Cross-Site Scripting

Stored cross-site scripting in Cesanta Mongoose's directory listing feature allows an attacker with filesystem write access to a served directory to plant a file whose name contains HTML or JavaScript markup; when any user browses that directory, the raw filename is reflected into the HTML page without escaping, executing arbitrary script in the Mongoose origin. All Mongoose versions prior to 7.22 with MG_ENABLE_DIRLIST enabled are affected. No public exploit or CISA KEV listing is confirmed at time of analysis; the vendor-released fix is available in Mongoose 7.22.

Reflected XSS in ATutor 2.2.4's preview.php enables an authenticated attacker to inject arbitrary JavaScript into a victim's browser session by manipulating the popup URL parameter. The frameset rendered by preview.php does not sanitize the popup parameter, allowing an attacker to break out of the HTML attribute context and append an event handler such as onload, even though the child frame file preview_top.php does apply sanitization. No patch exists and no patch is planned, as ATutor is no longer actively maintained; no public exploit or CISA KEV listing has been identified at time of analysis.

Reflected XSS in ATutor 2.2.4's restore functionality allows an authenticated low-privileged attacker to craft a malicious URL that executes arbitrary JavaScript in a victim's browser upon interaction. The CVSS 4.0 vector (PR:L/UI:A/SC:L/SI:L) confirms the attack requires a logged-in account, active victim click, and produces subsequent-system impact on the victim's browser session - not the attacker's own context. Critically, no patch will be issued: ATutor is end-of-life and no longer actively maintained, leaving all deployments permanently exposed.

Stored cross-site scripting in ATutor 2.2.4 allows unauthenticated attackers to register an account and inject a JavaScript payload into the phone number field, which executes in the browser of any authenticated user who subsequently visits the attacker's public profile. The immediate impact is session cookie theft, enabling account takeover of the victim without further interaction. No patch will be issued as ATutor is end-of-life; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the WP BASE Booking WordPress plugin (versions <= 6.3.2) allows subscriber-level authenticated users to inject malicious JavaScript into booking-related pages rendered for other users. The CVSS vector (PR:L, S:C) confirms that only a low-privilege subscriber account is needed to plant the payload, and a scope change occurs when the script executes in a victim's browser - typically an administrator. No public exploit code or active exploitation has been identified at time of analysis.

Cross-site scripting in the Media Library Assistant WordPress plugin (versions up to and including 3.39) allows a subscriber-level authenticated user to inject malicious scripts into the media library that execute in the browser session of a higher-privileged user, such as an administrator, who subsequently views the affected content. The scope change indicated by the CVSS vector (S:C) means successful exploitation crosses from the plugin context into the victim's browser, enabling session hijacking or privilege escalation within the WordPress installation. No public exploit code or active exploitation has been identified at time of analysis.

Reflected XSS in the Phoca Download Extension for Joomla (versions 5.0.0 through 6.1.4) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL containing a payload in the 'search' GET parameter. Exploitation requires social engineering to lure a victim into clicking the crafted link, after which the attacker can steal session tokens, perform actions on behalf of the victim, or redirect to malicious sites. No public exploit code has been identified and this CVE does not appear in the CISA KEV catalog at time of analysis.

Reflected cross-site scripting in Phoca Cart, a Joomla e-commerce extension by phoca.cz, affects versions 5.0.0 through 6.1.7 via the price_from and price_to URL filter parameters. An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary JavaScript in the victim's browser session. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Cross-site scripting in F-RevoCRM versions 7.3.0 through 8.0.3 enables remote attackers to inject and execute malicious client-side scripts in the browser of an authenticated user who is lured to a crafted page. The CVSS S:C (scope changed) metric confirms the injected script operates beyond the application's trust boundary, enabling session hijacking, credential theft, or unauthorized CRM operations performed under the victim's identity. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed via JPCERT and documented under JVN#58692577.

Arbitrary file upload via malformed archive in the Kirki WordPress customizer plugin (all versions before 6.2.3) allows users holding the Editor role to place executable and web-accessible files on the server, enabling Stored XSS against any visitor and Remote Code Execution on permissive server configurations. A publicly available proof-of-concept exists per WPScan, elevating practical risk beyond the CVSS 6.8 score. No confirmed active exploitation appears in CISA KEV at time of analysis, though SSVC rates technical impact as total.

Stored Cross-Site Scripting in GutenKit WordPress plugin before 2.5.0 allows authenticated users holding the Author role - or any role with file upload capability - to upload maliciously crafted SVG files through plugin-enabled upload paths that lack sanitization, executing arbitrary JavaScript in the browsers of any user who subsequently opens the file, including site administrators. A publicly available proof-of-concept exists via WPScan, and the SSVC framework rates technical impact as 'total,' meaning successful targeting of an administrator session could yield full WordPress site compromise. The vendor has released a remediated version (2.5.0), and exploitation status is rated 'none' by SSVC at time of analysis despite the public exploit code.

Stored cross-site scripting in the Admin and Site Enhancements (ASE) WordPress plugin before 9.0.1 allows authenticated users with site-owner-granted upload access to embed malicious JavaScript inside SVG files uploaded through incompletely sanitized routes, which then executes silently in the browser of any user - including administrators - who subsequently opens or previews the file. The plugin fails to apply SVG sanitization uniformly across all upload-accepting endpoints, meaning at least one route bypasses the intended XSS filter. A publicly available proof-of-concept has been confirmed by WPScan (EUVD-2026-63203), though SSVC assessment and the absence of a CISA KEV entry indicate no active widespread exploitation at time of analysis.

