Cross-Site Scripting

Stored cross-site scripting in LimeSurvey Community Edition 7.0.5 allows a low-privileged authenticated user to inject persistent malicious scripts through the replacement-fields dialog in the administrative question editor. When a higher-privileged user - such as an administrator - subsequently views or edits the affected question, the payload executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though Fluid Attacks has published a dedicated advisory.

HTML injection in OpenSTAManager versions 2.10.1 and earlier allows an authenticated high-privilege user to embed arbitrary HTML - including redirect anchor tags - into the user group name field, which is then rendered unsanitized to all users who view the group assignment interface in modules/utenti/edit.php. The attack enables phishing and open-redirect scenarios targeting other application users without requiring any special server configuration. Publicly available exploit code exists (documented in GHSA-crx4-7mmq-j74j with screenshots); this CVE is not in CISA KEV, and EPSS data was not provided.

Stored Cross-Site Scripting in the Greenshift animation and page builder blocks WordPress plugin (versions up to and including 12.8.9) allows authenticated attackers holding at minimum Contributor-level access to inject persistent malicious JavaScript via the plugin's customapi action handler. The root cause is unsanitized API response content written directly to the DOM through innerHTML in two JavaScript modules within the plugin. No active exploitation has been confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in the Reviews and Rating - Google Reviews WordPress plugin (all versions through 5.10) allows authenticated Contributors to inject arbitrary JavaScript via the wp_display() shortcode handler's unsanitized html_tags parameter. The malicious script persists server-side and executes in the browsers of any users who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. No confirmed active exploitation or public exploit code has been identified at time of analysis; the primary risk driver is the low privilege bar required - Contributor-level access - which is commonly available on multi-author or open-registration WordPress sites.

Stored cross-site scripting in the Betheme theme for WordPress (all versions through 28.4) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts into pages via unsanitized attributes of the 'icon_box_2' shortcode. The injected payload executes in the browser of any user who subsequently loads the affected page, including administrators, enabling session hijacking or privilege escalation. No public exploit code has been identified and the vulnerability carries no CISA KEV listing at time of analysis, but the low access barrier in multi-author WordPress environments elevates practical risk.

Stored Cross-Site Scripting in the Gutenverse FSE blocks plugin for WordPress (all versions through 4.0.2) enables authenticated attackers holding Contributor-level accounts or higher to embed persistent malicious JavaScript into page content via multiple vulnerable block types. Because the injected payload executes automatically in any visitor's browser session, the attack surface extends beyond the contributing user to all site visitors and administrators who load the affected pages. Exploitation requires no public exploit kit - the attack is straightforward for any party who can author content on the target WordPress site, and the CVSS scope change (S:C) reflects the cross-context browser impact.

Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1066) permits any authenticated Contributor-role user to inject arbitrary JavaScript payloads via unsanitized widget settings that are rendered unescaped inside HTML attributes. When a higher-privileged user such as an administrator previews or views the crafted content, the payload executes in their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. A public proof-of-concept is available via WPScan; however, no public exploit identified at time of analysis maps to confirmed active exploitation, and EPSS sits at 0.18% (8th percentile).

Stored XSS via unrestricted file upload in tamguo 1.5.3 allows authenticated network attackers to execute arbitrary JavaScript in victims' browsers. The /uploadFile and /imgUpload endpoints in FileUploadController.java and UEditorController.java accept arbitrary HTML and JavaScript files without content-type or extension validation, enabling persistent script injection. No public exploit identified at time of analysis and EPSS probability is 0.14% (3rd percentile), indicating low current exploitation pressure.

Cross-site scripting across three components of Cockpit CMS (item.php, field-select.js, and tags.js) enables remote attackers to inject and execute malicious JavaScript within authenticated users' browser sessions in versions 2.13.5 and prior. The CVSS Scope:Changed metric signals that impact extends beyond the vulnerable component - successful exploitation against an authenticated administrator can result in session hijacking, credential theft, or persistent content manipulation within the CMS. No active exploitation is confirmed (no CISA KEV listing; EPSS 0.30% / 23rd percentile), though a researcher repository at github.com/Securify-AI/CVE-2026-39275 exists as a potential POC reference.

Cross-site scripting in Drupal Core across all maintained 11.x release branches allows network-accessible unauthenticated attackers to inject malicious scripts into rendered web pages, with impact occurring in victims' browser contexts upon user interaction. High attack complexity (AC:H) constrains opportunistic exploitation, and all signals - EPSS at 0.15% (4th percentile), SSVC exploitation status of none, no KEV listing, and no public exploit code - converge on a low-urgency posture. Vendor patches are available for the 11.3.x and 11.4.x branches via Drupal SA-CORE-2026-011, while Drupal 11.2.x and earlier receive no fix as an end-of-life branch.

Stored XSS in Drupal Core allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other site visitors, including administrators. The vulnerability spans multiple Drupal release trains - 10.x through 10.6.x, and all 11.0.*, 11.1.*, and 11.2.* branches - and is addressed in patched releases 10.6.13, 11.3.14, and 11.4.4 per the vendor advisory SA-core-2026-012. No public exploit code has been identified at time of analysis, and CISA SSVC classifies exploitation as none with non-automatable attack paths, placing this at moderate real-world priority despite scope change in the CVSS vector.

Stored XSS in the Drupal Media Folders contributed module (versions 0.0.0 through 1.0.8) allows network-accessible injection of persistent malicious scripts that execute in the browsers of users who subsequently view affected media folder pages. The CVSS scope change (S:C) confirms the payload crosses the application security boundary into the victim's browser session, enabling session hijacking or privilege escalation against authenticated users including administrators. No active exploitation has been confirmed - no CISA KEV listing, no public exploit code, and an EPSS of 0.15% (4th percentile) - and a vendor patch is available via Drupal security advisory SA-contrib-2026-080.

