Cross-Site Scripting

Stored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contributor-level access or higher to inject arbitrary JavaScript via an improperly escaped block animation attribute rendered into an HTML attribute context. When a higher-privileged user such as an administrator views the affected content, the injected script executes in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan reporting, making exploitation accessible to low-skilled threat actors despite the low EPSS score of 0.15%.

Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin before version 3.4.0 allows any user holding the course-author role to inject unsanitized JavaScript into course settings fields, where it silently executes in the browser of every subsequent visitor - including logged-in administrators. Because the injected payload runs within the victim's full session context, a successful attack against a site administrator can result in complete WordPress site takeover through credential theft, rogue plugin installation, or arbitrary content modification. A publicly available proof-of-concept has been published by WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS score of 0.15% (5th percentile) reflects limited observed exploitation probability at time of analysis.

HTML injection via unsanitized email notifications in JetFormBuilder WordPress plugin (versions before 3.6.5.2) allows unauthenticated form submitters to embed arbitrary HTML-and conditionally JavaScript-into notification emails delivered to administrators and other configured recipients. The scope change is real: a public form submission influences the admin's email client environment rather than the WordPress server itself, with JavaScript execution gated on the recipient's mail client rendering capability. A publicly available proof-of-concept exists via WPScan, though EPSS at 0.18% (8th percentile) reflects no widespread active exploitation; the vulnerability is not in CISA KEV.

Stored Cross-Site Scripting in the Joli Table Of Contents WordPress plugin (versions up to and including 2.8.0) allows authenticated administrator-level users to inject persistent malicious scripts into admin settings pages that execute in the browsers of other administrators who view those pages. The vulnerability bypasses WordPress's unfiltered_html capability restriction, making it particularly relevant in WordPress multisite deployments where that capability is intentionally withheld from site administrators. A vendor-released patch (2.8.1) is available, and a public proof-of-concept has been published by WPScan.

Stored cross-site scripting in the Social Chat - Click To Chat App Button WordPress plugin (all versions ≤8.6.2) allows authenticated contributors to plant arbitrary JavaScript via the consent_message JSON attribute in the .qlwapp data-box element. When auto_open and consent_enabled are both set to 'yes' in the injected configuration, the malicious script fires immediately on page load with no additional victim interaction required, enabling session-cookie theft, credential harvesting, or malicious redirects against any visitor who loads the affected page. A patched version (8.6.3) is confirmed available via the WordPress plugin repository changeset; no public exploit code has been identified at time of analysis.

Stored XSS in the Events Manager WordPress plugin (versions ≤ 7.3.3) enables persistent JavaScript injection via event attribute values using the '#_ATT{key}' template placeholder, which is stored without sanitization and rendered without output escaping. Authenticated users with Author-level access can exploit this on any site running the plugin without special configuration; when the plugin's anonymous event submission feature is enabled (a non-default setting), unauthenticated attackers can achieve the same result. Payloads execute in the browser of any visitor who views the compromised event page. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (versions ≤2.4.30) allows authenticated Contributor-level users to inject persistent JavaScript payloads into pages, executing in every subsequent visitor's browser. The attack exploits the `parseThumbs()` function in `dflip.js`, which unsafely accepts the inner HTML of `.df-element` divs from Custom HTML blocks as a `title` argument and writes it directly into the DOM without sanitization - enabling both direct `innerHTML` injection and attribute breakout via `onerror` event handlers on crafted `img` elements. No public exploit code or CISA KEV listing identified at time of analysis, but the scope-change (S:C) in the CVSS vector signals that successfully stored payloads affect all site visitors, including administrators.

Stored Cross-Site Scripting in the Dear Flipbook WordPress plugin (≤2.4.30) allows authenticated contributors to inject persistent JavaScript payloads that execute silently in any visitor's browser. The attack exploits the plugin's client-side parseCSSElements() function, which Base64-decodes JSON embedded in CSS class names of Custom HTML blocks via atob()/JSON.parse() and renders the logo property as raw innerHTML with no server-side or client-side sanitization intercept. No public exploit code identified at time of analysis; a patched version (2.4.37) has been released per WordPress SVN changeset references.

Stored cross-site scripting in Emlog versions 2.6.29 and prior allows persistent JavaScript injection via crafted tag names rendered in the article editor. The underlying flaw is that PHP's addslashes() escapes backslash-sensitive characters but does not HTML-encode entities, so an attacker can store the HTML entity ' (representing a single quote) which the browser later decodes back to a literal quote at render time, breaking out of a JavaScript string literal and executing arbitrary code in the victim's session. No vendor-released patch was publicly available at time of publication, and no public exploit code beyond the security advisory proof-of-concept has been identified.

Stored cross-site scripting in Stormshield Network Security's web administration panel allows an authenticated administrator who injects malicious script into group comments within the webservices interface to execute arbitrary JavaScript in the browser session of any other administrator who subsequently views that group entry. The CVSS 4.3 score reflects the constrained preconditions: adjacent network access, high privileges, and required user interaction by a second victim. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored cross-site scripting in IBM Langflow OSS 1.0.0-1.11.2 allows an unauthenticated network attacker to inject persistent malicious scripts into the Playground chat interface. When a victim user subsequently loads the chat view, the stored payload executes in their browser under the application's origin, enabling session hijacking, credential theft, or unauthorized UI manipulation. IBM has released a patch per advisory node/7285646; no public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program (all versions before v22.2) allows unauthenticated remote attackers to inject malicious scripts into HTML attribute contexts, executing arbitrary JavaScript in victims' browsers. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C vector confirms a classic reflected XSS pattern requiring only that a target user click a crafted link. Reported by TR-CERT with no public exploit or KEV listing at time of analysis.

