remote unauthenticated attackers to execute arbitrary JavaScript in the browser of any user - including administrators - who follows a crafted link. The GET parameter `u` bypasses the application's `$securityFilter` and is interpolated without encoding directly into an HTML `<img src="...">` attribute, enabling attribute breakout and injected event-handler execution. No patched version was available at time of disclosure; no public exploit code or active exploitation (CISA KEV) has been identified.

Reflected XSS in WWBN AVideo's showAlertMessage() function allows unauthenticated attackers to inject arbitrary JavaScript into the site's execution context by abusing how the raw HTTP Referer header is embedded inside a JavaScript block comment without output encoding. Exploitation requires luring a victim to navigate to AVideo from an attacker-controlled page so the browser automatically includes the crafted Referer header. The injected script executes under the AVideo site origin, enabling session theft, credential harvesting, or UI redressing against authenticated users.

Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to inject persistent malicious scripts via the unsanitized `mla_link_attributes` shortcode parameter. Any user who subsequently loads the injected page executes the attacker-controlled script in their browser context, enabling session hijacking, credential theft, or privilege escalation to administrator. A patch was committed in changeset 3512155 and no public exploit has been identified at time of analysis.

Stored Cross-Site Scripting in Media Library Assistant (WordPress plugin, ≤3.35) allows authenticated attackers with Author-level access to poison bulk edit preset configurations and execute arbitrary JavaScript in the context of an administrator's browser session. The flaw bypasses the `wp_kses()` tag-filtering safeguard because the payload operates at the HTML attribute level - injecting closing quotes and inline event handlers - exploiting the absence of `esc_attr()` escaping when preset field values are rendered into `<input value="...">` attributes via simple string replacement in `mla_generate_bulk_edit_form_fieldsets()` and the `mla-bulk-edit-fieldsets.tpl` template. No public exploit code and no CISA KEV listing are present in the available data; exploitation requires social engineering an administrator into importing a crafted preset file.

Stored Cross-Site Scripting in the Media Library Assistant WordPress plugin (versions ≤3.35) allows authenticated contributors to plant persistent JavaScript payloads that execute in any visitor's browser. The injection point is the mla_link_href parameter of the [mla_gallery] shortcode when mla_output is set to 'paginate_links': the _paginate_links() function processes the value through mla_process_shortcode_parameter() and _replace_query_parameter() but writes the result directly into href attributes without invoking WordPress's esc_url() sanitizer, leaving the output unsanitized. No public exploit has been identified at time of analysis, and a fix has been committed to the plugin's SVN trunk (changeset 3512155), though the exact released patch version is not independently confirmed from the available references.

Stored XSS in the Featured Image with URL WordPress plugin before 1.0.6 allows any authenticated user holding at least a Contributor role to inject malicious JavaScript via an unsanitized image attribute value, which then executes in the browser of every subsequent viewer - including Editors and Administrators. A publicly available proof-of-concept is documented by WPScan. Vendor-released patch version 1.0.6 is available, and no active exploitation has been confirmed in the CISA KEV catalog.

Stored XSS in the AI Builder WordPress plugin (versions 2.4.1 through <2.7.8) allows any authenticated contributor-level user to inject persistent JavaScript via an unsanitized custom JS field, which executes in the browser of every subsequent viewer - including editors and administrators who review the post. This creates a reliable privilege-escalation path from contributor to full WordPress site administrator via session token theft or forced admin-action execution. Publicly available exploit code exists per WPScan, and a vendor-released patch is available in version 2.7.8.

Stored cross-site scripting in the Advanced Customized Prompts WordPress plugin (≤1.0.1) allows any authenticated subscriber-level user to inject persistent JavaScript into product popup configurations, which then executes in the browsers of all visitors viewing the affected product. The plugin performs no capability check, ownership verification, or nonce validation before persisting popup data, and fails to escape stored values on output - a dual failure enabling both unauthorized write and reflected-on-read XSS. A publicly available proof-of-concept exists via WPScan; no vendor-released patch has been identified at time of analysis.

