Cross-Site Scripting

Stored Cross-Site Scripting in the Serious Slider WordPress plugin (all versions up to and including 1.4.0) allows authenticated contributors to inject persistent malicious scripts via the 'theme' shortcode attribute, which then execute in the browser of any user who subsequently visits the affected page. The flaw originates from insufficient sanitization and output escaping in multiple code paths within inc/shortcodes.php, as confirmed by Wordfence and EUVD-2026-59867. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Stored Cross-Site Scripting in the Advanced File Manager WordPress plugin (versions up to and including 5.4.12) allows unauthenticated network attackers to inject persistent malicious scripts via the unsanitized 'soundFile' parameter in elFinder.js. Successful exploitation grants script execution in an authenticated WordPress administrator's browser context, enabling session hijacking, credential theft, or administrative action abuse. No public exploit code or CISA KEV listing has been identified at time of analysis, and real-world impact is substantially constrained by a non-trivial domain-prefix precondition detailed below.

Stored XSS in the Loco Translate WordPress plugin (versions up to and including 2.8.7) allows authenticated users holding the translator role or above to inject persistent malicious scripts via crafted PO file extracted comments. When an affected translation page is subsequently loaded by another authenticated user - including site administrators - the stored payload executes in that user's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis; a fix commit is confirmed in the WordPress plugin trac repository, and the Wordfence advisory provides the authoritative disclosure record.

Stored Cross-Site Scripting in the Quiz and Survey Master (QSM) WordPress plugin through version 11.2.1 allows authenticated attackers holding at minimum a contributor role to inject persistent JavaScript payloads via the 'question_title' parameter. The injected script executes in the browser of any user who subsequently views a page containing the poisoned quiz, enabling session hijacking, credential harvesting, or unauthorized administrative actions. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; however, the scope change noted in the CVSS vector underscores that impact crosses the boundary from the injecting contributor into every visiting user's browser context.

Stored Cross-Site Scripting in the Gravity Booster - Styles & Layouts for Gravity Forms WordPress plugin (versions ≤ 5.26) allows authenticated attackers with editor-level permissions to inject persistent malicious scripts into admin settings fields. The injected payload executes in the browser of any user who subsequently visits an affected page, enabling session hijacking, credential theft, or further privilege escalation within the WordPress environment. Exploitation is constrained to multi-site WordPress installations or single-site deployments where the unfiltered_html capability has been explicitly disabled; no public exploit or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the Weblizar Admin Custom Login WordPress plugin (all versions ≤ 3.6.4) allows an authenticated administrator to inject persistent malicious scripts into the WordPress login page, which then execute in the browsers of any user who visits it - including unauthenticated visitors. The vulnerability is conditionally exploitable: it only manifests on WordPress multi-site networks or single-site installations where the unfiltered_html capability has been explicitly revoked from administrators, both non-default configurations. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting in code-projects Online Shopping System 1.0 allows remote low-privileged attackers to inject arbitrary JavaScript into victim browsers via the unsanitized `amount_1` parameter in `/checkout.php`, enabling session hijacking, credential theft, or UI manipulation against users who interact with the crafted response. The affected product is a PHP-based e-commerce application distributed by code-projects.org, with the vulnerability tracked exclusively through VulDB. A public proof-of-concept exploit has been released on GitHub, elevating the practical risk beyond the moderate CVSS 4.0 score of 5.1 suggests in isolation.

Cross-site scripting in code-projects Online Food Order System 1.0 allows authenticated remote attackers to inject malicious scripts via the dname parameter in edit_food_items.php. When a separate victim user views the manipulated food item entry, the injected script executes within their browser session. Publicly available exploit code exists per a GitHub proof-of-concept, though no active exploitation has been confirmed by CISA KEV.

Stored cross-site scripting in SourceCodester Online Book Store System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the System Settings Module at /admin/index.php?page=site_settings, which subsequently executes in the browser of any user who loads the affected settings page. A public proof-of-concept has been disclosed (CVSS 4.0 E:P modifier confirmed), though the CVSS 4.0 base score of 1.9 reflects the significant constraint of requiring prior administrative access. No active exploitation has been identified in CISA KEV, and no vendor-issued patch is confirmed at time of analysis.

Stored cross-site scripting in the ECS WordPress plugin before 4.3.8 allows a Contributor-level user to inject arbitrary JavaScript into any post - including administrator-authored pages - by exploiting missing authorization and object-ownership checks on the Dynamic Repeater AJAX handlers. The plugin gates these endpoints solely with a capability-agnostic nonce distributed through the Elementor editor, making them reachable by any edit_posts user who can then write unsanitized data-source bindings that execute in the browser of any visitor or administrator who views the affected page. No public exploit has been confirmed and EPSS sits at 0.15% (5th percentile), but the low privilege bar and potential to chain into admin account takeover make patching to 4.3.8 a straightforward and time-sensitive action.