Stored cross-site scripting in Gastromenum Ticket and QR Menu System allows authenticated low-privilege users to inject persistent malicious scripts that execute in other users' browsers. All versions prior to 2026.08.31 are affected. The vulnerability is tracked by TR-CERT (Turkish national CERT) and no public exploit or active exploitation has been identified at time of analysis.

Cross-site scripting in Yordam Information Technology's Library Information and Document Automation Program enables unauthenticated network attackers to inject malicious scripts into pages served to authenticated library staff or patrons. Affected versions span v22.1 up to (but not including) v22.2. No active exploitation has been identified and no public proof-of-concept is known, but the vulnerability is reported by TR-CERT and carries a scope-changing CVSS vector reflecting its potential to pivot from the web app context into the victim's browser session.

Stored cross-site scripting in Menulux Portal (all versions before 20260903211448) allows an authenticated low-privileged user to inject persistent malicious scripts into web pages that execute in the browsers of other users who view the affected content. The scope change (S:C in CVSS) indicates the attack crosses the boundary from the application into victim browsers, enabling session theft, credential harvesting, or UI redirection against any user who views the poisoned content. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by TR-CERT and a fix has been released.

Stored XSS in Grav Admin before 2.0.20 allows arbitrary JavaScript to execute within authenticated admin browser sessions by embedding malicious javascript: URI schemes inside plugin or theme changelogs. The root cause is that MarkdownEditor and MarkdownModal Svelte components pass marked.parse() output directly into the DOM via Svelte's {@html} directive without sanitization, meaning any attacker who can publish or distribute a crafted Grav package can trigger JavaScript execution when an admin views that package's changelog. No public exploit code or CISA KEV listing exists at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects the constrained impact on subsequent systems only.

Stored cross-site scripting in Grav Admin plugin (getgrav/grav-plugin-admin2) versions <= 2.0.19 allows a low-privileged attacker to inject HTML/JavaScript payloads via a crafted username that bypasses server-side validation, executing in an administrator's browser session when specific UI surfaces render the stored username. The root cause is the `tHtml()` internationalisation function in `src/lib/stores/i18n.svelte.ts`, which inserts unescaped user-supplied parameters into locale template strings before markdown parsing - a classic stored XSS pattern. Fixed in version 2.0.21; no public exploit code or CISA KEV listing is known at time of analysis.

Stored cross-site scripting in Grav Shortcode Core before 6.2.5 allows authenticated users with page-edit permissions to inject arbitrary HTML and JavaScript via the [lorem] tag parameter and [details] summary parameter, both of which are written to rendered pages without output escaping. Any visitor who loads an affected page - including site administrators - will have the injected script execute in their browser, enabling session hijacking, credential theft, or further privilege escalation against admin accounts. Vendor-released patch version 6.2.5 resolves both injection points; no public exploit or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in Grav CMS versions 2.0.0 through 2.0.17 allows authenticated page editors to plant persistent XSS payloads via the modular page subsystem, which bypasses the CMS's save-time XSS sanitization entirely. By embedding malicious Twig template code into a modular page, an attacker with page-edit privileges can cause arbitrary JavaScript to execute in the browsers of any visitor to the parent page - including site administrators. If an administrator is targeted, the attacker can escalate to full site compromise through session hijacking or forced admin-side actions. No public exploit code has been identified at time of analysis, and the CVE is not listed in CISA KEV.

Stored cross-site scripting in phpMyFAQ before 4.1.8 allows authenticated FAQ editors to plant persistent JavaScript payloads that execute in every visitor's browser. The root cause is FaqHelper::convertOldInternalLinks() calling html_entity_decode() on content that was previously sanitized via entity encoding - effectively undoing the protection and re-introducing executable HTML. The impact extends beyond the attacker's own session to all users who subsequently view the poisoned FAQ pages, confirmed by the scope-change metrics in the CVSS 4.0 vector. No public exploit or KEV listing exists at time of analysis.

Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a script-breakout payload in the error parameter. The attack targets any user who follows the crafted link to the AVideo login page, enabling session hijacking, credential phishing overlays, or browser-based actions on behalf of the victim. No active exploitation (CISA KEV) is recorded and no public exploit code has been independently confirmed beyond the security advisory description.

Reflected XSS in DreamMaker (Interinfo) allows authenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to a specially crafted URL. The vulnerability affects all tracked versions per the wildcard CPE string and was reported by TWCERT; the CVSS 4.0 vector confirms a network-reachable, low-complexity attack that nonetheless requires both attacker authentication and victim interaction. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

DOM-Based XSS in the WoodMart WordPress theme (all versions before 8.3.8) allows low-privilege authenticated attackers to inject malicious scripts into the browsers of higher-privileged users visiting affected pages. The CVSS scope change (S:C) indicates the injected payload can reach beyond WoodMart's own security boundary into the broader WordPress page context, enabling session theft or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis; the fix is available in version 8.3.8.

Cross-site scripting in Eleveo Quality Management 9.7.0 allows authenticated low-privileged users to inject malicious scripts into the Conversation Review component, which then execute in the browsers of other users who subsequently view the affected content. A public proof-of-concept exploit has been disclosed via Google Drive, and the vendor did not respond to responsible disclosure outreach, leaving no vendor-issued patch available at time of analysis. No active exploitation has been confirmed by CISA KEV.