Stored XSS in Splunk SOAR below 8.6.0 enables an authenticated 'Incident Commander' role user to inject JavaScript into a note, which executes in the browser of any user who subsequently opens it. The flaw stems from unsanitized HTML rendering triggered by a note format change, meaning content stored safely in one format becomes executable in another. No public exploit code exists and the vulnerability is absent from CISA KEV; however, successful exploitation could compromise victim session integrity within the SOAR platform.

Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to embed malicious JavaScript within dashboard sparkline format options, which then executes in the browser of any user who views that dashboard. If the victim holds the 'admin' Splunk role, the attacker effectively gains access to all data accessible through Splunk Web and can perform actions at admin-level permissions. Exploitation requires social engineering - the victim must be tricked into navigating to the malicious dashboard - and no public exploit code has been identified at time of analysis. Affected versions span four active release branches below 10.4.2, 10.2.6, 10.0.9, and 9.4.14.

Stored cross-site scripting in Splunk Enterprise's dashboard table renderer allows a low-privileged user - without admin or power role - to inject JavaScript payloads into sparkline table cell tooltips, which execute in the browser of any user who opens the malicious dashboard and hovers over an affected cell. The vulnerability spans four active Splunk Enterprise release lines (9.4, 10.0, 10.2, and 10.4), confirmed by EUVD-2026-63133 and Splunk advisory SVD-2026-0801. No public exploit code or active exploitation has been identified at time of analysis, but the broad version coverage and low attacker privilege bar make patching a clear operational priority.

Stored cross-site scripting in Splunk Enterprise's guided tour feature enables a 'power'-role user to inject and execute arbitrary JavaScript in any other authenticated user's browser when that user opens a crafted tour link. Affected across four active release branches (9.4.x, 10.0.x, 10.2.x, 10.4.x) with fixed versions now available per Splunk advisory SVD-2026-0801. No public exploit code or CISA KEV listing exists at time of analysis; the CVSS score of 5.7 reflects the dual prerequisite of attacker role access and required victim interaction.

Stored cross-site scripting in Splunk Enterprise exposes victim user data when a user holding the schedule_search capability injects a malicious script into an alert trigger condition field and induces another user to open the crafted link. The script executes in the victim's browser context and can access all Splunk data available to that user, making this particularly dangerous in environments where analysts or admins have broad search access over sensitive logs and security telemetry. Patch is available from Splunk across four version branches; no public exploit or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Splunk Enterprise (below versions 10.4.2, 10.2.6, 10.0.9, and 9.4.13) enables an unauthenticated attacker to execute arbitrary JavaScript in an authenticated user's browser by tricking that user into visiting a malicious web page. Splunk Web's page message handler processes incoming postMessage events without validating their origin or source, allowing cross-origin script injection into the victim's active Splunk session. Successful exploitation can expose all data accessible to the victim user and permit unauthorized actions affecting system integrity; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in lemmy-ui prior to 0.19.19-beta.1 allows session hijacking and unauthorized authenticated actions against viewers who render attacker-controlled markdown content. The vulnerable markdown-it-html5-embed@1.0.0 plugin generates video element fallback HTML by inserting image alt text via unescaped string replacement, bypassing the markdown-it html:false safety setting because plugin-generated output is never subject to that guard. An attacker controlling a federated Lemmy instance or holding approved-member status can store the payload, and any viewer who renders it on a deployment lacking Content-Security-Policy headers will execute attacker JavaScript in the lemmy-ui origin. No public exploit identified at time of analysis; EPSS data not provided in source intelligence.

Stored cross-site scripting in pfSense Plus (before 26.07) and pfSense CE (through 2.8.1) allows an external attacker who controls a DNS PTR record to execute arbitrary JavaScript in an administrator's browser by engineering top-talker visibility in the Traffic Graphs feature, ultimately enabling account creation and OS command execution on the firewall. The attack chain bridges an unauthenticated DNS-layer injection through an unsanitized DOM sink in AJAX responses to full authenticated control of the management interface. No public exploit has been identified at time of analysis, but successful exploitation yields complete administrative compromise of a network perimeter device - making this a high-impact target despite its moderate CVSS 4.0 score of 5.3.

Stored cross-site scripting in Snipe-IT prior to 8.6.2 allows an authenticated low-privilege user to inject arbitrary JavaScript via a crafted manufacturer or supplier name, which executes in the browser of any authenticated user who views the affected detail page. The CVSS 4.0 vector assigns SC:H/SI:H on the subsequent system, reflecting that a successful payload delivered to an administrator can yield full session compromise - including data exfiltration and action execution - against the Snipe-IT instance. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the vulnerability mechanism is fully disclosed via the public GitHub security advisory and fix commit.

Stored cross-site scripting in the Cisco Industrial Ethernet 1000 Series Switch web-based management interface allows an authenticated remote attacker to inject persistent malicious scripts into interface pages, which then execute in the browser context of other authenticated users. Affected firmware spans versions 1.1 through 1.9.5 across the IE 1000 product line, as confirmed by EUVD-2026-62562 and the Cisco security advisory. No public exploit code or active exploitation has been identified at time of analysis, and Cisco has published advisory cisco-sa-ie1k-NgXUFF52 with remediation guidance.