Stored cross-site scripting in the Translate WordPress with GTranslate plugin before 3.0.10 allows authenticated administrators to inject persistent JavaScript into front-end markup rendered to all site visitors. The plugin's bundled front-end scripts consume an unvalidated settings value and construct DOM markup from it without escaping, meaning a malicious or compromised admin can embed scripts that execute in every visitor's browser session. No public exploit has been reported as actively exploited in the wild; however, a proof-of-concept is publicly available via WPScan.

Stored cross-site scripting in the CoolClock WordPress plugin before 4.3.8 allows contributor-level and higher authenticated users to inject arbitrary JavaScript via an unsanitized skin configuration value, which is rendered unescaped within an HTML attribute and executes in any visitor's browser upon page load. A publicly available proof-of-concept exploit has been published by WPScan. The vulnerability enables session hijacking, credential theft, or unauthorized actions within the WordPress admin panel when an administrator views affected content.

Stored cross-site scripting in the CoolClock WordPress plugin (before 4.3.8) allows contributor-level users to inject arbitrary JavaScript through an unsanitized custom skin setting that is echoed verbatim into an inline script block. When a higher-privileged user such as an administrator views the affected post or page, the payload executes in their browser, enabling session hijacking or full site takeover. A publicly available proof-of-concept exploit has been published by WPScan, and a vendor-released patch is available in version 4.3.8.

Reflected Cross-Site Scripting in the Themify WooCommerce Product Filter WordPress plugin (versions ≤1.5.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by tricking them into clicking a crafted URL containing a malicious query parameter name. The vulnerability stems from insufficient sanitization and escaping in class-wpf-utils.php and class-wpf-public.php, as confirmed by Wordfence source references. An upstream fix has been committed to the WordPress plugin SVN trunk, though an exact released patched version is not confirmed from available data. No public exploit code or CISA KEV listing has been identified.

Stored XSS in the Bold Timeline Lite WordPress plugin (versions ≤1.2.8) allows authenticated Contributor-level users to inject arbitrary JavaScript via the `supertitle` and `subtitle` attributes of the `bold_timeline_item` shortcode, executing in the browsers of any visitor loading the injected page. The root cause is unsanitized attribute input and unescaped HTML output in bold_timeline_item_view.php (lines 202 and 204), confirmed by WordPress plugin trac source references. A fix has been committed to the plugin trunk per the referenced changeset, though no public exploit or active exploitation has been identified at time of analysis.

Reflected cross-site scripting in HUSKY - Products Filter Professional for WooCommerce (WordPress plugin, versions ≤1.4.3) allows unauthenticated attackers to inject arbitrary JavaScript into page responses by embedding malicious payloads inside SEO-friendly permalink URL filter path segments. The root cause is in wp_load_js(), which calls parse_url_query() to extract filter values from the URL path and serializes them with PHP's json_encode() into an inline script block without escaping single quotes, enabling string-context escape and script injection. Exploitation requires social engineering - the victim must click a crafted link - but a successful attack against a store administrator can lead to session hijacking or full WooCommerce backend compromise. No public exploit identified at time of analysis.

Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.

Reflected XSS in WP-Members Membership Plugin for WordPress (all versions through 3.5.6) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability exists in the registration form's URL query string handling within class-wp-members-forms.php (lines 2202-2203), where unsanitized input is echoed into page output without proper escaping. Exploitation depends on a two-step social engineering chain - the victim must visit an attacker-crafted URL and then click the Terms of Service link on the rendered registration page - with no public exploit identified at time of analysis.

Reflected XSS in the Chaty (Floating Chat Widget) WordPress plugin by Premio affects all versions through 3.5.9, allowing unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted search URL. The root cause is a subtle DOM-level bypass: WordPress server-side HTML-encodes the 's' search parameter into the page title, but the plugin's frontend JavaScript reads that title via jQuery's `.text()` method, which invokes the browser DOM API and silently decodes the HTML entities back to raw characters before embedding the value unescaped into an HTML attribute. Wordfence has confirmed the vulnerability and a corrective code change is visible in the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.