Stored or reflected cross-site scripting in Eleveo Call Recording Software 9.7.0 allows an authenticated low-privilege user to inject arbitrary client-side script via the name or username parameter of the /callrec/roleAddAction.do endpoint. When a victim user - likely an administrator viewing role management pages - loads the affected page, the injected payload executes in their browser context. A public proof-of-concept exploit exists on Google Drive; the vendor did not respond to responsible disclosure, so no patch has been issued.

Cross-site scripting in light0011 CMS allows remote attackers to inject arbitrary JavaScript into chapter content pages by manipulating the `content` argument processed through PHP's `htmlspecialchars_decode()` function in the chapter template. The misuse of this function-which decodes HTML entities rather than encoding them-means user-supplied chapter content is rendered as raw HTML in victims' browsers. A public proof-of-concept is available via GitHub issue #8, and the project maintainer has not responded to the coordinated disclosure.

Stored cross-site scripting in Apache SkyWalking's Booster UI dashboard widget rendering (versions 10.2.0 through 10.4.0) allows an attacker with dashboard-edit access to inject persistent JavaScript that executes in the browser of any user viewing the affected dashboard. This is an incomplete remediation of CVE-2025-54057, meaning the original patch left residual unsanitized widget input paths. No public exploit code or active exploitation has been identified at time of analysis, though the prior CVE's public disclosure increases the likelihood of targeted research against the remaining surface.

Let me synthesize. Product: pfSense (Netgate pfSense Plus / pfSense CE). Product name: "pfSense". Key facts: XSS in captive_portal_status.widget.php, affects pfSense Plus <= 26.03 and pfSense CE <= 2.8.1. CVSS 5.4 AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. CWE-79. EPSS 0.26% (17th percentile). No KEV. Tags mention RCE — likely mislabeled/stretch (XSS → limited code exec in browser context). "N A" tag is noise. CPE is n/a — data quality flag possible: CPE missing. Hmm, the flag types are mislabeled_tag/wrong_vendor/wrong_product/missing_tag. Not "missing_cpe". I could flag "RCE" as mislabeled tag? The description says "execute arbitrary code" but it's XSS — the CWE is CWE-79, so "RCE" tag is arguably mislabeled. Hmm — but description itself says allows arbitrary code execution. I'd be careful. Maybe flag "RCE" mislabeled with medium/low confidence... Actually the rules say only emit flags when clearly wrong and verifiable. XSS in a captive portal widget page = script execution in victim's browser, not server RCE. CVSS vector C:L/I:L/A:N with S:U strongly implies no RCE. I think flagging "RCE" as mislabeled is defensible with medium confidence. Also "N A" tag — that's clearly a bad tag (from "n/a" vendor parsing). Could flag as mislabeled_tag target "N A" — but suggested? It's not a real tag. Hmm, "wrong_vendor"? The tag "N A" is a garbage placeholder. I'd flag it as mislabeled_tag with suggested null. Actually maybe better: type "mislabeled_tag", target "N A", suggested null, confidence high, reason "Placeholder 'N A' is an artifact of missing CPE vendor/product data, not a real tag." Also missing tags: "pfsense" would be a clearly applicable vendor/product tag. Suggested "pfsense". That seems high confidence and unambiguous. Also "netgate"? I'd emit missing_tag target "pfSense", suggested "pfsense". Hmm, but the instruction says emit missing_tag only when unambiguously implied — pfSense is the product; the tag list lacks it. Yes. Should I flag "PHP"? captive_portal_

Stored cross-site scripting in the pfSense dashboard RSS Widget allows an authenticated attacker to inject arbitrary JavaScript into the browsers of all authenticated users who view the dashboard. The attacker configures the RSS widget to point to an attacker-controlled feed whose title element contains a malicious payload; because pfSense previously rendered the feed title via `<?=$item->get_title()?>` without sanitization, the script executes in any victim session that loads the dashboard. Affected versions are pfSense Plus 26.03 and 25.11.1, and pfSense CE 2.8.1; no public exploit has been identified at time of analysis.

Reflected cross-site scripting in HubCore platform 14.1.1 allows unauthenticated remote attackers to inject arbitrary JavaScript via the `language` POST parameter on the `/loginController/doLogin` endpoint, with execution occurring in the victim's browser context. Because the vulnerable endpoint is the public-facing login page - requiring no prior authentication - an attacker who delivers a crafted login link can steal session tokens, impersonate the victim, or redirect users to phishing pages. Publicly available exploit code exists in a researcher's GitHub repository; the vulnerability is not in the CISA KEV catalog and EPSS is low at 0.23%.

Reflected cross-site scripting in EMX Tecnologia Gestao X Business Suite 8.4 and earlier enables unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL targeting the /Configuracao/Imagens.aspx endpoint. The root cause is insufficient validation of the mensagem query parameter, which is reflected directly into the HTTP response without sanitization, enabling session hijacking, credential theft, or forced browser-side actions against authenticated users of this Brazilian ERP/business management platform. No public exploit has been confirmed at time of analysis, and EPSS scoring at 0.16% (5th percentile) indicates low current exploitation probability.

Stored cross-site scripting in MOOS core-moos through 10.4.0 allows any MOOS publisher to inject script payloads into the MOOSDB HTTP monitoring interface. Because MOOS clients are inherently unauthenticated by protocol design, attackers with network access to a MOOS community can set variable names, values, source process names, or community names to contain HTML/script markup that is rendered unescaped in the operator's browser. The fix (PR #78) adds a comprehensive HTMLEscape() function covering all attacker-controlled database fields, plus a restrictive Content-Security-Policy header as a secondary control.

Reflected cross-site scripting in itsourcecode Online Medicine Delivery System 1.0 allows an authenticated remote attacker to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `location` parameter of the `/index.php?q=orderdetails` endpoint. The attacker must induce a logged-in user to follow a crafted URL, at which point the unsanitized parameter value is reflected directly into the page response. A public proof-of-concept writeup on GitHub confirms exploitability; no KEV designation applies.