Stored Cross-Site Scripting in the Hydra Booking WordPress plugin (all versions ≤ 1.2.2) allows injection of arbitrary web scripts via the unsanitized `first_name` parameter in host profiles, with payloads executing against any visitor who loads the affected host archive pages. Although the CVSS vector assigns PR:L, the plugin's public Signup shortcode permits any site visitor to self-register as a `tfhb_host`, collapsing the practical exploitation barrier to effectively unauthenticated. No CISA KEV listing or public exploit code has been identified at time of analysis, and an upstream fix commit (SVN changeset 3632543) is available in the WordPress plugin repository.

Stored Cross-Site Scripting in Beaver Builder Page Builder for WordPress (all versions up to and including 2.10.2.2) allows authenticated users at Author level or above to permanently inject arbitrary JavaScript via the Button Module's Button Code field. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or drive-by malware delivery across the site's entire visitor population. No active exploitation is confirmed in the CISA KEV catalog, and no public proof-of-concept exploit has been identified at the time of analysis.

Cross-site scripting in IBM Db2 Mirror for i 7.4, 7.5, and 7.6 enables a remote low-privileged authenticated attacker to inject and execute arbitrary scripts in a victim user's browser session via the product's web interface. The CVSS vector (I:H) indicates that successful exploitation can result in high-integrity impact - such as unauthorized administrative actions or session hijacking - when a higher-privileged user interacts with attacker-controlled content. No public exploit code and no confirmed active exploitation have been identified at the time of analysis.

Stored XSS in Red Hat migration-planner allows an authenticated attacker to inject a malicious `javascript:` URI into the `AgentStatusUpdate.CredentialUrl` field, which executes in a victim's browser session when viewed through the Hybrid Cloud Console. The attack enables session hijacking and sensitive data disclosure with high confidentiality impact. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored cross-site scripting in Grav CMS versions 1.5.2 through 2.0.12 allows authenticated page editors lacking admin.super privileges to bypass the built-in XSS filter by embedding a literal `>` character inside a quoted HTML attribute value, exploiting a regex blind spot in `Security::detectXss()` that causes the detector to consider the tag closed while browsers continue parsing it and execute a trailing event handler such as `onerror`. The crafted payload is accepted, persisted server-side, and executes in the site origin every time any visitor - including unauthenticated users - views the affected page. No public exploit has been identified at time of analysis; vendor-released patch is available in Grav 2.0.13.

Stored cross-site scripting in the Grav Form Plugin before version 9.1.15 allows authenticated form authors to inject arbitrary HTML and JavaScript into radio and toggle field option labels, which then execute in the browsers of any visitor or administrator rendering that form. The root cause is Twig's |raw filter being applied to user-controlled label content, bypassing the template engine's automatic output encoding. No public exploit code or active exploitation has been identified at time of analysis; the CVSS 4.0 score of 5.1 accurately reflects the requirement for prior authentication with form-authoring privileges.

Stored cross-site scripting in the Embed Google Photos album WordPress plugin (all versions through 2.2.1) allows authenticated Contributor-role users to inject arbitrary JavaScript via an unescaped shortcode attribute rendered directly into an HTML attribute context. The injected script executes silently in the browser of any user who views the affected post, including administrators, enabling session hijacking and potential full site takeover. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects negligible current exploitation activity.

Stored XSS in Trix editor (all versions prior to 2.1.18) allows an authenticated low-privilege user to persist a javascript: URI payload via the paste path, which executes in victim browsers when the rendered content is viewed and the injected link is clicked. The entry vector exploits HTMLParser's mishandling of a crafted <span data-trix-attachment="{}"> element, which bypasses attachment processing and routes unvalidated attributes - including a malicious href - into the document model through StringPiece.fromJSON. No public exploit has been identified and the vulnerability is absent from CISA KEV; a vendor-confirmed fix is available in version 2.1.18.

Stored cross-site scripting in Worksuite SaaS Asset Management allows authenticated administrators to persist arbitrary JavaScript into the application database via the Location and Description fields of the asset creation form. All users who subsequently view an affected asset - regardless of their own privilege level - will execute the injected script in their browser, enabling session hijacking, credential theft, and unauthorized actions performed within their authenticated session context. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 4.6 (Medium) reflects the high-privilege prerequisite that meaningfully constrains the attack surface.