Reflected cross-site scripting in the Unlimited Elements For Elementor WordPress plugin (versions ≤2.0.16) allows unauthenticated remote attackers to inject arbitrary JavaScript into pages viewed by victims who follow a crafted link. The vulnerable `show_preview` AJAX action is registered without authentication, and while it is gated by a WordPress nonce, that nonce is trivially retrievable by loading any publicly accessible page on the target site, rendering the protection ineffective. No public exploit has been identified at time of analysis, though the low complexity of exploitation makes this straightforward to weaponize in phishing or drive-by attack chains.

Stored cross-site scripting in Flextype CMS 0.9.9 through 1.0.0-alpha.3 allows an attacker with write access to the server-side plugins directory to inject arbitrary scripts into administrators' browsers. The vulnerable sink is the dependency error page rendered by getValidPluginsDependencies() in Plugins.php, which reflects plugin directory names without HTML-encoding. Exploitation requires the attacker to first plant a malicious plugin directory name and then wait for an authenticated user to trigger a dependency validation failure; no public exploit or active exploitation has been identified at time of analysis.

Cross-site scripting in Angular's compiler and runtime (@angular/core, @angular/compiler) prior to versions 20.3.28, 21.2.20, and 22.1.0 allows unauthenticated remote attackers (with user interaction) to execute arbitrary JavaScript by bypassing built-in sanitization for security-sensitive host bindings. The compiler incorrectly derived SecurityContext from the declaring directive's CSS selector rather than the actual concrete host element, causing it to emit the wrong sanitizer-or no sanitizer at all-for attributes such as href, src, action, xlink:href, and data. Vendor-released patches exist for all three active release lines; no public exploit or KEV listing has been identified at time of analysis.

Stored XSS in AnythingLLM 1.16.1 and earlier enables a manager-role user to inject arbitrary JavaScript into the application homepage by writing a malicious meta_page_title or meta_page_favicon value via /api/admin/system-preferences - MetaGenerator renders those values into page HTML without any HTML entity encoding. When an administrator visits the homepage, the injected script executes in their browser session and can exfiltrate the administrator JWT token. With the stolen JWT, the attacker escalates fully to administrator level, gaining the ability to create API keys, read or alter all workspace and chat data, delete users, and execute any other administrative operation. No fixed release version is available; only an upstream commit patch exists.

Stored Cross-Site Scripting in the EventON WordPress plugin (versions ≤ 2.5.7) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of other users, including administrators. The vulnerability stems from insufficient input sanitization and output encoding in subscriber-accessible event fields, enabling privilege escalation via script execution in a privileged session. No public exploit code or active exploitation has been confirmed at time of analysis.

Stored Cross-Site Scripting in the WP Docs WordPress plugin (versions ≤2.3.1) allows authenticated subscribers to inject malicious scripts that execute in the browsers of other users, including administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a subscriber-initiated, stored XSS with scope change, meaning a low-privilege account can affect higher-privilege sessions. No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in LIBRID/LIBREF (versions 2.01.0.2183 through 10092026) by Ankaref Innovation and Technology Inc. allows low-privileged authenticated users to inject persistent malicious scripts that execute in victims' browsers when affected pages are viewed. The vulnerability carries a scope change, enabling a limited user account to compromise sessions of higher-privileged users such as administrators. The vendor did not respond to TR-CERT's disclosure, and no patch has been issued; no public exploit or active exploitation has been identified at time of analysis.