Stored cross-site scripting in Apache Allura allows authenticated repository contributors to inject persistent JavaScript payloads through code repository content, executing in the browsers of any user who subsequently views the affected forge pages. All releases through 1.20.0 of this open-source software forge platform are vulnerable. The Apache Security Team released version 1.21.0 in September 2026 to address this issue, as credited to researcher n0mi1k via the oss-security mailing list; no public exploit code has been identified at time of analysis.

Stored cross-site scripting via markdown HTML processing in Apache Allura through 1.20.0 permits an authenticated attacker to inject persistent malicious scripts that execute in the browsers of other users who view the compromised content - wikis, ticket comments, blog posts, or discussion threads. The vulnerability stems from insufficient sanitization of HTML embedded within markdown-rendered content across the forge platform's collaborative features. The Apache Software Foundation has released version 1.21.0 as the fix; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in LearnPress WordPress Plugin before 4.4.6 allows authenticated Instructor-role users to inject persistent JavaScript through quiz question answer title fields, with payloads executing in the browsers of any user who views the affected quiz - including administrators. The unescaped HTML sink means stored payloads persist until patched, making every quiz viewer a potential victim regardless of their privilege level. No public exploit or active exploitation (CISA KEV) is confirmed at time of analysis, but the admin-targeting capability meaningfully elevates practical impact beyond the medium CVSS score.

Stored Cross-Site Scripting in Magepeople Inc.'s Booking and Rental Manager WordPress/WooCommerce plugin (all versions through 2.7.7) allows authenticated low-privileged users to inject persistent malicious scripts into pages rendered by the application. When a higher-privileged user such as an administrator subsequently views the affected page, the stored payload executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

DOM-Based XSS in WPKoi Templates for Elementor (WordPress plugin) versions through 3.7.2 allows a low-privileged authenticated attacker to inject malicious scripts that execute in victims' browsers when they view affected pages. The flaw stems from insufficient neutralization of user-supplied input during web page generation, enabling script injection into the DOM without server-side reflection. No public exploit or CISA KEV listing has been identified at time of analysis, but Patchstack has publicly documented the vulnerability, lowering the bar for exploitation.

Unauthenticated cross-site scripting in WP Statistics WordPress plugin versions up to and including 14.16.11 allows remote attackers without any account to inject malicious JavaScript that executes in the browser of an authenticated user who visits the affected page. The CVSS scope change (S:C) reflects that injected scripts run in the victim's browser security context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in VillaTheme's Product Variations Swatches for WooCommerce plugin (versions <= 1.1.18) allows authenticated subscribers to inject malicious JavaScript that executes in the browsers of higher-privileged users, such as administrators, when they view affected content. The flaw stems from insufficient input sanitization or output escaping of subscriber-controllable data processed by the plugin's variation swatch rendering logic. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though the low authentication bar - subscriber role - expands the potential attacker pool on any store permitting public registration.

Stored or reflected Cross-Site Scripting in the Graphene WordPress theme (by silverks) version 2.9.4 and earlier allows a low-privileged Subscriber-level user to inject malicious JavaScript that executes in the browser of any higher-privileged user who views the affected content. The scope change (S:C) in the CVSS vector confirms impact extends beyond the attacker's own session to other users, enabling session hijacking, credential theft, or privilege escalation against site administrators. No public exploit code or active exploitation has been identified at time of analysis, but Patchstack has reported and documented the issue.

Stored XSS in MISP's dashboard ButtonWidget allowed an authenticated user to persist arbitrary URLs - including `javascript:` scheme values - through the `updateSettings()` whole-layout save endpoint, which lacked the widget-config validation that `updateWidgetSettings()` already enforced. A malicious URL stored via this unguarded path could reach client-side rendering or navigation, potentially executing script in the victim's MISP browser session and enabling actions or data access at that user's privilege level. Practical exploitability was substantially reduced by MISP's existing render-time URL validation, making this a defense-in-depth persistence-layer gap rather than a confirmed end-to-end XSS bypass; no public exploit or active exploitation has been identified.

Reflected XSS in MISP's event attribute filtering query builder allows an unauthenticated attacker to execute arbitrary JavaScript in the security context of any authenticated MISP user who follows a crafted viewEventAttributes URL. The taggedAttributes and galaxyAttachedAttributes URL parameters are serialized via PHP's JsonTool::encode() with JSON_UNESCAPED_SLASHES and embedded raw into a <script> element; an attacker-controlled </script> sequence in either parameter breaks out of the script block and injects arbitrary HTML or JavaScript. Successful exploitation could yield session credential theft, unauthorized data modification, or any other action permitted by the victim's MISP role. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in pfSense Plus before 26.07 and CE before 2.9.0 allows an authenticated attacker holding the Firewall: Schedules: Edit privilege to inject arbitrary JavaScript via the schedule description field in /firewall_schedule_edit.php. The description is written to backend storage without HTML sanitization, and when rendered in /firewall_rules.php only single-quote escaping is applied - insufficient to prevent double-quote-based breakout from an HTML attribute context. Any pfSense administrator with the Firewall: Rules privilege who views the rules list while the malicious schedule is attached will silently execute the attacker's payload, enabling session token theft or in-browser privilege escalation within the firewall management interface.