Cross-site scripting via JavaScript regexp context tracking bypass in Go's html/template standard library package allows injection of arbitrary content into rendered HTML pages. The template engine's context tracker incorrectly handles an unescaped forward-slash delimiter in pathological inputs, causing premature exit from the JavaScript regexp parsing context and permitting attacker-controlled data to be emitted as raw, unescaped JavaScript. All Go releases prior to 1.26.6 and 1.25.13 are affected; no public exploit has been identified at time of analysis and this CVE is not listed in CISA KEV.

Stored XSS in django-helpdesk before 2.3.3 enables unauthenticated external attackers to inject arbitrary JavaScript into the authenticated staff interface by submitting HTML-formatted ticket email bodies or uploading .html/.htm file attachments through the public-facing ticket submission channel. The payload persists in the helpdesk database and executes in the browser session of any staff member who opens the attachment during routine triage, enabling session hijacking, credential exfiltration, or unauthorized actions performed under the staff member's identity. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Stored cross-site scripting in NodeBB before 4.15.0 allows any federated ActivityPub actor to inject persistent malicious JavaScript into forum posts viewed by all subsequent users. The renderEmoji function fails to HTML-encode tag.icon.url and tag.name values sourced from incoming ActivityPub Create/Note objects before writing them into stored post content, creating a durable XSS sink reachable from the open Fediverse. A vendor-released patch exists in NodeBB v4.15.0 (2026-08-12); no public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected XSS in Next AI Draw.io 0.2.1 through 0.4.16 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the localhost origin by crafting malicious URLs containing a payload in the unsanitized `mcp` query parameter. Successful exploitation - which requires a victim to click the crafted link - enables theft of diagram session tokens and API credentials accessible within that browser origin. Publicly available exploit code exists (GitHub issue #917 via VulnCheck), though no CISA KEV listing confirms active exploitation at time of analysis.

Cross-site scripting in rails-html-sanitizer 1.0.3-1.7.0 allows external SVG references to bypass sanitization when applications use non-default allowed tags including SVG reference elements such as 'use' or 'feImage'. The PermitScrubber correctly blocked external hrefs via the legacy 'xlink:href' attribute but failed to apply the same restriction to the SVG 2 plain 'href' attribute, which modern browsers also honor. Exploitation via 'use' requires the external SVG to be same-origin for script execution; 'feImage' enables cross-origin image loading for user tracking. No public exploit or CISA KEV listing exists at time of analysis.

Stored cross-site scripting in the Markdown renderer of maalfer Pentestify before v2.3.2 allows authenticated users to inject and execute arbitrary JavaScript within the application's origin by embedding a double-quote character inside a Markdown link URL. The front-end `markdownToHtml()` function escaped `&`, `<`, and `>` but omitted quote escaping, so a `"` in a user-supplied URL closes the surrounding `href` attribute and enables injection of HTML event handlers. The fix in v2.3.2, confirmed by commit 272f7d6 and a tagged GitHub release, adds `&quot;` and `&#39;` escaping to close the gap. No public exploit has been identified at time of analysis, and this CVE is not in the CISA KEV catalog.

Stored XSS in Zimbra Collaboration Classic Web Client before 10.1.17 enables remote, unauthenticated attackers to deliver malicious JavaScript via crafted email attachments, which executes in the victim's browser session upon inline preview. Affected organizations running ZCS versions prior to 10.1.17 are exposed to session hijacking, unauthorized webmail actions, and data exfiltration without the attacker needing any account on the target system. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at time of analysis, but the email delivery vector requires no attacker foothold and lowers the exploitation barrier significantly.

Cache-poisoning XSS and open redirect in Etherpad (ep_etherpad-lite 2.1.0-3.0.0) stem from unsanitized reflection of the attacker-controlled `x-proxy-path` HTTP request header into admin HTML/JS/CSS assets and into a 302 Location target. The most severe vector is cache-poisoning: because no `Vary: x-proxy-path` header was emitted, a CDN or shared reverse proxy caches a single attacker-crafted response and serves the injected script to every authenticated admin who subsequently loads `/admin/index.html`, requiring no further attacker involvement. The timeslider redirect independently allows open redirect via protocol-relative URL injection (`//evil.example`). No CISA KEV listing is confirmed; a working PoC curl command is published in the GitHub advisory GHSA-fjgc-3mj7-8rg8.

