Cross-Site Scripting

Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted cancelUri parameter. The isSafeRedirectURL validation function restricts only the URL protocol, leaving HTML metacharacters unchecked; a relative URL containing embedded quotes and event handlers bypasses the check entirely and is reflected verbatim into the href attribute of the Cancel button. Exploitation requires a victim to interact with the Cancel button after following a malicious link, placing this in the phishing-dependent reflected-XSS risk class.

Reflected XSS in AVideo's videoEmbeded.php allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by delivering a crafted embed URL. The `link` GET parameter is echoed verbatim inside an HTML comment with no escaping, so injecting the sequence `-->` closes the comment context and enables arbitrary script injection. No active exploitation has been confirmed per CISA KEV, but the zero-friction delivery model - a victim clicking a malicious embed link - makes this a realistic phishing-chain enabler against authenticated AVideo users.

Stored cross-site scripting in OCS Inventory NG's ocsreports web console lets an administrator plant malicious HTML/JavaScript in the notification template (endpoint /ocsreports/?function=notification) that executes in the browser of any other administrator who opens the template customisation view. The injected script runs in the application's security context, enabling session hijacking or privileged actions against fellow admins. Reported by INCIBE; no public exploit identified at time of analysis, and it is not listed in CISA KEV.

Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inject arbitrary scripts via the `skype_url` shortcode attribute, executing against any site visitor who interacts with the poisoned element. The flaw stems from a three-part sanitization failure: the field is excluded from the URL-option whitelist, the renderer explicitly bypasses `esc_url()` for Skype URLs, and the fallback `sanitize_text_field()` preserves quote characters enabling single-quoted HTML attribute breakout. Versions up to and including 4.27.6 are affected; a fix was released in 4.27.7. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.

Cross-site scripting in Dify 1.13.0's WebApp Sign-In component allows remote attackers to inject malicious JavaScript by manipulating the redirect_url parameter consumed by the router.replace() function. The attack requires passive victim interaction with a crafted sign-in URL and low attacker privileges, limiting the immediate impact to integrity modification within the browser context. A public proof-of-concept exploit exists, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.

Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis.

Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.

Stored cross-site scripting in Jenkins update-center2 3.18.3 and earlier allows an attacker who can submit a plugin for hosting to inject malicious script into plugin download index pages by embedding payloads in plugin names, descriptions, or version metadata. Any user who browses the affected plugin index page triggers the XSS payload in their browser session. No exploitation has been confirmed (SSVC: none, no KEV), and no public exploit code has been identified at time of analysis.

Stored cross-site scripting in Jenkins Customizable Header Plugin 295.v2544b_ca_19b_97 and earlier allows authenticated attackers with permission to modify plugin appearance settings to inject persistent JavaScript payloads via a crafted SVG icon, executing in the browser context of any Jenkins user who loads the affected header. Because the header renders on every Jenkins page, a single write operation by a low-privileged attacker broadly affects all platform users, including administrators. No public exploit code has been identified at time of analysis, and SSVC categorizes exploitation as none, though technical impact is rated total.

Stored cross-site scripting in Jenkins SonarQube Scanner Plugin ≤2.18.3 allows attackers holding Item/Configure permission to inject javascript: scheme URLs into dashboard links the plugin constructs from SonarQube scanner results. The plugin performs no URL-scheme validation, so a malicious javascript: payload persists in the Jenkins UI and executes in any victim's browser that views or interacts with the affected dashboard link. No public exploit or active exploitation has been identified at time of analysis; the Jenkins security team confirmed and published this issue on 2026-09-02.

Stored XSS in Jenkins' system log viewer exposes administrators and privileged users to session hijacking and UI redress attacks, exploitable by any attacker who controls a Jenkins agent process. The vulnerability affects Jenkins 2.579 and earlier (including LTS 2.568.2 and earlier), where log record metadata - source, level, and timestamp - is rendered in the browser without HTML escaping, allowing persistent JavaScript injection via agent-controlled log channels. Patch versions 2.580 (weekly) and LTS 2.568.3 are available per the Jenkins security advisory SECURITY-3967; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.

Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.

Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.

Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.

Cross-site scripting (XSS) in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected output, crossing security boundaries as reflected by the scope-changed CVSS vector. All tracked versions of the module are affected per the wildcard CPE and EUVD-2026-70010 listing. No public exploit code and no CISA KEV listing have been identified at time of analysis; Drupal's security team published advisory SA-CONTRIB-2026-102.

Cross-site scripting in the Drupal Screenshot contributed module allows a high-privileged authenticated attacker to inject malicious script content that executes in the browser context of other users who view the affected page. The scope-changing CVSS vector (S:C) confirms that the injected payload can compromise sessions or data belonging to users other than the attacker, enabling session hijacking, credential theft, or unauthorized actions on behalf of victims. No public exploit code has been identified at time of analysis, and no KEV listing is present.

Cross-site scripting in the Drupal Address Suggestion contributed module allows an authenticated administrator to inject persistent malicious JavaScript into pages served to other users. Affected versions span all releases from 0.0.0 through 1.0.24; version 1.0.25 resolves the issue per Drupal security advisory SA-CONTRIB-2026-103. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool.

Stored cross-site scripting in the Drupal Monster Menus contrib module (versions 0.0.0 through 9.5.3) allows malicious script payloads to be persistently injected into navigation or menu rendering contexts, executing in the browsers of subsequent authenticated visitors. The CVSS scope-change flag (S:C) confirms the attack crosses session boundaries, enabling session hijacking, credential theft, or further lateral movement within the Drupal application. No public exploit code has been identified at time of analysis, and Drupal's security team has released an advisory (SA-CONTRIB-2026-116) with a patch.

Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis.

Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.

Unauthenticated cross-site scripting in the Estatik real estate WordPress plugin affects all versions up to and including 4.3.4, allowing remote unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS scope-change flag (S:C) indicates the injected script can affect browser sessions beyond the vulnerable component itself - typically enabling session hijacking, credential theft, or unauthorized actions performed on behalf of logged-in administrators. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Unauthenticated cross-site scripting in the TrustedSite WordPress plugin (versions <=1.2.5) allows remote attackers without any credentials to inject arbitrary JavaScript into pages served to site visitors or administrators. The CVSS vector designates a scope change (S:C), meaning the injected script executes in the victim's browser context and can affect resources beyond the vulnerable WordPress installation itself - including session cookies and browser-stored credentials. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated entry point and low attack complexity make this a realistic risk on any unpatched deployment.

Reflected Cross-Site Scripting in the Interactive Geo Maps WordPress plugin (versions <= 1.6.30) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to click a crafted URL. The vulnerability carries a CVSS 7.1 with scope change, meaning the injected script executes in the context of the victim's authenticated WordPress session rather than the plugin's own origin. No public exploit or active CISA KEV listing has been identified at time of analysis, though Patchstack has published a vulnerability entry.

Unauthenticated stored or reflected Cross-Site Scripting in the MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin (versions <= 5.13.1) allows remote attackers to inject arbitrary JavaScript that executes in a victim's browser when they visit an affected page. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and crosses into the browser security context, making this a meaningful risk on any WordPress site running the affected plugin. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has documented the issue.

Unauthenticated cross-site scripting in the Upsell Order Bump Offer for WooCommerce plugin (WP Swings) allows remote attackers to inject malicious scripts into victim browsers by tricking authenticated users into visiting a crafted URL. All versions through 3.1.5 are confirmed affected per CPE data published by Patchstack. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.

Stored XSS in SiYuan before v3.8.2 enables authenticated users with upload access to bypass the asset extension blocklist by using file types such as .xht, .ehtml, .xsl, .xbl, or .rdf that browsers render as executable documents. When a victim opens or previews the malicious asset, embedded JavaScript runs in the SiYuan application context, allowing theft of API tokens and full workspace compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in v3.8.2.