Stored cross-site scripting in pfSense Plus and pfSense CE allows an authenticated attacker holding the 'Firewall: Rules: Edit' privilege to inject arbitrary JavaScript via the `descr` parameter in `/firewall_rules_edit.php`. The injected payload is written to the pfSense XML configuration with only backslash-escaping applied and no HTML sanitization, then rendered unencoded in the firewall log table at `/status_logs_filter.php`, executing in the browser of any administrator holding the 'Status: Logs: Firewall' privilege who views the affected entries. Patches are available in pfSense Plus 26.07 and pfSense CE 2.9.0; no public exploit or CISA KEV listing has been identified at time of analysis.

Stored XSS in pfSense Plus before 26.07 and pfSense CE before 2.9.0 allows an authenticated user holding only the Status: Monitoring privilege to inject arbitrary JavaScript via unsanitized graph configuration POST parameters in /status_monitoring.php. The payload is persisted in the global pfSense XML configuration file and rendered unsanitized into a JavaScript string context, meaning it executes automatically in the browser of every subsequent visitor to the Status: Monitoring page - including full administrators. Vendor-released patches exist in pfSense Plus 26.07 and CE 2.9.0; no public exploit code has been identified at time of analysis.

Reflected cross-site scripting in the Kriesi Enfold WordPress theme through version 8.0 allows unauthenticated remote attackers to inject arbitrary JavaScript into the browsers of victims who click a crafted URL. The S:C scope change in the CVSS vector confirms the script executes in the victim's browser context, enabling session theft, credential harvesting, or forced actions under the victim's identity. No public exploit or active exploitation confirmed at time of analysis; reported by Patchstack.

Reflected XSS and open-redirect flaws in J2Store, a Joomla e-commerce extension by j2commerce.com, allow unauthenticated network attackers to inject malicious scripts into victim browsers via the `filter_tag`, `pricefrom`, and `priceto` parameters across all 3.x releases through 3.3.21 and all 4.x releases through 4.1.6. Four task handlers additionally accept base64-encoded redirect URLs without destination-host validation, enabling phishing attacks that abuse the shop's trusted domain to mislead customers into visiting attacker-controlled sites. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Reflected cross-site scripting in AVideo's userLogin.php allows unauthenticated network attackers to execute arbitrary JavaScript in a victim's browser by supplying a crafted cancelUri parameter. The isSafeRedirectURL validation function restricts only the URL protocol, leaving HTML metacharacters unchecked; a relative URL containing embedded quotes and event handlers bypasses the check entirely and is reflected verbatim into the href attribute of the Cancel button. Exploitation requires a victim to interact with the Cancel button after following a malicious link, placing this in the phishing-dependent reflected-XSS risk class.

Reflected XSS in AVideo's videoEmbeded.php allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by delivering a crafted embed URL. The `link` GET parameter is echoed verbatim inside an HTML comment with no escaping, so injecting the sequence `-->` closes the comment context and enables arbitrary script injection. No active exploitation has been confirmed per CISA KEV, but the zero-friction delivery model - a victim clicking a malicious embed link - makes this a realistic phishing-chain enabler against authenticated AVideo users.

Stored XSS in the Divi WordPress theme's Social Media Follow module allows authenticated Contributor-level users to inject arbitrary scripts via the `skype_url` shortcode attribute, executing against any site visitor who interacts with the poisoned element. The flaw stems from a three-part sanitization failure: the field is excluded from the URL-option whitelist, the renderer explicitly bypasses `esc_url()` for Skype URLs, and the fallback `sanitize_text_field()` preserves quote characters enabling single-quoted HTML attribute breakout. Versions up to and including 4.27.6 are affected; a fix was released in 4.27.7. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in GutenKit Page Builder (versions ≤2.4.4) allows authenticated Contributor-level WordPress users to inject persistent JavaScript via the 'postBodyCss' parameter, which executes in victim browsers whenever an affected page is visited. The vulnerability stems from insufficient sanitization of CSS body input before storage and inadequate output escaping on render, earning a CVSS 6.4 with scope-change (S:C) reflecting the browser-context boundary crossing. No public exploit or KEV listing is confirmed at time of analysis, but Contributor-level access is commonly available on multi-author WordPress sites, making this a realistic intra-site privilege escalation vector.

Cross-site scripting in Dify 1.13.0's WebApp Sign-In component allows remote attackers to inject malicious JavaScript by manipulating the redirect_url parameter consumed by the router.replace() function. The attack requires passive victim interaction with a crafted sign-in URL and low attacker privileges, limiting the immediate impact to integrity modification within the browser context. A public proof-of-concept exploit exists, and the vendor did not respond to coordinated disclosure, leaving no official patch available at time of analysis.

Cross-site scripting in Dify 1.13.0 allows unauthenticated remote attackers to inject arbitrary client-side script via the redirect_url argument processed by the router.replace function in the Splash Layout component. Exploitation requires a single user interaction - the victim must follow a crafted link - but no account or prior access to the Dify instance is required. A public proof-of-concept exploit was disclosed on GitHub Gist on or around 2026-07-05; the vendor did not respond to the coordinated disclosure, and no confirmed patch is available at time of analysis.

Stored cross-site scripting in the SEOWriting WordPress plugin (through version 1.12.5) allows authenticated Contributor-level users to inject arbitrary JavaScript that executes in the browser session of higher-privileged users - Editors or Administrators - who view or preview the affected post. The root cause is a misconfigured KSES allowlist that explicitly whitelists the `onload` event attribute on `iframe` elements, bypassing WordPress's built-in content sanitization. A publicly available proof-of-concept confirms the attack path is reproducible; the vulnerability is not currently listed in the CISA KEV catalog, suggesting active exploitation has not been widely observed at time of analysis.