Stored Cross-Site Scripting in GiveWP's donor data handling allows a low-privileged attacker to inject malicious JavaScript into donor-submitted fields that executes in a privileged user's browser when donation records are viewed. All GiveWP installations running versions prior to 4.16.6 are affected. The CVSS scope change (S:C) indicates the injected script can operate outside the donor submission context - most likely executing within an administrator's session, enabling session hijacking or unauthorized admin actions. No public exploit or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in WP Data Access WordPress plugin versions up to and including 5.5.79 is exploitable by users holding the WordPress Author role, allowing them to inject persistent malicious scripts into content managed by the plugin. When a higher-privileged user such as an administrator views the affected output, the attacker's JavaScript executes in that user's browser context - a cross-boundary impact reflected in the Changed scope (S:C) of the CVSS vector. Reported by Patchstack and catalogued under ENISA EUVD-2026-57910, no public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in the Featured Image from URL WordPress plugin (versions up to and including 5.3.3) allows authenticated Contributors to inject malicious scripts into pages viewed by higher-privileged users such as editors or administrators. The vulnerability resides in insufficient output encoding of user-supplied URL input used for featured images, giving attackers a foothold for privilege escalation or session hijacking within the WordPress admin context. No public exploit code or CISA KEV listing has been identified at time of analysis, but the Contributor-level access requirement makes this realistic in any multi-author WordPress site.

Stored Cross-Site Scripting in WpBookingly (WordPress plugin by MagePeople Team, versions ≤ 1.3.2) allows a low-privileged attacker - such as an external customer submitting a booking request - to inject malicious scripts into customer-facing input fields that are later rendered unsanitized in the WordPress admin panel. When an administrator views the poisoned booking data, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized admin-level actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the network-accessible, low-complexity attack surface makes this a meaningful risk for any site accepting public booking submissions.

Stored Cross-Site Scripting in the Accordion WordPress plugin (versions <= 3.0.6) allows authenticated subscriber-level users to inject malicious JavaScript into accordion content fields, which then executes in the browser of any higher-privileged user who views the affected page. The scope change (S:C in CVSS) confirms the attack pivots from the subscriber's input to the victim's browsing session, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and subscriber-level access requirement make this a realistic threat on sites with open user registration.

Subscriber-level Cross-Site Scripting in FluentCommunity (WordPress plugin) versions up to and including 2.7.5 allows authenticated users with subscriber-level access to inject malicious scripts that execute in the browser context of other users, including administrators. The scope change (S:C in CVSS) indicates the injected payload affects a different security principal than the attacker, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low privilege requirement and network-accessible attack surface make this a realistic threat for multi-user WordPress deployments running community features.

Cross-site scripting in the AfterShip Tracking WordPress plugin (versions ≤ 1.18.1) enables subscriber-level authenticated users to inject malicious scripts that execute in the browsers of other site visitors or administrators. The CVSS scope change (S:C) confirms the injected payload executes outside the attacker's own session context, making administrator session hijacking the primary impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Stored cross-site scripting in the Profile Extra Fields by BestWebSoft WordPress plugin (versions ≤1.3.4) allows an authenticated subscriber-level user to inject arbitrary JavaScript into custom profile fields, which then executes in the browser of any higher-privileged user who views the affected profile - including site administrators. The scope-changed impact (S:C) is the key risk multiplier: a minimally privileged attacker can potentially hijack admin sessions or perform unauthorized actions on behalf of victims. No public exploit code or active exploitation has been identified at time of analysis.

Subscriber-level cross-site scripting in AcyMailing SMTP Newsletter plugin (versions up to and including 10.11.1) enables a low-privileged authenticated user to inject malicious script payloads that execute in the browser context of higher-privileged site users, such as administrators. The changed-scope CVSS vector (S:C, PR:L, UI:R) is consistent with stored XSS where subscriber-submitted content persists and fires when an administrator reviews it in the WordPress backend, enabling session hijacking or unauthorized administrative actions. No public exploit code and no active exploitation have been identified at time of analysis.

Cross-site scripting in the Popup by Supsystic WordPress plugin (all versions up to and including 1.11.2) enables script injection into pages viewed by other users, with the injected code executing in the victim's browser under a changed scope. Reported by Patchstack and tracked as EUVD-2026-57935, the vulnerability carries a CVSS base score of 6.5 with Changed Scope, meaning successful exploitation crosses the security boundary between the plugin and the victim's browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and network-accessible attack vector make it straightforward to weaponize given the right conditions.