Reflected XSS in the Drupal Search API Autocomplete contributed module (versions 0.0.0 through 1.12.0) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in the context of victims' browsers when they are socially engineered into clicking a crafted URL. The CVSS scope change (S:C) confirms the injected script executes outside the application's security zone - in the victim's browser - enabling session token theft or authenticated action hijacking. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is available via Drupal Security Advisory SA-CONTRIB-2026-082.

Stored XSS in GazellePW (GazellePosterWall) allows authenticated low-privilege users to inject persistent JavaScript via a crafted subtitle filename, which is stored during upload and rendered unsanitized in the subtitle deletion page. A public exploit writeup (snaacky.com) documents a 1-click chain leveraging this flaw to achieve complete GazellePW database compromise, substantially elevating the practical impact beyond the CVSS 5.4 Medium base score. No public exploit confirmation via CISA KEV exists, but the availability of a detailed public exploit chain warrants prioritized remediation on any instance where untrusted authenticated users can upload subtitles.

Stored XSS in GazellePW's forum reward comment system allows network-accessible attackers to inject persistent JavaScript payloads into the `data-tooltip` attribute of forum thread views, which Tooltipster then renders as live HTML in victims' browsers. The vulnerable endpoint is `/forums.php?action=ajax_get_jf` (parameter `c`), confirmed at commit 86c4bedf727691b5a97af42a4864869d18446449 of the Mosasauroidea repository. A publicly referenced write-up claims this can be chained for complete GazellePW database compromise, though that escalation path has not been independently verified or confirmed by CISA KEV.

Stored cross-site scripting in GazellePW's custom bonus title feature allows authenticated users with low privileges to inject persistent JavaScript payloads that execute in the browsers of other users - including administrators - who view bonus management pages. Affected is a specific commit (86c4bedf) of the GazellePosterWall PHP application. A public exploit writeup at snaacky.com describes a 1-click chain leveraging this and related issues to achieve complete database compromise, significantly elevating real-world impact beyond the base CVSS score of 5.4. No public KEV listing; EPSS is low at 0.29%, but the published exploit chain warrants elevated attention for any operator of this software.

Stored cross-site scripting in GazellePW's torrent remaster custom title feature allows authenticated tracker members to inject persistent JavaScript that executes in every subsequent visitor's browser. The unsanitized `remaster_custom_title` parameter is written to the database through both upload and edit code paths (Upload.php, takeedit.php, torrents.class.php) and rendered without encoding, with CVSS Scope Changed confirming cross-user impact. A publicly referenced blog post at snaacky.com describes a 1-click exploit chain leveraging this flaw for complete GazellePW database compromise, meaningfully elevating the practical risk above the base CVSS 5.4 score. No public exploit has been confirmed by CISA KEV, and EPSS sits at 0.30% (22nd percentile), consistent with a niche deployment target.

Stored XSS in GazellePW (GazellePosterWall) commit 86c4bedf allows low-privileged authenticated users to inject arbitrary JavaScript through the avatar_mouse_over_text parameter in the donor feature, with the payload persisting in storage and executing in victims' browsers when they hover over the attacker's avatar tooltip. CVSS 5.4 (Scope: Changed) reflects cross-user impact, meaning the stored payload can target administrators or other members of the tracker platform. A public exploit chain writeup at snaacky.com describes a 1-click exploit leveraging GazellePW vulnerabilities to achieve complete database compromise, elevating the practical severity beyond the base CVSS score alone.

Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject malicious client-side scripts via the 'Success' argument in /admin/sumit_form.php. The administrative panel endpoint fails to sanitize user-supplied input before rendering it in the browser response, enabling script injection targeting any user - likely an administrator - who follows a crafted URL. A proof-of-concept exploit has been publicly disclosed on GitHub, though no confirmed active exploitation or CISA KEV listing exists at time of analysis.

Stored cross-site scripting in Ekushey Project Manager CRM allows a malicious or compromised administrator to inject arbitrary HTML and script into the application's login page, which then executes silently in the browser of every unauthenticated visitor who loads that page - including users about to submit their credentials. The vulnerability persists until the system name setting is corrected, and the payload runs within the CRM's own origin, co-located with the credential input fields. A public proof-of-concept exists on GitHub (LindHunt/CVE-2026-26211); no CISA KEV listing or vendor patch has been identified at time of analysis.

Stored cross-site scripting in Ech0 before 4.4.3 allows authenticated administrators to upload SVG or HTML files containing arbitrary JavaScript that executes in the application origin when accessed by any user, enabling session hijacking and credential exfiltration. The file upload handler at internal/service/file/file.go trusts the client-supplied multipart Content-Type header without server-side magic byte detection or extension validation, and SVG uploads are permitted in the default AllowedTypes configuration without any bypass required. Uploaded files are served publicly without authentication via a gin.Static route, meaning any user - authenticated or not - who visits the file URL triggers execution. Vendor-released patch 4.4.3 is available; no public exploit has been identified at time of analysis.

Stored XSS in Ech0 before 4.7.3 allows admin-privileged attackers to inject executable JavaScript into the public RSS/Atom feed via unescaped tag names or raw HTML markdown content. The payload persists in the database and executes when RSS subscribers open the feed in clients that render Atom `<summary type="html">` as HTML, affecting anonymous and authenticated subscribers without further attacker interaction. No public exploit code and no CISA KEV listing exist at time of analysis; the admin-only injection prerequisite substantially constrains real-world risk.