Stored cross-site scripting in Jenkins update-center2 3.18.3 and earlier allows an attacker who can submit a plugin for hosting to inject malicious script into plugin download index pages by embedding payloads in plugin names, descriptions, or version metadata. Any user who browses the affected plugin index page triggers the XSS payload in their browser session. No exploitation has been confirmed (SSVC: none, no KEV), and no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in Xpro Addons for WordPress (before 1.7.4) allows any user holding the Contributor role or higher to inject malicious JavaScript through insufficiently escaped widget settings, which are then rendered unsanitized within HTML attributes on the front end. When a privileged user such as an administrator views a page containing the compromised widget, the attacker's payload executes in their browser session. A publicly available exploit has been documented by WPScan; no CISA KEV listing is present, but the low barrier to exploitation (any registered Contributor) makes this a meaningful risk on multi-author or membership WordPress sites.

Stored Cross-Site Scripting in the All in One SEO WordPress plugin before version 5.0.0.1 enables users holding the contributor role or above to inject persistent malicious scripts into post content that execute in the browser of any higher-privileged user who subsequently edits that post. The attack effectively allows a low-trust contributor to hijack administrator sessions, enabling full site compromise. A publicly available proof-of-concept from WPScan exists, and the plugin's broad deployment across millions of WordPress installations amplifies aggregate exposure.

Stored Cross-Site Scripting in Icegram Express WordPress plugin versions before 5.8.6 allows administrator-level users to inject malicious scripts into HTML attributes via the list description setting. When another user subsequently loads the affected page, the injected payload executes in their browser, enabling session hijacking, credential capture, or unauthorized actions on their behalf. A publicly available proof-of-concept exploit has been confirmed by WPScan, though real-world impact is substantially constrained by the high-privilege prerequisite required to plant the payload.

Stored cross-site scripting in the Drupal Entity Browser contributed module (versions prior to 2.16.0) allows a high-privileged authenticated attacker to inject persistent malicious script payloads that execute in victims' browsers when affected pages are loaded. The scope change (S:C in the CVSS vector) confirms the injected script crosses into the victim's browser context, enabling session hijacking or credential theft against users who view affected content. No public exploit code or active exploitation has been identified; the vendor (Drupal Security Team) has released a patched version and published advisory SA-CONTRIB-2026-094.

Cross-site scripting in the Drupal Address Suggestion contributed module allows an authenticated administrator to inject persistent malicious JavaScript into pages served to other users. Affected versions span all releases from 0.0.0 through 1.0.24; version 1.0.25 resolves the issue per Drupal security advisory SA-CONTRIB-2026-103. No public exploit code or CISA KEV listing has been identified at time of analysis, and the high-privilege requirement substantially limits the realistic attacker pool.

Stored cross-site scripting in the Drupal Monster Menus contrib module (versions 0.0.0 through 9.5.3) allows malicious script payloads to be persistently injected into navigation or menu rendering contexts, executing in the browsers of subsequent authenticated visitors. The CVSS scope-change flag (S:C) confirms the attack crosses session boundaries, enabling session hijacking, credential theft, or further lateral movement within the Drupal application. No public exploit code has been identified at time of analysis, and Drupal's security team has released an advisory (SA-CONTRIB-2026-116) with a patch.

Stored cross-site scripting in the Drupal Slick Carousel contributed module (all releases before 2.1.0) allows injection of persistent malicious scripts into carousel-rendered content. Any authenticated user or visitor who loads a page containing the compromised carousel triggers script execution in their browser, potentially exposing session tokens and enabling unauthorized actions performed under the victim's identity. The Drupal Security Team has released a patch via sa-contrib-2026-117; no public exploit code or confirmed active exploitation has been identified at time of analysis.

Stored cross-site scripting in WCFM Marketplace (WordPress WooCommerce multivendor plugin) through version 3.8.2 allows authenticated contributors to inject persistent malicious JavaScript into marketplace content. When a higher-privileged user such as a site administrator or shop manager views the injected content, the payload executes within their browser session - enabling session hijacking, credential theft, or administrative actions performed on the attacker's behalf via the scope change. Reported by Patchstack; no public exploit code or active exploitation has been identified.

Stored cross-site scripting in the Gallery PhotoBlocks WordPress plugin (versions <= 1.3.4) allows authenticated contributors to inject malicious scripts into gallery content, which execute in the browsers of higher-privileged users such as editors or administrators who view the affected content. The scope change (S:C in the CVSS vector) reflects the cross-context impact: attacker-controlled script runs in the victim's authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and no KEV listing was found.

Stored XSS in Craft CMS 5.0.0-RC1 through 5.10.10 allows a malicious administrator to inject arbitrary JavaScript into the site name field, which executes in the browsers of other users who subsequently view control panel settings pages. The attack requires existing administrator-level credentials (PR:H per CVSS 4.0 vector) and passive user interaction to trigger, making it primarily a threat in multi-administrator deployments where one privileged account may be compromised or untrustworthy. Vendor-released patch is available at version 5.10.11; no public exploit or CISA KEV listing identified at time of analysis.

Stored Cross-Site Scripting in the Easy Waveform Player WordPress plugin (≤1.2.2) allows authenticated Contributor-level users to inject arbitrary JavaScript via the shortcode_easywaveformplayer() function due to missing input sanitization and output escaping. The payload persists server-side and executes in every visitor's browser upon page load, with scope change enabling cross-origin script execution. No public exploit or CISA KEV listing has been identified at time of analysis; a patch commit (changeset 3674516) is visible in the WordPress plugin SVN repository.