Stored XSS in Craft CMS 5.0.0-RC1 through 5.10.10 allows a malicious administrator to inject arbitrary JavaScript into the site name field, which executes in the browsers of other users who subsequently view control panel settings pages. The attack requires existing administrator-level credentials (PR:H per CVSS 4.0 vector) and passive user interaction to trigger, making it primarily a threat in multi-administrator deployments where one privileged account may be compromised or untrustworthy. Vendor-released patch is available at version 5.10.11; no public exploit or CISA KEV listing identified at time of analysis.

Stored XSS in the Broken Link Checker WordPress plugin (versions ≤ 2.4.13) allows unauthenticated attackers to inject persistent JavaScript into the WordPress admin link log via a multi-hop redirect-based payload delivery mechanism. The plugin's HTTP checker follows attacker-controlled redirects and stores the redirect destination URL verbatim in the link log without sanitization; the admin table printer then renders this unsanitized content to any administrator who views the link log. No public exploit has been identified at time of analysis, and a vendor-released patch is confirmed available as version 2.4.13.1.

Stored Cross-Site Scripting in the Easy Waveform Player WordPress plugin (≤1.2.2) allows authenticated Contributor-level users to inject arbitrary JavaScript via the shortcode_easywaveformplayer() function due to missing input sanitization and output escaping. The payload persists server-side and executes in every visitor's browser upon page load, with scope change enabling cross-origin script execution. No public exploit or CISA KEV listing has been identified at time of analysis; a patch commit (changeset 3674516) is visible in the WordPress plugin SVN repository.

Reflected cross-site scripting in the Login With Ajax WordPress plugin (versions through 4.5.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The scope change in the CVSS vector (S:C) reflects the XSS payload executing outside the origin context, enabling session theft, credential harvesting, or DOM manipulation against authenticated WordPress users. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated contributors to plant a `javascript:` URI in the `redirect_url` parameter of the `et_pb_contact_form` shortcode, which executes in any visitor's browser upon contact form submission. The flaw arises from using `esc_attr()` instead of `esc_url()` for sanitization and the parameter's absence from the `$url_options` URL-sanitization array, allowing the raw URI to reach client-side JavaScript that assigns it to `window.location.href`. No public exploit code or CISA KEV listing has been identified at time of analysis, but Divi's enormous deployment footprint makes this a meaningful aggregate risk despite the Contributor access prerequisite.

Stored cross-site scripting in the Simple Ajax Chat WordPress plugin (versions before 20260827) permits unauthenticated users to inject arbitrary HTML and JavaScript into chat messages, which execute in the browser of any viewer including site administrators. Because no authentication is required to post messages and the plugin does not sanitize or escape content before rendering, a single malicious chat post persists and fires against every subsequent visitor. A publicly available exploit demonstrates the issue, and CVSS PR:N/UI:R confirms the attacker-to-victim delivery model: the attacker posts once, then waits for an administrator to trigger code execution by viewing the chat.

Stored XSS in the FAQ Builder AYS WordPress plugin (versions before 1.8.5) permits unauthenticated remote attackers to inject persistent JavaScript payloads via visitor-submitted content that is stored without sanitization and later rendered in the WordPress admin dashboard. A double-bypass condition compounds the flaw: the plugin's own partial HTML escaping is undone by a subsequent server-side decoding step, ensuring injected scripts reach the admin browser intact. When a logged-in administrator views the affected admin panel page, the payload executes with full administrative privileges, enabling session hijacking or complete site takeover. A publicly available exploit exists per WPScan; vendor patch version 1.8.5 is available.

Stored XSS in the RegistrationMagic WordPress plugin prior to version 6.0.9.9 allows unauthenticated attackers to inject malicious scripts into registration form fields that are rendered unescaped within HTML attributes on WordPress administrative pages. When a privileged administrator subsequently views the affected backend page, the attacker's payload executes in the admin's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists via WPScan, and a vendor-released patch (6.0.9.9) is confirmed available.

Reflected Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (all versions before 3.0.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in a crafted URL targeting an unescaped request parameter rendered inside an inline JavaScript event handler. Exploitation is constrained to sites running a non-default icon display configuration, and requires the victim to interact with the affected share button. A public proof-of-concept is available via WPScan; no active exploitation has been confirmed by CISA KEV.

Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. A publicly available proof-of-concept from WPScan exists; no active exploitation confirmed in CISA KEV at time of analysis.

Reflected XSS in Photo Gallery by 10Web WordPress plugin (all versions before 1.8.44) lets an unauthenticated attacker execute arbitrary JavaScript inside the authenticated browser session of an administrator or contributor by tricking them into clicking a crafted link. Two distinct injection sinks exist: the Shortcode admin page (exploitable against contributors and above) and the Galleries/Albums list page (requires the site to have more than 20 galleries, and targets administrators). Both sinks reflect unsanitized request parameters into HTML input-attribute values and weaponize an auto-firing onfocus event handler, bypassing some user-interaction defenses. A publicly available PoC via WPScan confirms the issue; vendor-patched version 1.8.44 is available.

Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.

Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.

Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript payloads that execute against any visitor of an affected page. The vulnerability chains two compounding flaws: the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only recognizes the modern `@ET-DC@...@` marker format, while the rendering engine silently accepts and converts a legacy JSON format, bypassing sanitization entirely; a second flaw in the `post_meta_key` resolver skips `wp_kses_post()` output encoding when `enable_html` is set to `on`, feeding raw `get_post_meta()` output directly into page HTML. A patch was released in version 4.27.7 per the Divi changelog. No public exploit has been identified at time of analysis.

Stored cross-site scripting in OpenCart 4.1.0.3 and 4.1.0.4 allows an authenticated customer to inject malicious script content via the `firstname` field in `catalog/controller/account/edit.php`, which executes in the browser of any user (likely an admin or staff member) who triggers the Autocomplete Workflow over customer data. A public proof-of-concept is available on GitHub. No vendor patch exists - the vendor did not respond to the coordinated disclosure.

Stored cross-site scripting in OpenCart 4.1.0.3 and 4.1.0.4 allows an authenticated low-privilege user (e.g., a customer account) to inject malicious script into the address_1 field via the Autocomplete Workflow in catalog/controller/account/address.php, which then executes in the browser of any user who subsequently views the stored address data. A public proof-of-concept exploit is available on GitHub. The vendor did not respond to the coordinated disclosure, so no official patch has been issued.

Stored cross-site scripting in NocoBase's rich text field read renderer allows any authenticated user with record-creation permissions to inject persistent malicious HTML into the application's collection API, executing arbitrary JavaScript in the browsers of all users who subsequently view the affected record. The vulnerable component is the ReadPretty renderer (packages/core/client/src/schema-component/antd/input/ReadPretty.tsx), which fails to sanitize event handlers from stored rich text values before rendering them. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

Stored cross-site scripting in BookStack before 26.05.4 lets a user with editor-level permissions upload a malicious SVG through the drawing upload endpoint, which accepts unvalidated base64 content and stores it without inspection. The image gallery API later streams the file with no content-type validation and no CSP headers, so the embedded script executes in the browser of any administrator who views it - enabling admin session/account takeover. No public exploit is identified at time of analysis, but the fixing commit and test case publicly document the vulnerable code path.

Stored cross-site scripting in WWBN AVideo's Live_schedule module allows a low-privileged attacker with streaming permission to persist unsanitized JavaScript via the setTitle() and setDescription() POST endpoints. The injected payload is served to any user - including unauthenticated visitors - who loads remindMe.php, giving the stored payload a wider execution surface than the injection privilege level implies. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects this split: low-privilege write, passive-interaction trigger, and limited per-browser impact.

Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.

Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.

Incomplete script filtering in SVGO's opt-in removeScripts plugin allows stored XSS to survive the sanitization pass across versions 1.0.0 through 2.8.3, 3.3.4, and 4.0.x in applications that process attacker-controlled SVG and serve the result in a browser context. The plugin fails to recognize namespace-prefixed SVG anchor elements such as svg:a and does not strip ASCII tab, line-feed, or carriage-return characters from URL values before scheme validation - characters browsers silently discard before parsing, allowing javascript: URIs to bypass detection intact. Vendor-released patches exist at v2.8.4, v3.3.5, and v4.1.0; no public exploit or CISA KEV listing was identified at time of analysis.

Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. Exploitation requires two deliberate user actions - opening the crafted email and invoking the Add Local Contacts function - limiting opportunistic mass exploitation; no public exploit has been identified at time of analysis.

Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.

Stored cross-site scripting in the HPE AOS-CX web-based management interface allows an authenticated attacker with high privileges to inject persistent malicious script that executes in the browser of any administrator who subsequently views the affected page. Because the scope changes to the victim's browser context, a successful exploit enables session hijacking, credential theft, or execution of privileged management actions against AOS-CX network infrastructure. No public exploit code has been identified at time of analysis, and this CVE is one of several addressed in HPE security bulletin hpesbnw05134en_us alongside CVE-2026-73749, CVE-2026-73766, and CVE-2026-73778.

Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal `#?` sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. The Cache Middleware compounded this by stripping fragments when building cache keys, so a response shaped by fragment-injected parameters gets stored and served to subsequent users under a key that omits those parameters entirely. No public exploit code has been identified at time of analysis, and exploitation is gated by the requirement that the runtime and intermediary pass raw `#` characters through to the application.

Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in the HPE Networking Fabric Composer web management interface allows an unauthenticated attacker on an adjacent network segment to inject persistent malicious script into the interface, which executes in any authenticated user's browser upon visiting the affected page. The CVSS 8.8 score with S:C/C:H/I:H/A:H reflects the elevated downstream impact: a successful payload executing in a network administrator's session could facilitate full session hijacking, credential theft, or unauthorized configuration changes to the managed fabric infrastructure. No public exploit or KEV listing has been identified at time of analysis.

Stored cross-site scripting in the web management interface of HPE Networking Fabric Composer allows an authenticated low-privilege operator to inject persistent script that executes in an administrator's browser session, enabling privilege escalation within the appliance interface. HPE (advisory hpesbnw05133) assigned a CVSS 3.1 base score of 9.0, driven largely by a scope change (S:C) and full C/I/A impact against the higher-privileged admin context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.

XML injection and cross-site scripting in the xmldom JavaScript library allows attacker-controlled tag names to be injected verbatim into serialized XML or HTML output. Applications using @xmldom/xmldom prior to 0.8.14 or 0.9.11, or the legacy xmldom package at any version, are affected when they pass externally-supplied strings to Document.createElement() and then serialize the resulting DOM with XMLSerializer.serializeToString(). The serializer's requireWellFormed: true path failed to validate element qualified names and synthesized xmlns:PREFIX declarations against the XML QName production, meaning malformed names containing characters such as '>' or '<' pass through unchecked and cause XSS when the output is rendered in a browser. No public exploit has been identified at time of analysis, though the GitHub security advisory and PR diffs include explicit test cases demonstrating injection payloads.

Arbitrary file upload in Gravity Forms for WordPress (all versions ≤ 3.0.2) allows unauthenticated attackers to write PHP or HTML files with attacker-controlled names to the plugin's temporary upload directory by exploiting chunk-state hash reuse in the `GFAsyncUpload::upload()` function. On NGINX or other non-`.htaccess`-respecting web servers, this leads to remote code execution; on Apache deployments the plugin's bundled `.htaccess` file blocks PHP execution, though attacker-written `.html` files can still produce stored same-origin XSS if a victim visits the generated URL. No public exploit has been identified at time of analysis, and exploitation is meaningfully constrained by two simultaneous prerequisites: a specific form configuration and a non-Apache web server.

Stored cross-site scripting vulnerabilities in Rockwell Automation's ArmorStart® LT distributed motor controller expose industrial operators to persistent script injection via the device's embedded web management interface. Per the CVSS 4.0 AV:N/PR:N vector, unauthenticated remote attackers can inject malicious scripts that are persisted on the device and execute in the browsers of any operator or engineer who subsequently accesses affected pages - enabling session hijacking, credential theft, or display of falsified operational data. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the ICS context meaningfully elevates practical risk beyond the moderate base score.