Stored Cross-Site Scripting in Ultimate Member WordPress plugin (all versions ≤ 2.12.1) allows authenticated attackers with subscriber-level access to plant persistent JavaScript via textarea profile fields with HTML support, exploiting a DOM gadget where pickadate.js concatenates stored id attribute values into the DOM via jQuery .html(). The scope change (S:C) means injected scripts execute in any visitor's browser on profile page load without additional interaction, enabling session theft, credential harvesting, or malicious redirects against administrators and regular users alike. No public exploit code has been identified at time of analysis, but the Wordfence report includes direct code-level references that materially reduce reproduction difficulty; an upstream fix commit exists.

Stored XSS in the eCommerce Product Catalog WordPress plugin (≤3.5.10) by implecode allows any authenticated contributor to persist malicious JavaScript via the 'style' shortcode attribute, bypassing WordPress's save-time wp_kses_post sanitization because the payload is stored inside shortcode brackets containing no HTML tags, with dangerous markup generated only at render time by the shortcode handler. Every subsequent visitor to an injected page executes the attacker's script in their browser context, enabling session hijacking, credential theft, or malicious redirects against administrators and customers alike. No public exploit code has been identified at time of analysis and the CVE is not listed in the CISA KEV catalog, but upstream changeset 3656358 confirms a fix has been committed.

Reflected XSS in AshAuthentication's confirmation and magic link interaction pages allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by crafting a malicious GET URL. Versions 4.8.0 through 4.14.1 and 5.0.0-rc.0 through 5.0.0-rc.12 of this Elixir framework authentication library embed user-supplied request parameters verbatim into hidden HTML form inputs using unescaped EEx template expressions, and since the vulnerable accept handlers are served over GET, simply loading the crafted link is sufficient - no form submission or prior session is required. No public exploit code has been independently identified at time of analysis, though the attack is trivially constructable from the public advisory and commit diff alone.

Stored Cross-Site Scripting in TranslatePress (WordPress plugin by cozmoslabs) versions through 3.2.6 allows authenticated attackers with subscriber-level access to inject persistent JavaScript via approved comment body content rendered in the Translation Editor's Strings Dropdown. The payload executes in the browser of any user - typically an administrator or editor - who subsequently opens the affected translation editor interface, creating a reliable subscriber-to-admin privilege escalation path through session hijacking or unauthorized administrative action. No confirmed active exploitation or public POC is identified at time of analysis; a vendor-released patch exists as version 3.3.

Stored Cross-Site Scripting in MetForm for WordPress (all versions through 4.1.8) allows authenticated contributors to permanently inject arbitrary JavaScript into pages via the 'mf_form_id' Elementor widget setting, exploiting two independent filter bypass paths. The payload evades Elementor's save-time wp_kses_post filter because it contains no HTML tags, and MetForm's own str_replace logic transforms script-tag constructs into executable JavaScript template literals - providing a second delivery route. Any visitor loading an injected page has the script execute in their browser context, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the tagDiv Composer WordPress plugin (all versions through 5.4.5) allows authenticated attackers with Contributor-level access to persist arbitrary JavaScript in WordPress post content that executes in the browsers of any user who views the affected page. The exploit abuses a base64-encoding bypass in the vc_raw_html shortcode: WordPress's save-time wp_kses_post() sanitizer never sees the dangerous tags because they are encoded as innocuous base64 text, and the vc_raw_html::render() method decodes and emits the content unescaped at render time. No public exploit is identified at time of analysis, but the technique (base64-bypass of wp_kses_post) is a well-understood class in the WordPress ecosystem and the barrier to exploitation for authenticated users is low.

Stored Cross-Site Scripting in the Gutenverse - WordPress Blocks, Page Builder & Site Editor plugin (all versions through 4.0.2) permits authenticated contributors to persist arbitrary JavaScript via the titleTag block attribute. The vulnerability is architecturally subtle: the malicious payload bypasses WordPress's wp_kses_post sanitization at save time by residing inside a Gutenberg block-comment delimiter, and the dangerous HTML is only synthesized when do_blocks() renders the page, at which point no further escaping is applied. Because the injected script fires in administrator and editor browser sessions during post preview, a contributor can effectively escalate impact to admin-level session hijacking. No public exploit identified at time of analysis.

Reflected Cross-Site Scripting in the Events Manager WordPress plugin (all versions up to and including 7.4.0.1) allows unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users. The attack surface is the plugin's unauthenticated 'search_events_grouped' AJAX action, which accepts the 'header_format' parameter and passes it to output_grouped() without sanitization - bypassing the wp_kses() protection applied only at the shortcode entry point. No public exploit code or CISA KEV listing was identified at time of analysis; exploitation requires tricking a victim into clicking a crafted link.

Stored Cross-Site Scripting in the FundEngine WordPress plugin (versions up to and including 1.8.1) allows any authenticated user with at minimum Subscriber-level access to inject persistent malicious scripts via the `wfp_featured_video_url` parameter. The REST endpoint that processes this input has its `permission_callback` hardcoded to `__return_true`, effectively bypassing WordPress role-based access controls and exposing the vulnerable code path to the lowest-privilege registered user. Injected scripts execute in the browsers of any subsequent visitor to the affected campaign page, enabling session hijacking, credential theft, or further lateral movement. No confirmed active exploitation has been identified (not in CISA KEV) and no public exploit code is referenced at time of analysis.

Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (all versions through 2.2.16) allows authenticated contributors to inject persistent JavaScript via a double-quote breakout in the cozyHoverEffect.boxShadow.color block attribute, bypassing WordPress's native wp_kses_post sanitization filter. Because the crafted payload contains no angle brackets, it passes the save-time sanitizer cleanly and executes as an event-handler injection at render time whenever any user visits the affected page. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog; however, the scope change (S:C) and low privilege requirement elevate real-world risk beyond the moderate CVSS score suggests.