Stored cross-site scripting in the Grav API Plugin (all versions prior to 1.0.2) allows an authenticated attacker holding api.media.write permission to upload a malicious SVG file whose embedded JavaScript executes in any victim's browser that opens the file. The upload pipeline in HandlesMediaUploads::processUploadedFile() checks the SVG filename extension but omits the Security::sanitizeSVG() call, so script content passes through unmodified and is later served as Content-Type: image/svg+xml, triggering browser-side execution. Successful exploitation enables session token theft and impersonation of the victim; no public exploit has been identified at time of analysis, and vendor-released patch version 1.0.2 is available.

Stored cross-site scripting in OpenEMR's patient portal template import handler (all versions before 8.3.0) lets any authenticated Forms Administration user persist arbitrary HTML or JavaScript by uploading a crafted template file, because the prior defense was a trivially-bypassed blocklist rather than proper sanitization. The payload executes in the browser of every other Forms Administration peer who subsequently opens the template in the Summernote HTML editor, enabling session-token theft or privilege escalation within the EMR administrative context. No public exploit has been identified at time of analysis; vendor-released patch OpenEMR 8.3.0 is available.

Reflected XSS in OpenEMR's patient portal template import handler allows a remote unauthenticated attacker to craft a malicious URL that executes arbitrary JavaScript in the browser of any authenticated Forms Administrator who visits it, enabling session hijacking with administrative privileges. The vulnerable parameter (`templateHtml` GET) was reflected directly into the page response in `portal/import_template.php` without sanitization, and the only prior protection - a naive `<script` tag blacklist - was trivially bypassable with event-handler payloads. A vendor-released patch is available in OpenEMR 8.3.0 and no public exploit is identified at time of analysis.

Reflected XSS and XML injection in the J-BusinessDirectory Joomla extension (cmsjunkie.com, versions prior to 6.2.3) exposes site users to client-side script execution via a crafted link. The companyName HTTP request parameter is written directly into an XML attribute without output encoding, allowing attacker-controlled markup to be reflected in server responses. No public exploit code has been identified and the flaw is not listed in CISA KEV, but the unauthenticated attack vector makes it a realistic phishing-leveraged threat against any publicly accessible site running the affected extension.

Cross-site scripting in Dell OpenManage Enterprise (all versions prior to 4.7.0) enables a low-privileged remote authenticated attacker to inject malicious JavaScript that executes in the browsers of other users, leading to information exposure such as session token theft or disclosure of management data. The CVSS vector confirms network accessibility with low attack complexity, but exploitation requires both a valid low-privileged account and a separate victim who interacts with the injected content. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this in a monitor-and-patch rather than emergency-response category.

phpMyFAQ before v4.1.6 exposes database credentials by writing backup ZIP archives to the publicly accessible document root at a predictable path (`content.zip`), enabling credential theft via two distinct attack chains. Unauthenticated attackers can race concurrent HTTP requests against the brief window between archive creation and deletion, while a second path chains a stored XSS in the admin panel to force an authenticated backup and retrieve the resulting archive. No public exploit code has been identified at time of analysis, though the concrete credential disclosure impact warrants prompt remediation for all internet-facing deployments.

CSS injection in M-Files Web before version 26.8.16330.2 permits an authenticated vault administrator to embed arbitrary CSS into the web interface, visually manipulating the UI rendered to all other vault users. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation is gated behind high-privilege admin credentials and requires passive victim interaction, substantially constraining the realistic threat surface. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

HTML injection in M-Files Web before version 26.8.16330.2 enables authenticated attackers to inject malicious HTML into web UI elements that are subsequently rendered in the browsers of other authenticated users, constituting a stored cross-site scripting (XSS) primitive. The attack requires valid low-privileged credentials and passive victim interaction, constraining opportunistic mass exploitation, but the risk is meaningful in multi-user enterprise deployments where document management workflows create natural injection surfaces. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holding contributor-level accounts inject arbitrary JavaScript that executes silently in every subsequent visitor's browser. The exploit embeds a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content; the plugin's bundled lazysizes ls.unveilhooks addon then dynamically inserts a script element into the DOM at page-view time with no domain validation. No public exploit has been identified at time of analysis and the CVE is absent from the CISA KEV catalog, though the fix commit fully exposes the exploitation mechanic.

Stored cross-site scripting in the JetEngine WordPress plugin before 3.8.14 allows users with the upload files capability - such as Authors - to upload unsanitized SVG files whose embedded JavaScript executes in any visitor's browser upon viewing the file. The plugin adds SVG to the site-wide allowed upload type list without stripping executable content, and on WordPress multisite deployments the flaw additionally bypasses upload-type restrictions enforced by the network administrator. No public exploit has been identified at time of analysis, and the EPSS exploitation probability of 0.16% (6th percentile) reflects a low current threat velocity.

Stored cross-site scripting in the Easy Media Replace WordPress plugin (≤0.2.0) allows any user holding the Author role or higher to inject arbitrary JavaScript into attachment titles, which executes in the browser of a higher-privileged user when they access the WordPress media library. No active exploitation has been identified per SSVC assessment (exploitation: none), but SSVC rates the Technical Impact as 'total', reflecting the potential for full administrative site compromise if a privileged session is hijacked. No vendor-released patched version has been confirmed at time of analysis.