Stored Cross-Site Scripting in WP Recipe Maker Premium for WordPress (all versions ≤ 10.5.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'wprm-call-to-action' shortcode's unsanitized attributes. Every subsequent visitor to an injected page executes the attacker's script in their browser, enabling session hijacking, credential harvesting, or privilege escalation to administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Firefox's DOM Navigation component allows a remote unauthenticated attacker to inject and execute script content across security origins when a victim visits a specially crafted webpage. The vulnerability is classified CWE-79 with scope change (S:C), indicating potential cross-origin impact beyond the attacked page. Mozilla patched this in Firefox 155 and Firefox ESR 153.2, with coverage across multiple advisory tracks (mfsa2026-82, -85, -86, -88). No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.

Stored XSS across multiple legacy PHP templates in LibreNMS allows an attacker who controls a monitored network device to inject arbitrary JavaScript via SNMP-polled fields (ifAlias, mempool_descr, storage_descr, sensor_descr) or syslog program fields, with payload execution triggered when any authenticated LibreNMS user browses alerts, health dashboards, or syslog views. The vulnerability spans at least five distinct template locations and stems from inconsistent output encoding - adjacent fields in the same code paths are correctly escaped, but affected fields are not. No public exploit has been identified at time of analysis and the CVE is not listed in CISA KEV, though the high confidentiality impact from potential session token theft makes patching a priority for any network operations team.

Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. No public exploit has been identified at time of analysis, though the attack surface (SNMP-fed stored XSS with network-facing ingestion) is straightforwardly exploitable for anyone with access to a monitored device.

Stored cross-site scripting in LibreNMS through 26.4.0 lets an administrator (or an attacker who has hijacked an admin session) chain an SSRF into persistent XSS by pointing the admin-configurable Oxidized integration URL (oxidized.url) at an attacker-controlled server. That server returns malicious JSON whose name, ip, model, author, and commit-message fields are rendered into the device showconfig page without htmlspecialchars(), so any user viewing any device's showconfig tab executes attacker-supplied JavaScript. A proof-of-concept mock Oxidized server has publicly confirmed the injection; no active exploitation is listed in CISA KEV.

Stored cross-site scripting in LibreNMS 26.4.0 and below allows an authenticated administrator to inject arbitrary HTML/JavaScript into graph description configuration keys, which then execute in the browsers of every authenticated user who views the affected graph type. The vulnerable sink is `includes/html/pages/graphs.inc.php:194`, where `LibrenmsConfig::get()` output is echoed without `htmlspecialchars()`. A public proof-of-concept is documented in the GHSA advisory; no active exploitation is confirmed via CISA KEV. The vendor released a fix in version 26.7.0.

Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.

Stored Cross-Site Scripting in the Live Composer - Free WordPress Website Builder plugin (all versions through 2.1.19) lets authenticated contributors inject persistent JavaScript payloads via the dslc_module_projects_output shortcode, with those payloads executing in the browser of every subsequent page visitor including site administrators. The root mechanism is WordPress's shortcode-aware kses processing, which serializes and preserves shortcode bodies as opaque placeholders before content filtering runs, allowing attacker-controlled attributes - view_all_link, main_heading_link_title, main_filter_title_all, and button_text - to reach multiple render-time output sinks in the plugin's projects module entirely unescaped. No public exploit has been identified at time of analysis, but the scope change to victim browsers creates a realistic session-hijacking path to full administrative takeover on multi-author sites.

Stored cross-site scripting in the Live Composer Free WordPress Website Builder plugin (all versions up to and including 2.1.19) allows authenticated attackers with contributor-level access to embed persistent JavaScript payloads via the dslc_module_testimonials_output shortcode. The vulnerability exploits a two-phase rendering gap: WordPress's native wp_kses_post filter sanitizes content at save time but treats shortcode markup as opaque, so attacker-controlled values in fields such as main_heading_title, view_all_link, main_heading_link_title, and main_filter_title_all are never escaped - they reach the DOM unfiltered when do_shortcode() executes at page-view time. No public exploit code or CISA KEV listing has been identified at time of analysis; Wordfence confirmed the flaw through direct code-level review of the testimonials module.

Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions up to and including 2.12.1) allows unauthenticated attackers to inject arbitrary JavaScript via the guest checkout form's 'custom_order' parameter. The payload is persisted in the WordPress database without sanitization and fires inside the WordPress admin panel when an administrator reviews the affected order - a routine operational workflow requiring no social engineering of the victim. Upgrade to version 2.12.2 is indicated by plugin Trac changeset history; no CISA KEV listing or public proof-of-concept has been identified at time of analysis.

Stored Cross-Site Scripting in the Blocksy Companion WordPress plugin (versions up to and including 2.1.51) allows authenticated attackers with author-level access to inject persistent malicious JavaScript via the unsanitized tagName attribute of the blocksy/dynamic-data Gutenberg block. Any visitor who loads a page containing the injected content will have the script execute in their browser context, enabling session theft, credential harvesting, or further site-level compromise. No active exploitation has been confirmed and a patched release (2.1.52) is available per the plugin Trac changeset; no public exploit code has been identified at time of analysis.

Stored cross-site scripting in the BetterDocs WordPress plugin (versions through 4.8.1) allows contributor-level authenticated attackers to inject persistent JavaScript that executes in any visitor's browser context. The flaw exploits a two-stage processing gap: entity-encoded quotes in a heading id attribute pass WordPress's wp_kses_post sanitization at save time, but are later decoded by html_entity_decode() inside process_content_for_toc(), after which a lazy regex extracts the now-unescaped value and echoes it directly into the Table of Contents HTML output. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored XSS in the User Profile Builder WordPress plugin (all versions through 4.0.0) allows unauthenticated attackers to inject malicious JavaScript via the email parameter submitted during user registration. The payload persists in the unconfirmed email addresses database and executes in the browser of any administrator with manage_options capability who visits the Users > Unconfirmed Email Addresses list table and interacts with row-action links, because the row_actions() function renders the stored email value verbatim as a javascript: href. No public exploit has been identified at time of analysis, and an upstream fix is available via SVN changeset 3666521.

Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions through 3.29.11) allows authenticated contributors to inject persistent malicious scripts via the 'tag' shortcode attribute, executing in the browser of any user who subsequently visits the compromised page. The scope change (S:C in CVSS) reflects the cross-context impact: scripts run under victims' browser sessions, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of administrators. No public exploit has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Stored XSS in the Affiliate Super Assistent WordPress plugin (≤ 1.10.2) enables unauthenticated attackers to inject persistent JavaScript payloads via the doCommentShortcode function in AsaCore.php, which executes in the browser of any visitor loading an affected page. The vulnerability carries a CVSS 7.2 (High) score reflecting network accessibility, no authentication requirement, and scope change to the victim browser context. No active exploitation or public PoC has been identified at time of analysis; an upstream fix commit (changeset 3672410) is available via the WordPress plugin repository.

Stored Cross-Site Scripting in Live Composer Free WordPress Website Builder (versions ≤ 2.1.19) allows authenticated contributors to permanently embed arbitrary JavaScript into WordPress pages via the unsanitized 'custom_id' shortcode attribute. The payload is rendered verbatim into the HTML id="" attribute of div elements by dslc_modules_section_front() and dslc_modules_area_front() due to absent esc_attr() output escaping, then executes in the browser of every subsequent visitor - including administrators. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but sites permitting open contributor registration face realistic risk of admin session theft or persistent malicious redirects.

Stored Cross-Site Scripting in the Live Composer WordPress page builder plugin (all versions through 2.1.19) allows authenticated contributors to inject persistent JavaScript payloads via the dslc_custom_field shortcode, executing in any visitor's browser session. Wordfence identified insufficient input sanitization and output escaping in shortcodes.php at multiple code paths (lines 84, 88, 89). No public exploit has been identified at time of analysis, but the vulnerable code is publicly browsable in the plugin's SVN repository and a remediation changeset has been published.