HTML injection in MISP versions ≤2.5.45 allows any authenticated user with write access to embed arbitrary HTML markup in attribute types/values, object names/relations, or tag colour and name fields, which renders as live HTML when a report referencing those elements is exported to PDF via the convert_markdown_to_pdf module. The same component shipped a hardcoded sample-value defect - literal strings 'domain-ip' and 'google.com' used as format arguments rather than placeholders - meaning every plain attribute reference in a PDF displayed sample text instead of the real indicator, constituting a separate data-integrity failure. CIRCL, the MISP maintainer, patched both issues in commit 949744a4b (released as v2.5.46) by wrapping all user-controlled interpolations with CakePHP's h() HTML-encoding function. No public exploit has been identified and the CVE is not listed in CISA KEV.

Stored cross-site scripting in LIBRID/LIBREF (Ankaref Innovation and Technology Inc.) allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users visiting affected pages. The vulnerability spans all versions from 2.01.0.2183 through build 10092026 and was disclosed by TR-CERT (advisory TR-26-1064). No vendor patch is available - the vendor did not respond to coordinated disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. No public exploit code and no active exploitation have been identified at time of analysis.

Stored XSS in Redux Framework (WordPress plugin) through version 4.5.13.1 allows authenticated Subscriber-level users to inject arbitrary JavaScript into their user profile Slider field, which then executes in an Administrator's browser when the admin views that profile. Three compounding weaknesses enable this: the `user_meta_save()` function skips sanitization of scalar (non-array) values, the `Redux_Slider::render()` method writes slider values into unquoted HTML attributes without escaping, and PHP loose-type comparison in `clean_default()` permits crafted strings like `1 tabindex=0 autofocus onfocus=alert(1) x=` to pass numeric validation. Vendor-released patch 4.5.14 was published September 07, 2026; no public exploit code or active exploitation (CISA KEV) is confirmed at time of analysis.

Cross-site scripting in SHIRASAGI CMS allows an authenticated low-privileged attacker to inject arbitrary JavaScript that executes in the browser of other users visiting affected pages. The vulnerability carries a CVSS 5.4 (Medium) score with scope change (S:C), meaning attacker-controlled script runs outside the injector's own session - a common vector for session hijacking or admin account takeover in CMS platforms. Reported by JPCERT/CC with a JVN advisory (JVN#37476837), no active exploitation or public POC has been identified at time of analysis.

Palo Alto Networks PAN-OS web interface on PA-Series and VM-Series firewalls and Panorama management platforms contains a stored cross-site scripting vulnerability that enables an authenticated administrator to inject persistent JavaScript payloads into the management UI, which execute in the browsers of other administrators who view the affected pages. Affected versions span PAN-OS 11.1.x through 12.1.x; Cloud NGFW and Prisma Access are explicitly not affected. No public exploit has been identified, and the CVSS 4.0 score of 1.1 reflects the narrow exploitation conditions: administrator-level credentials are required along with passive interaction by a second administrator.

Reflected XSS in the Form Maker by 10Web WordPress plugin (all versions ≤1.15.46) allows unauthenticated attackers to inject arbitrary JavaScript into WordPress admin pages via the unsanitized `bulk_action` parameter in the Submissions controller. Successful exploitation requires social-engineering an authenticated WordPress admin into clicking a crafted link, enabling session hijacking or unauthorized admin actions in the victim's browser context. No public exploit code or CISA KEV listing has been identified; version 1.15.47 resolves the issue per confirmed WordPress SVN changesets.

Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.

Stored cross-site scripting in the Builderall for WordPress plugin (versions ≤3.0.2) allows authenticated contributors to inject persistent JavaScript via the Photo Module's unsanitized 'attributes' setting, executing against any subsequent visitor to an affected page. The attack requires only contributor-level WordPress credentials and results in scope-changed impact against victim browsers, enabling session hijacking or malicious redirects. No public exploit code or active exploitation has been identified; Wordfence reported the issue with precise source-code references across multiple affected PHP files.

Stored XSS in the Builderall for WordPress plugin (all versions through 3.0.2) enables authenticated contributors to inject persistent JavaScript via the 'bg_video_service_url' page-builder setting, with payloads executing in the browsers of any subsequent visitor - including administrators - who loads an affected page. The flaw is rooted in absent input sanitization and output escaping across the plugin's AJAX handling, model storage, and rendering pipeline, as confirmed by Wordfence and Trac source references. No public exploit code has been identified at time of analysis, and exploitation is constrained by the requirement for at least contributor-level WordPress credentials.