Stored Cross-Site Scripting in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) enables authenticated contributors to plant a `javascript:` URI in the `redirect_url` parameter of the `et_pb_contact_form` shortcode, which executes in any visitor's browser upon contact form submission. The flaw arises from using `esc_attr()` instead of `esc_url()` for sanitization and the parameter's absence from the `$url_options` URL-sanitization array, allowing the raw URI to reach client-side JavaScript that assigns it to `window.location.href`. No public exploit code or CISA KEV listing has been identified at time of analysis, but Divi's enormous deployment footprint makes this a meaningful aggregate risk despite the Contributor access prerequisite.

Stored Cross-Site Scripting in the Social Media Share Buttons & Social Sharing Icons WordPress plugin (versions before 3.0.1) allows users with the Contributor role or higher to inject persistent JavaScript payloads via unescaped post titles rendered inside inline event handlers on share buttons. Payload execution is deferred to site visitors who interact with those buttons - enabling session theft or full site compromise if an administrator triggers it. A publicly available proof-of-concept from WPScan exists; no active exploitation confirmed in CISA KEV at time of analysis.

Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin before version 4.7.19 enables any authenticated user holding the Author role or higher to plant a malicious JavaScript payload within a slider's before-label field. Because the plugin's bundled client-side script re-injects that label value into the DOM without sanitization, the payload executes automatically in the browser of every visitor - including administrators - who views the affected slider. A publicly available proof-of-concept was published by WPScan; vendor-released patch version 4.7.19 is available, and no active exploitation has been confirmed in the CISA KEV catalog.

Stored cross-site scripting in the Ultimate Before After Image Slider & Gallery WordPress plugin (all versions before 4.7.19) allows users holding the Author role or above to embed a persistent browser payload in a slider's after-label field, which executes in every visitor's browser - including site administrators - when the slider is rendered. The plugin's bundled client-side script re-injects the stored label value directly into the DOM without HTML encoding. A publicly available exploit exists per WPScan, making this a practical privilege-escalation path on any WordPress site granting Author access to untrusted users.

Stored XSS in Elegant Themes' Divi WordPress theme (all versions through 4.27.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript payloads that execute against any visitor of an affected page. The vulnerability chains two compounding flaws: the save-time sanitization filter `et_builder_sanitize_dynamic_content_fields()` only recognizes the modern `@ET-DC@...@` marker format, while the rendering engine silently accepts and converts a legacy JSON format, bypassing sanitization entirely; a second flaw in the `post_meta_key` resolver skips `wp_kses_post()` output encoding when `enable_html` is set to `on`, feeding raw `get_post_meta()` output directly into page HTML. A patch was released in version 4.27.7 per the Divi changelog. No public exploit has been identified at time of analysis.

Stored cross-site scripting in OpenCart 4.1.0.3 and 4.1.0.4 allows an authenticated customer to inject malicious script content via the `firstname` field in `catalog/controller/account/edit.php`, which executes in the browser of any user (likely an admin or staff member) who triggers the Autocomplete Workflow over customer data. A public proof-of-concept is available on GitHub. No vendor patch exists - the vendor did not respond to the coordinated disclosure.

Stored cross-site scripting in OpenCart 4.1.0.3 and 4.1.0.4 allows an authenticated low-privilege user (e.g., a customer account) to inject malicious script into the address_1 field via the Autocomplete Workflow in catalog/controller/account/address.php, which then executes in the browser of any user who subsequently views the stored address data. A public proof-of-concept exploit is available on GitHub. The vendor did not respond to the coordinated disclosure, so no official patch has been issued.

Stored cross-site scripting in NocoBase's rich text field read renderer allows any authenticated user with record-creation permissions to inject persistent malicious HTML into the application's collection API, executing arbitrary JavaScript in the browsers of all users who subsequently view the affected record. The vulnerable component is the ReadPretty renderer (packages/core/client/src/schema-component/antd/input/ReadPretty.tsx), which fails to sanitize event handlers from stored rich text values before rendering them. No public exploit code has been identified at time of analysis, and the issue is not listed in CISA KEV.

Stored cross-site scripting in WWBN AVideo's Live_schedule module allows a low-privileged attacker with streaming permission to persist unsanitized JavaScript via the setTitle() and setDescription() POST endpoints. The injected payload is served to any user - including unauthenticated visitors - who loads remindMe.php, giving the stored payload a wider execution surface than the injection privilege level implies. No public exploit code has been identified at time of analysis, and the CVSS 4.0 score of 5.1 (Medium) reflects this split: low-privilege write, passive-interaction trigger, and limited per-browser impact.

Stored XSS in the Apache Spark History Server (versions 3.0.0 through 3.5.7) allows a user with Spark job submission rights to inject unsanitized HTML/JavaScript into the History Server web UI via the application name field (spark.app.name), which executes in the browser of any higher-privileged user who subsequently views that job's history page. Apache rates this low severity due to layered prerequisites - the attacker must hold job submission rights and socially engineer an administrator into visiting the History Server. No public exploit has been identified at time of analysis; the vendor-released fix is Spark 3.5.8.

Stored XSS in sanitize-html versions 1.9.0 through 2.17.6 allows authenticated low-privileged users to inject executable JavaScript via SVG SMIL animation elements that survive the library's scheme-policy sanitization. The sanitizer validates the `values` attribute as a single flat URL, missing that `attributeName="href"` gives `values` URI-list semantics under SVG SMIL; a payload of `#safe;javascript:alert(1)` passes the scheme check on its leading fragment while the `javascript:` entry survives intact. When a victim clicks the rendered link, the browser resolves the later entry and executes script in the application's origin. A working proof-of-concept is publicly disclosed in the GHSA advisory; no CISA KEV listing at time of analysis.

Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. Exploitation requires two deliberate user actions - opening the crafted email and invoking the Add Local Contacts function - limiting opportunistic mass exploitation; no public exploit has been identified at time of analysis.

Cross-site scripting in SVGO's opt-in removeScripts plugin allows XSS payloads embedded inside SVG foreignObject elements to survive optimization unchanged. Applications that process attacker-supplied SVG through SVGO with this plugin enabled and then serve the output in a browser context are exposed: event-handler attributes, srcdoc iframe payloads, and executable URL schemes (javascript:, vbscript:, data:text/html) in action/data/formaction/href/src attributes all pass through unmodified. No public exploit is identified at time of analysis; fixed in SVGO 2.8.4, 3.3.5, and 4.1.0.

Cache poisoning and stored XSS in Hono (all versions before 4.13.5) stem from the framework's query helpers treating a literal `#?` sequence as a query string, creating a parser discrepancy between the application and every other layer - browsers, reverse proxies, WAFs, access logs, and validation middleware - that correctly ignores fragments. The Cache Middleware compounded this by stripping fragments when building cache keys, so a response shaped by fragment-injected parameters gets stored and served to subsequent users under a key that omits those parameters entirely. No public exploit code has been identified at time of analysis, and exploitation is gated by the requirement that the runtime and intermediary pass raw `#` characters through to the application.

Reflected cross-site scripting in the HPE Networking Fabric Composer web management interface allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim administrator's browser by tricking them into following a crafted URL. The CVSS Scope:Changed metric confirms the injected script executes across the browser security boundary, enabling session token theft, credential harvesting, or unauthorized administrative actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in pulpcore's content serving layer allows authenticated users with file upload permissions to execute arbitrary JavaScript in the browsers of other users. When pulpcore uses local filesystem storage, uploaded files are served with their original MIME types (e.g., text/html, image/svg+xml) and without a Content-Disposition: attachment header, causing browsers to render the files inline within the host application's origin instead of prompting a download. This flaw affects Red Hat Ansible Automation Platform 2, Red Hat Satellite 6, and Red Hat Update Infrastructure 4 and 5; no public exploit code or confirmed active exploitation is identified at time of analysis.

Stored cross-site scripting vulnerabilities in Rockwell Automation's ArmorStart® LT distributed motor controller expose industrial operators to persistent script injection via the device's embedded web management interface. Per the CVSS 4.0 AV:N/PR:N vector, unauthenticated remote attackers can inject malicious scripts that are persisted on the device and execute in the browsers of any operator or engineer who subsequently accesses affected pages - enabling session hijacking, credential theft, or display of falsified operational data. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the ICS context meaningfully elevates practical risk beyond the moderate base score.

Stored Cross-Site Scripting in WP Recipe Maker Premium for WordPress (all versions ≤ 10.5.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'wprm-call-to-action' shortcode's unsanitized attributes. Every subsequent visitor to an injected page executes the attacker's script in their browser, enabling session hijacking, credential harvesting, or privilege escalation to administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Firefox's DOM Navigation component allows a remote unauthenticated attacker to inject and execute script content across security origins when a victim visits a specially crafted webpage. The vulnerability is classified CWE-79 with scope change (S:C), indicating potential cross-origin impact beyond the attacked page. Mozilla patched this in Firefox 155 and Firefox ESR 153.2, with coverage across multiple advisory tracks (mfsa2026-82, -85, -86, -88). No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in LibreNMS through 26.2.0 enables attackers to inject persistent malicious JavaScript via SNMP-sourced data fields - including BGP peer descriptions, VRF names, process data, and SLA tags - that execute in the context of authenticated administrators browsing legacy PHP routing and device pages. The dual attack path (device management access within LibreNMS, or network-level enrollment of a rogue SNMP device) means exploitation is not strictly confined to privileged insider accounts. Successful exploitation yields session credential theft and CSRF token exfiltration, giving the attacker effective administrative control over the monitoring platform. No public exploit has been identified at time of analysis.

Stored cross-site scripting in LibreNMS before 26.5.0 allows an attacker who controls any SNMP-monitored network device to inject persistent JavaScript into the LibreNMS web interface via poisoned VRF-related SNMP fields. The injected payload executes in the browser of any LibreNMS user who views VRF display pages, enabling session hijacking, credential theft, or UI redressing. No public exploit has been identified at time of analysis, though the attack surface (SNMP-fed stored XSS with network-facing ingestion) is straightforwardly exploitable for anyone with access to a monitored device.

Stored cross-site scripting in LibreNMS 26.4.0 and below allows an authenticated administrator to inject arbitrary HTML/JavaScript into graph description configuration keys, which then execute in the browsers of every authenticated user who views the affected graph type. The vulnerable sink is `includes/html/pages/graphs.inc.php:194`, where `LibrenmsConfig::get()` output is echoed without `htmlspecialchars()`. A public proof-of-concept is documented in the GHSA advisory; no active exploitation is confirmed via CISA KEV. The vendor released a fix in version 26.7.0.

Stored Cross-Site Scripting in WPBakery Page Builder for WordPress (versions through 8.7.4) allows authenticated attackers with subscriber-level access to persistently inject arbitrary JavaScript into pages viewed by any site visitor. The vulnerability stems from a sanitization bypass: the wp_kses_post function strips HTML tags but cannot neutralize base64-encoded payloads - which appear as plain alphanumeric text - and the vc_raw_html shortcode template subsequently decodes and echoes that content without escaping at render time. No public exploit code or CISA KEV listing has been identified at the time of analysis, though the subscriber-level access barrier is low on many WordPress sites that permit open registration.