Stored cross-site scripting in the 10Web Booster WordPress plugin (all versions before 2.33.5) enables unauthenticated attackers to persist malicious JavaScript in the HTML page head by exploiting a broken access token check on an otherwise-restricted request handler. Once injected, the payload fires automatically in the browser of every anonymous visitor to the affected page, without any further attacker interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection path and stored (persistent) nature of the payload make this more operationally impactful than the raw CVSS 4.7 score suggests.

Cross-site scripting in acmailer CGI and acmailer DB (Extra Innovation Inc.) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers when users interact with attacker-crafted content. Both distribution variants - the CGI-based and the database-backed editions - are confirmed affected per CPE data and JPCERT coordination (JVN#47716829). No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.

Stored cross-site scripting in the Media Library Assistant WordPress plugin (versions through 3.39) allows authenticated low-privileged users to inject persistent malicious scripts that execute in the browsers of other users - including administrators - who subsequently view affected media library pages. The Changed scope (S:C) in the CVSS vector confirms the payload escapes the plugin context and can affect the broader WordPress admin interface. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and low privilege requirement make it straightforward to exploit once authenticated. Reported by Patchstack (ENISA EUVD-2026-62210).

Stored Cross-Site Scripting in the PublishPress Series WordPress plugin (versions through 2.17.0) allows a high-privileged attacker to persist malicious JavaScript payloads that execute in victims' browsers when affected content is viewed. The scope change in the CVSS vector confirms the injected script crosses trust boundaries, affecting users beyond the administrative context where the payload was stored. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the category of moderate, authenticated risk.

Stored cross-site scripting in the Draft List WordPress plugin (versions through 2.6.4) allows authenticated users with low privileges to inject persistent malicious JavaScript into draft-related fields rendered by the plugin. When a higher-privileged WordPress user such as an administrator or editor views the draft list output, the stored payload executes in their browser, enabling session hijacking or unauthorized administrative actions. Reported by Patchstack (EUVD-2026-62208); no public exploit code or active exploitation confirmed at time of analysis.

Cross-site scripting via deliberate CSP header removal in Streambert's Electron API key redemption window affects versions 2.5.0 through 2.5.x, allowing attacker-controlled script content on sub.wyzie.io or any navigated resource to execute without Content-Security-Policy constraints and interact with other windows and persistent session storage. The wyzie-open-redeem IPC handler in index.js unconditionally strips all CSP response headers from a dedicated Electron session partition, and the redemption BrowserWindow omits a setWindowOpenHandler, compounding the attack surface. No public exploit has been identified at time of analysis; the vulnerability is fixed in version 2.6.0 by complete removal of the vulnerable feature.

Stored cross-site scripting in Koha's purchase suggestion handler allows any authenticated staff user to inject persistent malicious scripts into multiple unsanitized input fields, which then execute in the browsers of other staff users who view the suggestion list. Affected versions span three active release branches: 25.05.x before 25.05.13, 25.11.x before 25.11.07, and 26.05.x before 26.05.02, all of which have now received patched releases. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects limited subsequent-system impact and the requirement for both authenticated attacker access and passive victim interaction.

Persistent cross-site scripting in Otalio Ship Property Management System (all versions before 2.22.0) enables authenticated high-privileged attackers to escalate privileges by injecting unescaped malicious scripts into the application security page. The stored payload executes in the browser context of other authenticated users who subsequently view the affected page, enabling session hijacking or unauthorized actions under victim credentials. Reported by Mandiant; no public exploit code or CISA KEV listing identified at time of analysis.

Cross-site scripting in Joomla! CMS versions 5.1.0-5.4.7 and 6.0.0-6.1.2 exposes sites to stored XSS through improperly escaped schema.org structured-data markup output. An attacker holding high-privilege CMS credentials can inject malicious script into schema.org content fields, which subsequently executes in the browsers of users who load affected pages. No public exploit has been identified at time of analysis and the vulnerability is absent from CISA KEV; a vendor security advisory has been issued through the Joomla Security Centre.

Cross-site scripting in Trix rich text editor versions prior to 2.1.17 allows network-reachable attackers with content-insertion privileges to execute arbitrary JavaScript in victims' browser sessions. The DOMPurify sanitizer lacked a hook to explicitly block the `data-trix-serialized-attributes` attribute, enabling crafted attachment HTML to survive sanitization and fire event handlers such as `onerror` upon rendering. No CISA KEV listing was identified at time of analysis, but the fix PR publicly exposes a working test payload, materially lowering the barrier to exploitation.

HTML injection in MailerUp's public subscription form (all versions before 1.1.3) allows unauthenticated remote attackers to embed arbitrary HTML into the double opt-in verification email the application sends, using the form owner's configured sending identity and an attacker-specified recipient address. The root cause is unescaped interpolation of the subscriber-supplied first_name field directly into the HTML email body, confirmed by the patch commit which adds Django's escape() call. No active exploitation is confirmed in CISA KEV, but the Secur0 CNA advisory fully documents the injection point and patch version 1.1.3 is available.