Stored Cross-Site Scripting in the User Profile Builder WordPress plugin (versions up to and including 4.0.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'date' shortcode attribute, executing in victims' browsers whenever they visit an affected page. The vulnerability stems from insufficient input sanitization and output escaping in the format-date shortcode handler (format-date.php), identified in the plugin Trac source at lines 7 and 16. No active exploitation has been confirmed at time of analysis, and a fix appears committed upstream per changeset 3666521 on the WordPress plugin repository.

Stored Cross-Site Scripting in the Listdom WordPress plugin (all versions through 5.8.1) allows unauthenticated attackers to inject persistent malicious scripts via the `lsd[displ][style]` parameter, with payloads executing in every subsequent visitor's browser upon page load. The CVSS PR:N rating confirms no authentication is required to plant the payload once the vulnerable parameter is reachable. Wordfence identified the vulnerable code across four paths - single.php (lines 82 and 560), dashboard.php (line 739), and listing.php (line 196) - and a Trac changeset suggests a code-level fix was committed, though an explicit patched release version number is not confirmed in available data. No public exploit identified at time of analysis.

Stored XSS in Sulu CMS prior to versions 2.6.25 and 3.0.8 allows an authenticated attacker with media upload permissions to execute attacker-controlled JavaScript in a victim's browser on the Sulu origin. By uploading an HTML, XHTML, or XML file and crafting a download URL with the inline=1 query parameter, the attacker bypasses the expected Content-Disposition: attachment behavior, causing the browser to render the document instead of downloading it. When an authenticated victim opens the crafted link, the attacker's JavaScript executes with full access to the victim's Sulu-origin session and can read sensitive data or perform privileged actions on the victim's behalf. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated XSS in miniOrange's WordPress Social Login and Register plugin (versions 7.8.2 and earlier) allows remote attackers to inject arbitrary JavaScript into a victim's browser by tricking them into following a crafted URL targeting the plugin's social login flow. The scope-changed CVSS vector (S:C) confirms cross-context impact, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators. No public exploit code has been identified and the vulnerability is not listed in CISA's KEV catalog at time of analysis.

Unauthenticated cross-site scripting in SliceWP WordPress affiliate plugin versions 1.2.10 and earlier allows a remote unauthenticated attacker to inject malicious scripts that execute in the browser context of other users, including site administrators. The scope-changed CVSS vector (S:C) indicates the injected payload crosses browser security boundaries, enabling session hijacking, credential theft, or administrative action takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack disclosure provides sufficient detail for exploit development by capable actors.

Unauthenticated XSS in RegistrationMagic WordPress plugin versions 6.0.9.8 and below exposes sites to script injection attacks requiring only that a victim visit a crafted URL. The CVSS scope-change metric (S:C) confirms the injected payload executes in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or administrative action on behalf of the victim. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in the Kalles Addons WordPress plugin (versions <= 1.0.6) allows a low-privileged subscriber-level user to inject malicious JavaScript that executes in the browsers of other site visitors or administrators. The scope-changed CVSS vector (S:C) confirms the injected payload escapes the plugin's execution context and can affect other authenticated sessions. No public exploit or active exploitation has been identified at time of analysis.

Cross-site scripting in the Super Store Finder WordPress plugin (versions <= 7.10) allows unauthenticated remote attackers to inject malicious client-side scripts that execute in the security context of victim users' browsers. The CVSS Scope Change metric (S:C) confirms the attack crosses from the plugin's server-side context into the victim's browser environment, enabling session hijacking, credential harvesting, or malicious redirects against site visitors or administrators who interact with the affected input. No public exploit code or active exploitation has been identified at time of analysis, but the PR:N unauthenticated attack vector means any internet-facing WordPress installation running this plugin version is reachable without attacker credentials.

Unauthenticated cross-site scripting in the Tailored Tools WordPress plugin (versions 3.0.2 and earlier) allows a remote, unauthenticated attacker to inject malicious scripts that execute in the context of an authenticated victim's browser session. The scope change indicated by the CVSS vector (S:C) confirms that the injected payload crosses the plugin's security boundary into the victim's browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation has been identified at time of analysis.