Stored XSS in the PPWP - Password Protect Pages WordPress plugin (all versions up to and including 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized attributes in the 'ppwp' shortcode. Any user or administrator who subsequently loads an affected page will execute the injected script in their browser, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code or CISA KEV listing is identified at time of analysis; however, the CVSS Scope:Changed rating reflects meaningful cross-origin impact on visiting users beyond the injecting contributor.

Cryptographic failure in Adminer's CSRF token scheme before version 5.4.3 allows an attacker who observes any single valid token to recover the session secret with one XOR operation, then forge unlimited valid CSRF tokens indefinitely. The token format `(rand XOR secret):rand` transmits both XOR operands together, rendering the masking scheme arithmetically transparent; this flaw is compounded by approximately 20 bits of entropy in the underlying random value and PHP loose comparison in token verification. Successful exploitation permits CSRF attacks against authenticated Adminer sessions, enabling execution of arbitrary SQL queries including data exfiltration, unauthorized modification, and destructive operations. No public exploit has been identified at time of analysis.

Cross-site scripting with CSP bypass in Adminer before 5.4.3 enables arbitrary JavaScript execution in the browser of any user who connects to an attacker-controlled MySQL server. The vulnerability stems from unsanitized MySQL server version strings being injected directly into script tags that carry valid Content Security Policy nonces, effectively nullifying CSP protections. No public exploit code or CISA KEV entry has been identified at time of analysis, but the attack is meaningful against administrators and developers who routinely connect Adminer instances to external or third-party MySQL servers.

Adminer 4.6.0 through 5.4.x blindly prepends the client-supplied X-Forwarded-Prefix HTTP header to internally constructed URLs with no trusted-proxy allowlist or value sanitization, allowing attacker-controlled URL prefixes to propagate into Location redirect headers, Set-Cookie path attributes, and self-referential links. This yields an authenticated open redirect on state-changing POSTs and unauthenticated control of session cookie path scoping against default deployments in the affected version range. CR/LF injection is blocked, ruling out header splitting and XSS despite the intelligence source's XSS tag - that tag appears to be a mis-classification and should not inflate risk estimates. No public exploit has been identified at time of analysis, and no CISA KEV listing exists.

Reflected XSS in Dolibarr's extra fields administration template (all versions before 24.0.0) allows an unauthenticated attacker to execute arbitrary JavaScript in an authenticated administrator's browser session by delivering a crafted URL containing a malicious `type` parameter. The parameter is echoed without JavaScript-context encoding directly into an inline script block, and no Content-Security-Policy header is present to block the execution. Successful exploitation enables the attacker to create a persistent backdoor administrator account, constituting a full application takeover with no KEV listing but publicly available exploit code confirmed by VulnCheck.

Stored cross-site scripting in Baserow's rich-text mention renderer allows any authenticated workspace member - at the lowest permission level - to permanently inject and execute arbitrary scripts in the browsers of all other workspace members who view any table containing a mention of the attacker's account. The attack requires no victim interaction beyond passively loading the table view, and the payload persists until the attacker's display name is corrected or the offending row is deleted. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the zero-click broadcast delivery model makes this operationally more impactful than the CVSS 5.3 base score suggests for multi-tenant Baserow deployments.

Reflected or stored cross-site scripting in Johnson Controls Metasys 14 (before 14.1.5) and Metasys 15 (before 15.0.1) allows a low-privileged attacker to inject malicious scripts into web pages that execute in a victim user's browser. Metasys is a building automation and management system, meaning successful exploitation could enable session hijacking or unauthorized interaction with building infrastructure controls accessible through the web interface. No public exploit has been identified and no active exploitation is confirmed; a vendor-released patch is available.

Stored cross-site scripting in the contacts component of NethServer's WebTop groupware module allows an authenticated attacker to inject persistent JavaScript into shared address book fields, which executes silently in any victim's browser upon viewing the poisoned contact record. All WebTop installations on version 1.5.6 and earlier are at risk; successful exploitation can cascade into session hijacking, credential theft, and unauthorized access across all integrated groupware services including email and file storage. No public exploit has been identified at time of analysis, though the stored XSS class requires minimal technical sophistication once an attacker holds a low-privilege account.

Stored XSS in Horde IMP's AppleDouble MIME viewer (all versions before 7.2.0) allows any email sender to execute arbitrary JavaScript in a recipient's browser session when they view a crafted message. No account on the target system is required - only the ability to deliver mail - and because the payload persists in the mailbox it can re-execute on every subsequent view. A publicly available exploit exists, and the researcher documents a chained escalation path combining this flaw with CVE-2026-58451 that reaches application code execution when triggered in an IMP administrator's session.

Stored cross-site scripting in Grafana OSS allows an authenticated Editor-level attacker to hijack the browser session of any user who clicks a crafted alert link, executing attacker-controlled JavaScript in the Grafana origin with the victim's permissions. The attack exploits unsanitized rendering of the external Alertmanager alert generatorURL field as an href in the Alert Details 'See source' LinkButton, combined with a bypass of Grafana's click-interceptor heuristic by embedding :// inside a JavaScript comment within a javascript: URI. No public exploit code or CISA KEV listing has been identified at time of analysis, but the bypass technique is fully disclosed in the CVE description, lowering the bar for weaponization.

Cross-site scripting in ThemeGrill's Magazine Blocks WordPress plugin (versions ≤1.8.6) enables an authenticated Contributor to inject malicious scripts into block content that execute in a victim's browser upon page view. The CVSS scope-change metric (S:C) reflects that injected code escapes the plugin context and runs in the victim's browser session, potentially allowing session token theft or unauthorized admin actions. No public exploit code or active exploitation has been identified at time of analysis, but the Patchstack-reported flaw and ENISA EUVD-2026-64788 entry confirm the vulnerability.