Stored Cross-Site Scripting in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent (≤4.3.9) is exploitable by any authenticated subscriber-level WordPress user, allowing injection of persistent JavaScript that executes when a higher-privileged user such as an administrator views the affected content. The scope-changed CVSS metric (S:C) reflects the real danger: a successful payload can hijack an admin session, modify site content, or silently escalate attacker privileges. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Stored Cross-Site Scripting in the GeoDirectory WordPress plugin (versions <= 2.8.172) enables authenticated contributors to inject persistent malicious JavaScript into directory listings or plugin-managed content fields. When a higher-privileged user - such as an administrator - views the affected content, the injected script executes in their browser session under the application's origin, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though the low-complexity, network-reachable attack surface makes this a realistic threat on multi-contributor WordPress directory sites.

Stored Cross-Site Scripting in WP Tab Widget (WordPress plugin by MyThemeShop) allows authenticated contributors to inject persistent malicious scripts into tab widget content that execute in the browsers of other site users, including administrators. All versions up to and including 1.2.11 are confirmed affected per Patchstack and ENISA EUVD-2026-60930. The CVSS scope change metric (S:C) elevates the practical impact beyond the contributor's own session, enabling privilege escalation paths such as admin cookie theft. No public exploit identified at time of analysis.

Stored Cross-Site Scripting in the WordPress Table Of Contents Block plugin (versions up to and including 1.5.0) allows authenticated users with at least Contributor-level access to inject arbitrary JavaScript into post content via the block editor. Because the CVSS vector carries a changed scope (S:C), the injected payload executes in the browser context of any user - including administrators - who views the affected page, enabling session hijacking or privilege escalation. No public exploit code or CISA KEV listing is present in the available data, but the low attack complexity and broad administrator victim surface make this a meaningful risk for multi-author WordPress deployments.

Stored Cross-Site Scripting in the Typing Effect WordPress plugin (versions ≤ 1.3.7) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browsers of other users, including administrators, who visit affected pages. The CVSS vector (PR:L/UI:R/S:C) confirms the flaw is exploitable by low-privilege authenticated accounts and that the scope change elevates impact beyond the contributor's own session - enabling session hijacking or administrative action forgery. No public exploit code identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Stored Cross-Site Scripting in the Wufoo Shortcode WordPress plugin (versions 1.55 and earlier) allows authenticated Contributor-level users to inject persistent malicious JavaScript through the plugin's shortcode functionality. When a higher-privileged user - typically an administrator or editor - views the affected post or page, the script executes in their browser session, crossing the security boundary established by WordPress role separation. No public exploit code or active exploitation has been identified at time of analysis; however, the CVSS Scope:Changed metric confirms the impact extends beyond the contributor's own session.

Stored Cross-Site Scripting in the Video Conferencing with Zoom WordPress plugin (≤ 4.6.8) allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users such as editors or administrators. The CVSS scope-changed metric (S:C) confirms the injected payload crosses security boundaries, enabling session hijacking or unauthorized administrative actions against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, placing this as a medium-severity, authenticated attack vector requiring targeted abuse of contributor-level access.

Stored Cross-Site Scripting in the Login With Ajax WordPress plugin version 4.5.1 and earlier allows authenticated contributors to inject malicious scripts that execute in the browsers of higher-privileged users who view the affected content. The vulnerability carries a CVSS 3.1 score of 6.5 with scope change, meaning successful exploitation crosses the plugin's security boundary into the victim's browser session, enabling session token theft or unauthorized action execution. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and broad availability of the WordPress ecosystem make this a credible threat for sites with open contributor registration.

Stored Cross-Site Scripting in WPZOOM Forms - Contact Form Plugin for Gutenberg versions up to and including 2.0.4 allows authenticated Contributors to inject malicious JavaScript that executes in the browsers of higher-privileged users such as site administrators. The vulnerability stems from insufficient sanitization or escaping of user-supplied input before it is rendered in WordPress pages, a CWE-79 root cause confirmed by Patchstack and the ENISA EUVD entry EUVD-2026-60924. No public exploit identified at time of analysis and the flaw is absent from the CISA KEV catalog, but the Contributor-to-Administrator privilege escalation path makes this a meaningful risk on any multi-author WordPress deployment.

Stored Cross-Site Scripting in the Frontend Admin by DynamiApps WordPress plugin (versions up to and including 3.29.10) enables contributor-level authenticated users to inject persistent malicious scripts through frontend-rendered forms. When a higher-privileged user such as an administrator subsequently views the affected content, the payload executes in their browser session, potentially enabling session hijacking, unauthorized administrative actions, or credential theft. No CISA KEV listing or confirmed public exploit code has been identified at time of analysis, though the low-privilege entry point makes this a realistic and practical threat in multi-author WordPress environments.

Stored Cross-Site Scripting in the Featured Video Plus WordPress plugin (versions ≤ 2.3.3) allows contributor-role users to inject persistent malicious scripts into featured video fields. When a higher-privileged user such as an editor or administrator views the affected post, the script executes in their browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation has been confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in the Wise Chat WordPress plugin (versions <= 3.4) allows authenticated contributors to inject persistent malicious JavaScript that executes in the browser context of other site users, including administrators. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C) confirms this is network-exploitable at low complexity, requiring only contributor-level WordPress access and a victim loading the poisoned chat interface. No public exploit code or active exploitation has been identified at time of analysis.

Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.

Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

IN_PLACE sanitization bypass in DOMPurify before 3.4.13 enables persistent cross-site scripting after sanitize() returns, affecting any application that uses DOMPurify's documented element-removal hook pattern with IN_PLACE mode enabled. When a uponSanitizeElement or beforeSanitizeElements hook removes a node via node.remove(), DOMPurify's _sanitizeElements() exits that node's processing branch without invoking _neutralizeSubtree(), leaving descendant elements - including those carrying browser-queued event handlers such as img onload - outside both the returned DOM and the DOMPurify.removed list. A working proof-of-concept targeting DOMPurify 3.4.12 under Chromium is published in the official GHSA advisory; no active exploitation is confirmed in CISA KEV at time of analysis.

Stored XSS in Grav CMS before 2.0.14 allows authenticated page editors to bypass the save-time XSS detection gate by embedding a single invalid UTF-8 byte in page content, causing all PCRE /u-flagged patterns in Security::detectXss() to silently return false rather than flagging the payload. Any visitor who subsequently loads the affected page executes attacker-controlled JavaScript in their browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though the bypass mechanism is sufficiently documented in the vendor advisory that independent reproduction requires minimal effort.

Stored cross-site scripting in Grav CMS before 2.0.15 allows a low-privileged content contributor to inject arbitrary HTML and JavaScript into pages containing audio or video media elements, executing in the browser sessions of any viewer. The flaw originates in the sourceParsedownElement method, where media URL fragments are concatenated without escaping into rawHtml output. No public exploit is identified at time of analysis, but the CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated editor and a passive victim who views the crafted content.

Stored cross-site scripting in the Grav Form Plugin before version 9.1.19 allows authenticated form authors to embed persistent JavaScript payloads by supplying malicious content in field-definition properties - including prepend, append, spacer text, section text, and select option labels - which the form templates render verbatim via unescaped |raw filters and unquoted attributes. The injected script executes in every subsequent visitor's browser without any active deception required, making this a persistent, multi-victim condition for the life of the form definition. No CISA KEV listing or public exploit code has been identified at time of analysis, but the low-complexity exploitation path and PR:L privilege requirement make this a realistic threat in any Grav deployment where form-authoring access is granted to partially trusted users.

Script injection in Grav plugin-api before 1.0.15 enables authenticated users holding api.media.write permission to upload .svgz or .xhtml files that bypass the platform's SVG sanitizer, storing executable script payloads server-side. The sanitizer's incomplete extension check - recognizing only the exact string 'svg' - leaves these semantically equivalent vector/XML formats unprocessed, allowing stored cross-site scripting payloads to execute in the Grav site origin when subsequently accessed by administrators or visitors. No public exploit has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the mandatory low-privilege credential requirement and passive victim interaction.

Stored cross-site scripting in FileOrbis before version 16.5 allows authenticated low-privileged users to inject persistent malicious scripts into pages subsequently rendered for other users. When a victim browses to affected content while authenticated, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. Reported by TR-CERT; no public exploit identified at time of analysis, and the product does not appear in the CISA KEV catalog, indicating no confirmed active exploitation.

Cross-site scripting in Webkul Bagisto up to version 2.4.4 allows remote unauthenticated attackers to inject script-related HTML tags via the first_name or last_name parameters submitted to the /customer/register endpoint, with impact routed through the Customer-Registration Notification Email component. The CVSS 4.0 score of 2.1 reflects constrained real-world impact - user interaction is required and integrity impact is low - but a publicly available proof-of-concept on GitHub documents and lowers the bar for this attack. The vendor acknowledged the findings, confirming some issues have been addressed internally, though no specific patched release version has been publicly identified.

Reflected XSS in Reportico Web (versions up to and including 8.1.0) enables remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by crafting a malicious URL with a payload in the `reportico_criteria` parameter combined with `execute_mode=CRITERIA` on `run.php`. A public proof-of-concept is available per SSVC data, though no active exploitation is confirmed in CISA KEV. Successful exploitation requires social engineering the victim into clicking a crafted link, enabling session hijacking, credential theft, or malicious in-browser actions.

Stored cross-site scripting in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to inject persistent malicious JavaScript into the user documentation field, which then executes in the browsers of any users who view the affected content. The CVSS scope-change indicator (S:C) confirms that impact propagates beyond the injecting session to other authenticated users, enabling session hijacking, credential theft, or UI redressing. No public exploit confirmation or KEV listing is present, but a detailed researcher disclosure on GitHub (cert-rit, January 2026) documents the stored variant specifically.

Reflected XSS in reportico-web 8.1.0 and earlier allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted URL targeting the run.php endpoint with a malicious payload in the loadTemplate parameter combined with execute_mode=PREPARE. The CVSS vector (PR:N, S:C, UI:R) confirms no authentication is required from the attacker, though user interaction is needed, and the attack scope crosses into the victim's browser context. A public vulnerability research repository exists for this CVE, suggesting exploit code is likely available; no confirmed active exploitation via CISA KEV at time of analysis.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSHRM1.php, executing within the victim's browser session when a crafted link is followed. A public proof-of-concept exploit is available via a GitHub issue, lowering the practical bar for exploitation despite the low CVSS 4.0 score of 2.1. No active exploitation has been confirmed by CISA KEV; impact is bounded by mandatory user interaction and the browser-session scope of injected code.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript via the unsanitized `course` parameter in /BSCE2.php, executing in the context of a victim's browser upon interaction with a crafted link. A public proof-of-concept exploit exists (GitHub issue, VulDB reference), raising the practical exploitability above the base CVSS 4.0 score of 5.3 would suggest in isolation. No active exploitation is confirmed by CISA KEV, and real-world impact is substantially constrained by the product's narrow academic/student deployment footprint.