Stored cross-site scripting in the Ninja Forms - Scheduled Exports WordPress plugin (all versions through 3.0.3) allows any authenticated subscriber-level user to inject persistent malicious scripts via the REST API parameters interval, format, and emailTo, which then execute in the browsers of any user who visits the affected page. The root cause is a REST endpoint registered without a permission_callback that relies solely on nonce validation rather than WordPress capability checks, meaning the lowest default user role can reach it. No public exploit has been identified at time of analysis, but the subscriber-level entry barrier makes this meaningful on any site with open user registration.

Reflected cross-site scripting in Rizwan17's PHP inventory-management-system allows remote unauthenticated attackers to inject arbitrary JavaScript into any user's browser via the unsanitized `msg` parameter on the login page (index.php). The project lacks versioning and the maintainer has not responded to the disclosure filed in GitHub issue #11; no fix exists. Exploit code has been published (CVSS 4.0 E:P), but real-world impact is capped by the requirement for victim interaction and the product's extremely narrow deployment footprint.

Stored cross-site scripting in FairSketch Rise CRM 3.9.6 allows an authenticated administrator to inject persistent JavaScript into an item's title field, which executes in the browser of every client user who subsequently visits the affected store page. The scope-changing nature of the attack means a single malicious admin-level injection silently exposes all visiting clients to session hijacking, account takeover, and phishing without any per-victim interaction beyond a routine page visit. A GitHub repository exists under the CVE identifier (https://github.com/moksh-nfsu/CVE-2026-36392), suggesting proof-of-concept code may be publicly accessible.

Cross-site scripting in Rizwan17's open-source PHP inventory-management-system allows remote attackers to inject arbitrary JavaScript via unsanitized category_name, brand_name, or product_name parameters handled by the List Handler in includes/DBOperation.php. A publicly available proof-of-concept (GitHub issue #12) demonstrates exploitation. No patch exists - the maintainer has not responded to the responsible disclosure report - and the project uses rolling releases with no versioned fix available.

yshopmall through version 3.3 exposes an unauthenticated file upload endpoint (/api/upload) that performs no file type validation, allowing attackers to place arbitrary HTML, JSP or other executable content on the server. Because uploaded files are reachable from the application's origin, a crafted HTML file can execute script in a victim's browser session (reflected/stored XSS, CVSS 6.1, CWE-79), and a JSP upload could escalate to server-side code execution if the upload directory is served by a JSP-capable container. Exploitation requires a victim to open the attacker-supplied file URL (UI:R); there is no CISA KEV entry and no confirmed public exploit, and EPSS is low at 0.14% (3rd percentile), indicating limited observed activity rather than mass scanning.

Stored cross-site scripting in zhitan-ems 1.0.0 allows remote attackers to execute arbitrary JavaScript in a victim's browser by uploading a malicious SVG file through the /equipmentFile/upload endpoint. SVG files support embedded script content, and the application fails to sanitize or restrict SVG payloads before serving them, causing the browser to execute attacker-controlled code in the application's origin context. No public exploit code has been identified at time of analysis, and EPSS at 0.14% (3rd percentile) indicates minimal observed exploitation activity.

Stored XSS in the decidim-elections Ruby gem (versions before 0.32.0) allows a process-scoped admin or election editor with question-management rights to persist arbitrary JavaScript in election question body fields, which subsequently executes in the browsers of all public visitors and voters accessing affected election pages. The root cause is the `question_title` helper in `application_helper.rb` returning `question.body` marked `.html_safe` without any sanitization boundary, bypassing Rails' automatic HTML escaping. No public exploit code and no active exploitation (CISA KEV) have been identified; the issue was discovered through a formal security audit commissioned by the Decidim Association.