Stored cross-site scripting in Hugo's fenced-code-block renderer (versions 0.93.0 through 0.165.0) allows a low-privileged content author to inject arbitrary JavaScript into statically generated HTML pages by embedding crafted attribute values in a code-fence info string. The vulnerability arises because Hugo's `markup/internal/attributes/attributes.go` converts attribute values from byte slices to strings during storage, silently bypassing the escaping branch in `RenderAttributes` that only operates on byte slice types - contradicting the function's own documentation. Every visitor who loads an affected page executes the injected script; no public exploit identified at time of analysis, and exploitation has not been confirmed in CISA KEV.

Reflected XSS in Page Builder CK, a third-party Joomla extension by joomlack.fr, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL that embeds a payload in the `iscontenttype` parameter. All versions prior to 3.6.5 are affected; exploitation requires passive user interaction - a victim must click or be redirected to the crafted URL. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the low attack complexity and absence of authentication requirements make this trivially weaponizable against any Joomla site running the unpatched extension.

Reflected cross-site scripting in Piwigo 16.3.0 public authentication pages allows a remote attacker to inject arbitrary JavaScript into a victim's browser by planting a malicious `lang` cookie value that is reflected unencoded through the application's fatal error handler. The vulnerability spans four public-facing PHP files (identification.php, password.php, register.php, profile.php) and is exploitable without authentication. A publicly available proof-of-concept exists; vendor-released patch 16.4.0 is available and exploitation is not confirmed in CISA KEV, though the AC:H complexity requirement meaningfully constrains real-world risk.

Stored XSS in Heptabase by Hepta Platforms, Inc. allows authenticated attackers to inject persistent malicious JavaScript into specific application pages, which then executes in the browsers of other users who interact with the crafted content. All versions are affected per CPE data (cpe:2.3:a:hepta_platforms:heptabase:*), and the CVSS 4.0 vector scores high subsequent-system confidentiality and integrity impact (SC:H/SI:H), meaning victim users' sessions and data are meaningfully at risk. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is constrained by the need for the attacker to hold a valid account and for victims to actively click the injected content.

Arbitrary file upload in NewSiteServer (NSS) by CyberTutor allows unauthenticated remote attackers to store malicious HTML files on the server, producing stored XSS-equivalent effects against users who subsequently access those files. All known versions are affected per EUVD and CPE wildcard data; the upload endpoint requires no authentication. No public exploit code or active exploitation has been identified at time of analysis, and no patch version has been independently confirmed from available references.

Mutation XSS in justhtml (versions ≤1.11.0) allows injection of arbitrary HTML into serialized output when applications use a custom sanitization policy that retains raw-text elements such as <style> or <script>. Attacker-controlled text node content containing a closing tag sequence causes the serializer to break out of the raw-text context, inserting attacker-supplied markup into the final HTML string rendered by a victim's browser. No public exploit has been identified at time of analysis, but a vendor-released patch exists in version 1.12.0.

Cross-site scripting in justhtml 0.9.0-1.21.0 allows an attacker who can control the text content of HTML code or pre elements to escape the Markdown inline code span produced by to_markdown(), causing sanitized content to be emitted unescaped and re-parsed as live HTML by a downstream Markdown renderer. The to_markdown() function is explicitly documented as a security boundary, making this a trust-model violation. No public exploit code has been identified and CISA KEV status is not confirmed, but the root cause is a fundamental gap in the inline code-span helper that bypasses the library's own stated sanitization guarantees.

Cross-site scripting in justhtml before 3.11.0 allows remote unauthenticated attackers to execute arbitrary JavaScript in victims' browsers via SVG or MathML elements injected through selectedcontent projections. The default sanitizer fails to remove event handlers that are cloned and reinserted during the selectedcontent projection process, bypassing the library's intended sanitization guarantees. No public exploit code has been identified at the time of analysis, and a vendor patch (3.11.0) is available; EPSS data was not provided but the CVSS 4.0 score of 5.1 reflects the user-interaction requirement limiting opportunistic exploitation.

Sanitization bypass in justhtml (Python HTML sanitization library) before version 1.17.0 enables cross-site scripting in applications using custom policies that preserve SVG or MathML namespaces, custom policies that preserve <style> blocks, or programmatic DOM construction prior to serialization. Crafted HTML input containing mutation-XSS parser-differential payloads, HTML integration points such as SVG <foreignObject> or MathML <annotation-xml encoding="text/html">, or resource-loading CSS constructs can survive sanitization and activate as executable markup after browser reparse. No public exploit code has been identified and the CISA KEV list does not list this CVE; notably, the default JustHTML(..., sanitize=True) configuration is not affected by most of the reported issues.

Mutation XSS (mXSS) in justhtml 1.13.0 and earlier enables markup injection bypass against applications using non-default custom SanitizationPolicy configurations that preserve foreign namespaces. Specially crafted input sanitizes to apparently clean markup that is subsequently reinterpreted as executable script when re-parsed by a browser - a classic parser-differential attack. No public exploit identified at time of analysis and this CVE is not in CISA KEV; however, the no-special-authentication-required network attack vector and the availability of a confirmed patch commit make prompt upgrading the correct response for any application using affected custom policies.

Cross-site scripting in justhtml versions before 1.13.0 allows attackers who control `<pre>` element content to break out of fixed-length Markdown code fences and inject raw HTML into the serialized output. When an application passes attacker-supplied HTML through `JustHTML(..., sanitize=True).to_markdown()` and a downstream CommonMark or GFM renderer processes the result with raw-HTML enabled, the injected script executes in the victim's browser. A proof-of-concept with full reproduction steps is publicly available in the GHSA advisory; no public exploit identified at time of analysis beyond that PoC.

Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the clientName and clientContact parameters of /php_action/getOrderReport.php. A publicly available proof-of-concept exploit exists (CVSS 4.0 E:P), lowering the skill threshold for exploitation. No CISA KEV listing is present, but the unauthenticated, network-accessible vector with a public PoC makes this a credible risk for any exposed deployment.

Cross-site scripting in SourceCodester Stock Management System 1.0 allows remote attackers to inject malicious script via the clientName and clientContact parameters of /php_action/printOrder.php. When a legitimate user views a manipulated order print page, the unsanitized input is rendered in their browser, enabling session hijacking, credential theft, or malicious redirects. A public exploit has been disclosed via GitHub (referenced in VulDB entry 394299); no active exploitation is confirmed in CISA KEV.

Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in `/BSIT2.php`. Exploitation requires victim interaction (UI:P per CVSS 4.0) but no authentication (PR:N), enabling session hijacking or phishing against users of the affected application. A public proof-of-concept exploit has been disclosed on GitHub; no CISA KEV listing indicates no confirmed widespread active exploitation at time of analysis.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser by manipulating the `course` parameter of /BSIS1.php. A publicly available proof-of-concept exploit exists (referenced via GitHub), raising the practical threat level above what the moderate CVSS 4.0 score of 5.3 alone would suggest. No authentication is required to craft the malicious request, though successful exploitation depends on user interaction - a victim must visit a attacker-controlled or attacker-supplied URL.

Stored Cross-Site Scripting in the Image Photo Gallery Final Tiles Grid WordPress plugin (versions through 3.6.12) allows authenticated contributors to inject persistent malicious scripts via the 'delay' shortcode attribute. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit has been identified at time of analysis, and a code-level fix has been committed to the WordPress.org plugin repository (changeset 3490676).

Stored XSS in the MC4WP: Mailchimp for WordPress plugin allows authenticated WordPress users with Author-level access or above to inject persistent malicious scripts into form response message post meta fields (`text_subscribed`, `text_error`), affecting all versions through 4.12.0. Injected payloads execute in the browsers of any site visitor who loads a page rendering the compromised form response, enabling session hijacking, credential theft, or malicious redirects against other users including Administrators. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV, though the low privilege barrier of the Author role makes this a credible internal threat on multi-contributor WordPress installations.

Stored cross-site scripting in the Post Grid, Slider & Carousel Ultimate WordPress plugin (all versions before 1.8.1) allows any authenticated Contributor-level user to inject persistent JavaScript into a custom post type setting that executes in an administrator's browser session when the admin opens the poisoned item's edit screen. The attack effectively escalates a Contributor's limited privileges to full administrative control over the WordPress instance without any interaction from the attacker beyond the initial payload submission. No public exploit code has been identified and EPSS places exploitation probability at 0.16%, though the low technical barrier and the prevalence of multi-contributor WordPress sites make this a meaningful insider-threat and account-compromise vector.

Stored cross-site scripting in LeafWiki's search API allows an authenticated editor or administrator to plant a JavaScript payload in a page title, which executes in any victim's browser when they view search results containing that title. No public exploit identified at time of analysis. The attack surface widens significantly when the `--public-access` flag is enabled, making unauthenticated visitors viable targets; in default authenticated-only deployments, the blast radius is limited to logged-in users. A vendor-released patch is available in version 0.10.2.

Stored HTML attribute injection in Typemill versions prior to 2.23.0 allows authenticated content editors to embed arbitrary HTML attributes into generated og:title and og:description meta tags due to absent output encoding. Under applicable browser or DOM interaction conditions, this escalates to stored cross-site scripting (XSS) against any visitor loading the affected page. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; version 2.23.0 patches the issue and is confirmed by the official release notes.

Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior enables a remotely authenticated administrator to inject persistent malicious JavaScript that executes in other users' browsers upon page load. The scope change (S:C) in the CVSS vector confirms the attacker's injected payload crosses from the server context into victims' browser sessions, enabling session hijacking, credential theft, or DOM manipulation. No public exploit code has been identified at time of analysis, and no CISA KEV listing is present; Esri has issued a patch via the August 2026 ArcGIS security bulletin.

Reflected cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote, unauthenticated attacker to craft a malicious URL that, when clicked by a victim, executes arbitrary JavaScript in the victim's browser. The CVSS Scope:Changed metric indicates that injected scripts may affect components beyond the vulnerable Portal itself, such as session tokens shared across an ArcGIS Enterprise deployment. No public exploit code has been identified at time of analysis, and this vulnerability does not appear in CISA KEV.

Stored XSS in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker to inject persistent malicious scripts that execute in a victim's browser upon visiting affected portal content. Successful exploitation can yield session hijacking, credential theft, and unauthorized actions performed within a victim's authenticated portal session. No public exploit has been identified at time of analysis, and this CVE is not currently listed in CISA KEV.

Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 12.1 enables a remote, privileged attacker to persist malicious JavaScript in the portal, which then executes in the browsers of users who subsequently view the affected content. The vulnerability carries a CVSS 3.1 score of 6.1 (Medium) with scope change (S:C), meaning successful exploitation crosses trust boundaries into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at time of analysis, and Esri has released patches via their August 2026 ArcGIS Security Bulletin.

HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.3 enables a remote attacker holding administrative credentials to insert arbitrary HTML into an administrative API endpoint, with potential to mislead or deceive other administrators viewing the rendered output. The CVSS score of 3.8 (Low) reflects the high privilege prerequisite (PR:H), which confines realistic exploitation to scenarios involving compromised admin accounts, rogue insiders, or privilege escalation chains. No public exploit code exists and the vulnerability is not listed in CISA KEV at time of analysis.

Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote attacker holding high portal privileges to persist malicious JavaScript payloads in portal content. When any other authenticated user browses the affected item, the injected script executes in their browser, enabling session hijacking, credential exfiltration, or portal actions performed on the victim's behalf. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog at time of analysis; however, the CVSS scope-change metric (S:C) signals that impact crosses the security boundary of the vulnerable component and extends to victims' browser sessions.

Stored cross-site scripting in Esri Portal for ArcGIS versions 11.1 through 11.5 allows a remote, privileged attacker to persist malicious JavaScript within the portal, which subsequently executes in the browsers of any user who views the affected content. The vulnerability carries a CVSS 3.1 score of 5.5 with scope change (S:C), reflecting that exploitation crosses from the portal server into victim browser sessions, enabling session hijacking, credential harvesting, or unauthorized portal actions on behalf of victims. No public exploit code or CISA KEV listing has been identified at time of analysis, but Esri has released patches for affected enterprise versions and advises upgrading to the latest long-term support release.

Stored cross-site scripting in Esri Portal for ArcGIS versions 11.5 and prior allows a remote attacker holding administrative credentials to persistently inject malicious JavaScript that executes in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload escapes the application's trust boundary and can affect lower-privileged users who simply load poisoned portal pages. No public exploit code or active exploitation has been identified at time of analysis; Esri has released guidance directing affected users to patch via the August 2026 ArcGIS Security Bulletin.

HTML injection in Esri Portal for ArcGIS versions 11.1 through 12.0 enables a remote authenticated attacker to insert arbitrary HTML into the Portal for ArcGIS Home application, potentially exposing other portal users to malicious content. The flaw is tagged as XSS and classified under CWE-79, meaning unsanitized attacker-controlled input is rendered in the browser context of other users visiting the Home application. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code is identified, though the relatively low privilege requirement (authenticated, low-privilege user) broadens the potential attacker pool within any ArcGIS Enterprise deployment.

HTML injection in Esri Portal for ArcGIS versions 11.1 through 11.5 permits a remote, highly privileged attacker to insert arbitrary HTML into the Portal Home application, potentially delivering spoofed UI content or phishing material to other authenticated users. The CVSS vector (PR:H, UI:R, S:U) substantially constrains real-world impact: exploitation demands administrative-level credentials and victim interaction, with no availability impact and limited confidentiality or integrity effect. No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in the OpenSearch Dashboards dashboards-observability plugin allows a remote authenticated user with write permissions to saved objects to inject arbitrary JavaScript that executes in other users' browser sessions. Affected deployments include both self-hosted OpenSearch Dashboards and Amazon OpenSearch Service (managed). The scope change (S:C) and high confidentiality/integrity impact make this particularly dangerous in multi-tenant environments where admin accounts may view attacker-controlled saved assets. No public exploit or CISA KEV listing has been identified at time of analysis; vendor-released patches are available in versions 3.4.0 and 2.19.0.

Stored XSS in DiscordChatExporter's HTML export engine allows script injection via maliciously crafted emoji metadata in chat logs prior to version 2.47.2. The VisitEmojiAsync method in HtmlMarkdownVisitor.cs interpolates emoji.Name into HTML alt attributes and emoji.Code into title attributes without HTML entity encoding, creating an injection point that executes in the victim's browser when they open the exported HTML file. Exploitation requires tampered offline input or a future relaxation of Discord's server-side emoji name validation; no public exploit or active exploitation has been identified at time of analysis.

Element Web's EmbeddedPage component rendered homeserver-supplied homepage HTML directly into the DOM via React's dangerouslySetInnerHTML without first passing it through the application's sanitizedHtmlNode utility, enabling any malicious or compromised Matrix homeserver to inject arbitrary HTML into the client homepage of connecting users prior to version 1.12.22. The Content Security Policy blocks JavaScript execution, constraining impact to HTML-based phishing - fake login forms, spoofed UI overlays - rather than remote code execution. No public exploit code has been identified and this vulnerability is not listed in CISA KEV.

Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attackers to inject arbitrary JavaScript into a victim's browser session or redirect users to attacker-controlled URLs by crafting a malicious link containing an unsanitized submission redirect parameter. Exploitation requires a user to follow the crafted link, limiting automated mass exploitation. No public exploit code or active exploitation in CISA KEV has been identified at time of analysis.

Incorrect entity-passthrough logic in joshnuss xml_builder (Elixir) versions 0.0.6 through 2.4.0 allows attacker-supplied text containing pre-encoded entity sequences such as &lt;script&gt; to be emitted verbatim into serialized XML, rather than being double-encoded to &amp;lt;script&amp;gt;. When a downstream parser decodes the output and renders it in a markup-sensitive context - HTML, SVG, or RSS/Atom feeds - the entity sequences resolve into live markup, enabling content spoofing and cross-site scripting while bypassing upstream filters that block raw angle-bracket characters. No public exploit is identified at time of analysis, and no CISA KEV listing exists.

Cross-site scripting in the Miraikan Assist App (Android < 1.1.7, iOS < 1.0.7) enables remote attackers to inject and execute arbitrary JavaScript within the app's embedded WebView component when a user interacts with attacker-controlled content. The scope change in the CVSS vector (S:C) reflects that execution occurs across origin boundaries within the WebView context, enabling content manipulation beyond the app's own domain. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; patch is confirmed available from the vendor.