Stored XSS in the Pandora malware analysis platform's PDF download endpoint allows attacker-controlled JavaScript to execute in the security context of the application when an analyst views a crafted analysis task. An attacker submits a polyglot file that passes Pandora's content-based PDF detection but whose filename or extension causes Flask's send_file() to serve it with an active MIME type such as text/html, with no Content-Disposition: attachment header forcing browser download. Any victim with access to the analysis task who follows the PDF download link will have attacker-supplied script execute in their Pandora session, potentially exposing session data or enabling unauthorized actions. No public exploit identified at time of analysis; a patch is available via upstream commit 668ec65a93cee327e3d925da2698849c9e65625a.

Stored cross-site scripting in ApostropheCMS prior to 2.17.6 enables execution of arbitrary JavaScript in victim browsers through a parser-differential bypass in the bundled sanitize-html library. When `textarea` or `xmp` is included in a site's `allowedTags` configuration, a payload using a trailing solidus on the closing tag - such as `</textarea/>` - is treated as text by htmlparser2 10.x but as a valid close by spec-compliant browsers, causing injected markup like `<img onerror=...>` to execute as live HTML on page load. No public exploit repository has been identified and the vulnerability is not listed in the CISA KEV catalog, but a functional proof-of-concept payload is fully described in the upstream security advisory GHSA-jxwj-j7wr-gfrw; the fix ships in version 2.17.6.

Stored XSS in Etherpad's HTML export function allows any pad editor to execute arbitrary JavaScript in the browser of every collaborator who opens the exported document. The root cause is in `getHTMLFromAtext` (src/node/utils/ExportHtml.ts), where attribute-pool values routed through the `exportHtmlAdditionalTagsWithData` plugin hook are interpolated directly into span data-attributes without HTML escaping - reachable via the bundled ep_font_color or ep_font_size plugins. All ep_etherpad-lite npm releases through 1.8.14 are affected; vendor-released patch 3.3.0 is available. No public exploit tool has been identified at time of analysis, though the GHSA advisory contains a working payload example that significantly lowers the exploitation barrier.

Cross-site scripting in JetBrains PyCharm's Quick Documentation rendering feature (before version 2026.2.1) enables code execution within the IDE process when a developer inspects documentation for a symbol from a maliciously crafted source. Attackers - including supply-chain adversaries embedding malicious HTML or JavaScript into Python package docstrings - can achieve code execution in PyCharm's local process context once the victim triggers Quick Documentation on an affected symbol. No public exploit has been identified at time of analysis, and JetBrains has released a fix in version 2026.2.1.

Stored XSS in Roundcube Webmail's 'Add to address book' feature allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browser sessions of other users who trigger the affected action. Affected versions span the 1.6.x branch before 1.6.18 and the 1.7.x branch before 1.7.3, both patched on 2026-08-09 per vendor advisory. No public exploit code or CISA KEV listing has been identified at time of analysis, though stored XSS in webmail clients historically enables session hijacking and unauthorized mail access with low attacker effort.

DOM-based Cross-Site Scripting in OutSystems Service Center (all versions before 11.41.2) allows a low-privileged authenticated user to inject malicious JavaScript by uploading a file with a crafted filename, which executes in the browser context of other users - typically higher-privileged administrators - who subsequently view the rendered filename. The flaw affects every file attachment location within Service Center. OutSystems has released a vendor patch in version 11.41.2; no public exploit code or active exploitation has been identified at time of analysis.

Reflected cross-site scripting in code-projects Online Shopping System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the email argument in offersmail.php. The vulnerability requires no authentication (PR:N per CVSS 4.0 vector) but does require a victim to interact with a crafted link or page (UI:P). Publicly available exploit code exists on GitHub, though no active exploitation has been confirmed by CISA KEV.

Cross-site scripting in Webkul Bagisto's RMA Message Handler (versions 2.4.0-2.4.4) allows authenticated customers to inject arbitrary JavaScript via the message argument at the /customer/account/rma/send-message endpoint, with execution occurring in the browser of any privileged user (e.g., store administrator) who reviews the RMA thread. A public proof-of-concept exploit is available on GitHub, lowering the exploitation barrier. The vendor has acknowledged the issues were already identified internally, with partial fixes applied and remaining items deferred to upcoming releases - no confirmed patched version has been published.

Cross-site scripting in the Alaev SEO Tools Chrome Extension (versions up to 1.0.10) exposes users to script injection via the popup UI's addDiv function, which fails to sanitize externally sourced page SEO field data before inserting it into the DOM. A working proof-of-concept exploit is publicly available on GitHub, demonstrating injection through crafted page metadata. The vendor did not respond to responsible disclosure, and no patch has been released, leaving all users of affected versions without an official fix.

Cross-site scripting in Squirro Cognitive Search versions prior to 3.14.2 allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via three distinct application functions: Email Notification, Create Evaluation Sets, and HTML Editor. The CVSS scope change (S:C) indicates the injected script executes outside the originating security context, enabling session hijacking, credential theft, or malicious action on behalf of authenticated users. No public exploit identified at time of analysis, though a researcher-published CVE entry with supporting materials exists on GitHub at Henkel-CyberVM/CVEs, suggesting active investigation of the vulnerability.

Cross-site scripting in JeecgBoot v3.9.2's AI RAG chat upload endpoint allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in the browsers of users who interact with the malicious content. The CVSS 6.1 (Medium) vector confirms Changed Scope, enabling session hijacking, credential theft, or authenticated action hijacking against victims. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) indicates negligible current exploitation activity; this is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in the Bold Page Builder WordPress plugin (all versions through 5.6.8) allows authenticated attackers holding contributor-level access or above to persist arbitrary JavaScript via the bt_bb_shortcode shortcode, executing in any victim's browser upon page visit. The scope change (S:C in the CVSS vector) reflects that injected scripts run in the victim's browser security context rather than the WordPress server, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; however, a patch commit is available on the WordPress plugin SVN repository.

Stored Cross-Site Scripting in the Masteriyo LMS WordPress plugin (all versions before 2.3.3) allows instructor-role users to inject persistent malicious scripts into quiz fields that execute in the browsers of any page visitor, including administrators. The vulnerability stems from the plugin granting instructors unfiltered HTML storage capability without sanitizing or escaping output, creating a privilege-escalation path from instructor to effective administrator compromise via session hijacking. A publicly available proof-of-concept exists per WPScan; EPSS is low at 0.16%, and the flaw is not listed in CISA KEV, though POC availability elevates practical risk for unpatched single-site deployments.

Stored cross-site scripting in the Divi WordPress theme (versions 5.0 through before 5.9.0) allows any contributor-role user to inject persistent JavaScript into the Social Media Follow module's link attributes, which executes in the browser of any higher-privileged user - including administrators - who subsequently views the affected post. A publicly available proof-of-concept exploit exists per WPScan, and the scope-changed CVSS vector (S:C) confirms the injected script runs in the victim's privileged session context rather than the attacker's. Vendor-released patch version 5.9.0 is available and should be applied immediately.

Stored Cross-Site Scripting in the Smash Balloon Social Post Feed WordPress plugin (all versions through 4.9.0) allows authenticated attackers holding at minimum a Contributor role to inject arbitrary JavaScript via the 'id' shortcode attribute, which then executes in the browser of any user who visits the compromised page. The CVSS Scope:Changed designation reflects that injected scripts escape the plugin's trust boundary and execute within victims' browser sessions, enabling session hijack or privilege escalation against higher-privileged users such as administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, though a fix commit (changeset 3640517) has been applied to the plugin's trunk branch per WordPress plugin Trac.

Stored Cross-Site Scripting in the Snippet Shortcodes WordPress plugin (all versions through 5.2.0) allows any authenticated WordPress user with at least contributor-level access to inject persistent malicious scripts via unsanitized shortcode attributes. Once injected, the payload executes in the browser of any user who visits the affected page, including administrators, enabling session hijacking or privilege escalation. No active exploitation has been confirmed by CISA KEV, and no public exploit code is explicitly referenced in available intelligence; however, the Wordfence threat advisory and WordPress plugin trac source references document the vulnerability thoroughly.

Stored Cross-Site Scripting in the SureDash WordPress plugin (versions up to and including 1.10.3) allows authenticated contributor-level users to persist malicious scripts via the 'draweropenverposition' block/shortcode attribute. The flaw is exploitable because the plugin stores raw attribute values inside block-delimiter HTML comment JSON, which WordPress's wp_kses_post filter does not sanitize on save; at render time the value is interpolated into a style attribute without esc_attr() escaping, enabling a double-quote to escape the attribute context and inject arbitrary HTML event handlers. No public exploit has been identified at time of analysis, and no KEV listing is present, but the low privilege barrier (contributor role) makes this a realistic threat on any multi-author or membership WordPress site.

Stored Cross-Site Scripting in the YouTube Showcase WordPress plugin (versions up to and including 4.0.4) allows authenticated attackers with Author-level access to inject persistent malicious scripts via the `emd_mb_meta` shortcode. The flaw originates in two helper methods: `EMD_MB_Helper::image_info()` at helpers.php:L72 returns a raw, unsanitized attachment `post_title`, which `EMD_MB_Helper::shortcode()` at helpers.php:L274 then interpolates directly into an HTML `title` attribute using `sprintf()` without calling WordPress's standard `esc_attr()` function. No public exploit code or CISA KEV listing has been identified at time of analysis, but the scope-changed CVSS vector and the relatively low Author-level access bar make this an actionable patch priority for multi-author WordPress deployments.

Stored Cross-Site Scripting in the Toocheke Companion WordPress plugin (versions up to and including 2.10) allows authenticated contributors to inject persistent malicious scripts that execute in the WordPress admin dashboard. The vulnerability arises from a two-stage failure: the `toocheke_series_bg_color_save()` function stores raw, unsanitized POST input, and the series admin column renderer concatenates that value directly into a style attribute without `esc_attr()` escaping. When a site administrator views the series list table, the stored payload executes in their browser context, enabling session hijacking, credential theft, or further privilege escalation within the WordPress installation. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.