Stored XSS in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin (versions before 1.3.9.9) allows administrator-level users to inject arbitrary JavaScript via an unsanitized plugin setting used as an HTML tag name in front-end output. Any visitor loading a page that renders the upload field will execute the injected script in their browser context. A publicly available exploit exists; the vulnerability is rated CVSS 3.5 due to the high-privilege requirement, though post-authentication stored XSS can still enable session hijacking or malicious redirects against site visitors.

Stored HTML injection in TREK collaborative travel planner (versions prior to 3.1.0) enables content spoofing and UI redress attacks against authenticated collaborators when the Journey add-on is enabled. An authenticated trip owner embeds raw HTML in a trip title; the backend endpoint GET /api/journeys/suggestions returns it unsanitized, and the frontend renders it directly via React's dangerouslySetInnerHTML, bypassing output encoding. The default Content Security Policy blocks inline handlers and script execution, constraining impact to visual manipulation rather than full cross-site scripting; no public exploit or active exploitation has been identified at time of analysis.

Stored cross-site scripting in BigBlueButton's screenshare recording playback allows an authenticated low-privileged user to inject arbitrary script via a crafted meeting name, which executes in any other user's browser upon viewing the screenshare recording. Affected versions are all BigBlueButton releases prior to 3.0.29; the vulnerability is rooted in unescaped ERB interpolation of meetingName into both the page title and heading of index.html.erb. No public exploit or CISA KEV listing has been identified at time of analysis, though the publicly available commit diff could guide exploit development.

Incomplete HTML escaping in Xapian::MSet::snippet() within xapian-core exposes web applications using this search library to cross-site scripting attacks via a missed corner case of the previously patched CVE-2018-0499. Affected versions include all xapian-core releases before 2.1.0 and before 1.4.32. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but applications that render snippet() output directly into web pages without additional sanitization are at real risk.

SVG attribute injection in @dicebear/core and @dicebear/initials prior to 9.4.3 enables cross-site scripting when an application routes untrusted input through the rotate, fontSize, or fontWeight avatar options. TypeScript types these parameters as numbers, but JavaScript runtime coercion allows string values, permitting attribute breakout and injection of arbitrary SVG markup — payloads confirmed in the commit test suite include onerror-carrying <image> elements. Script executes in the page origin when the generated SVG is inlined or served as image/svg+xml; no public exploit identified at time of analysis and no CISA KEV listing, but the patch commit exposes working injection strings.

Cross-site scripting in Znuny's AgentTicketEmailResend template allows a high-privileged authenticated attacker to inject malicious script that executes within other agents' browser sessions, enabling session hijacking or unauthorized agent-level actions. All Znuny LTS versions prior to 6.5.22 are affected per CPE cpe:2.3:a:znuny:znuny:*:*:*:*:*:*:*:* and the vendor advisory at znuny.org/en/advisories/zsa-2026-12. No public exploit or active exploitation has been identified at time of analysis; the high privilege requirement substantially constrains the realistic threat surface.

Stored XSS in Laravel Backpack CRUD's color column Blade template allows any authenticated user with write access to a color-typed field to inject arbitrary JavaScript that executes in the browsers of other users - including administrators - who view the affected list page. The root cause is an inversion of the escaped/unescaped rendering branches in `color.blade.php`: because `$column['escaped']` defaults to `true`, the template renders values raw via `{!! $column['text'] !!}` instead of HTML-escaped, the exact opposite of every other column template in the library. No public exploit has been identified at time of analysis, but the CVSS scope-change indicator (S:C) reflects real cross-user impact including potential session cookie and CSRF token theft from administrators.

Stored XSS and arbitrary file upload in Laravel Backpack CRUD allows an authenticated admin to bypass the `SingleBase64Image` uploader's trivial `data:image` prefix check, writing files of any MIME type - including SVG with embedded JavaScript - to the configured storage disk. A companion bug in `FileNameGenerator` causes stored files to receive extensionless names because `mime_content_type()` returns false when passed a data URI string rather than a filesystem path, compounding server-side MIME enforcement failures. Affected versions span 6.0.0-6.8.13 and 7.0.0-7.0.37; vendor-released patches 6.8.14 and 7.0.38 address both flaws. No public exploit code or CISA KEV listing was identified at time of analysis.

Laravel Backpack CRUD versions prior to 6.8.14 (6.x branch) and 7.0.38 (7.x branch) allow any authenticated user to change the account's login email address without supplying their current password, enabling persistent account takeover that survives session termination. The asymmetry is stark: the password-change endpoint in the same controller enforces a Hash::check against the stored password, but the account-info update path passes the request directly to mass-assignment without an ownership challenge. No public exploit or CISA KEV listing has been identified, but the attack chain is low-complexity for anyone who can obtain a transient authenticated session.

Stored XSS in django CMS 5.0.8 allows an authenticated editor to execute arbitrary HTML in other staff users' browsers via the edit-mode plugin exception rendering path. When plugin rendering fails in edit mode, ContentRenderer.render_exception in cms/plugin_rendering.py interpolates attacker-controlled values - including get_short_description() output, exception messages, and placeholder source strings - into an HTML heading using an unsafe f-string, then returns the result through mark_safe, bypassing Django's autoescaping. No public exploit has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.

Reflected cross-site scripting in Cesanta Mongoose (all versions prior to 7.22) allows a remote unauthenticated attacker to inject arbitrary JavaScript into a victim's browser by crafting a percent-encoded URL path targeting the directory listing handler. The `mg_http_serve_dir()` and `listdir()` functions in `src/http.c` insert the decoded request URI directly into `<title>` and `<h1>` HTML elements without HTML entity escaping, and the resulting script executes in the Mongoose origin. Exploitation requires both that the server was compiled with `MG_ENABLE_DIRLIST` enabled and that a victim user is persuaded to visit the malicious link; no public exploit or CISA KEV listing is identified at time of analysis.