Stored XSS in Pentestify's user management component (all versions before 1.1.1) enables an authenticated attacker to execute arbitrary JavaScript in another authenticated user's browser by registering a crafted username containing an HTML-encoded single quote. The escapeHTML() sanitizer in js/app.js encodes the character to &#39;, but the browser HTML-decodes attribute values before the JavaScript engine parses the onclick handler, causing the encoded quote to reconstitute as a literal quote and break out of the JS string literal at runtime. No public exploit code has been confirmed at time of analysis, though the GitHub commit diff fully discloses the vulnerable code path and bypass technique, substantially lowering the bar for independent reproduction.

Reflected cross-site scripting in Serendipity CMS versions 2.3.5 through 2.6.0 enables arbitrary JavaScript execution in a victim's browser via the clean-URL search route. The flaw in include/functions_routing.inc.php's serveSearch() inverts the sanitization order - urldecode() runs after htmlspecialchars() and strip_tags(), so a URL-encoded payload survives HTML encoding intact and is decoded back into executable markup before page rendering. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 2.6.1.

Stored Cross-Site Scripting in the PPWP - Password Protect Pages WordPress plugin (all versions through 1.9.21) allows authenticated contributors to inject persistent malicious scripts via unsanitized `ppwp` shortcode attributes. Insufficient input sanitization and output escaping in the plugin's shortcode handler and view template enable payload persistence in the WordPress database, firing in the browsers of any subsequent visitor - including administrators - to affected pages. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.

Cross-site scripting in Loofah 2.25.0-2.25.1 is possible when applications call `Loofah::HTML5::Scrub.allowed_uri?` directly with HTML-encoded strings, because the method fails to detect `javascript:` or `vbscript:` schemes disguised via semicolon-less numeric character references such as `&#58` (colon) or `&#9` (tab). This is a bypass of the prior fix in GHSA-46fp-8f5p-pf2m, which covered semicoloned references (`&#58;`) but not the semicolon-less form that browsers still decode and execute. Loofah's default `sanitize()` path is not affected; only direct callers of the string-level `allowed_uri?` API - including Action Text 8.2's markdown link validation - are at risk. No public exploit identified at time of analysis; CVSS 4.0 scores this 2.3, reflecting narrow attack surface and high exploitation complexity.

SVG href attribute bypass in Loofah prior to 2.25.2 allows a crafted sanitized SVG to reference arbitrary same-origin external documents, defeating the HTML5 sanitizer's local-reference restriction. Applications accepting user-supplied SVG content and rendering it to other users are directly affected: SVG use elements can load and render same-origin external SVG containing scripts, while feImage elements can silently fetch external images for tracking. No public exploit or CISA KEV listing exists at time of analysis, but the bypass technique is straightforward and publicly disclosed via the GHSA advisory and PR diff.

Cross-site scripting in Trix editor prior to 2.1.18 allows DOM injection via unsanitized `javascript:` URIs deserialized from attacker-controlled JSON payloads during drag-and-drop operations. The vulnerable path exists exclusively in environments using the Level0InputController fallback - such as embedded WebViews lacking Input Events Level 2 support - where `StringPiece.fromJSON` applied `href` attributes from `application/x-trix-document` JSON directly to anchor elements, bypassing the DOMPurify checks that protected the HTML serialization path. No public exploit or active exploitation (CISA KEV) has been identified; the CVSS 4.0 score of 2.1 accurately reflects the constrained exploitability.

Reflected XSS in Astro's server-side View Transition CSS generator affects all server-rendered or on-demand Astro applications running versions 2.9.0 through 7.0.9. The framework interpolates attacker-controlled animation property values (such as duration, easing, delay, direction, fillMode, and name) directly into an inline <style> element without CSS or HTML escaping, allowing a crafted value containing </style> to break out of the style context and inject arbitrary HTML or JavaScript. A public proof-of-concept exists per the GHSA advisory; no public exploit identified at time of analysis beyond that PoC. The issue is fixed in Astro 7.1.0.

Cross-site scripting in IBM i 7.3 through 7.6 allows a remote authenticated attacker to inject and execute arbitrary JavaScript in the browser context of another user by exploiting improper neutralization of user-controlled input in a web interface component. The CVSS Scope:Changed (S:C) metric confirms the XSS payload escapes the IBM i application and executes in the victim's browser, enabling session hijacking, credential theft, or unauthorized page manipulation. No public exploit code or active exploitation has been identified at time of analysis; IBM has released a remediation via vendor advisory.

Stored XSS in the Draft List WordPress plugin (versions ≤2.6.3) allows a Contributor-level authenticated user to inject persistent JavaScript into public-facing pages by exploiting a sanitization ordering flaw in the [drafts] shortcode and widget template engine. The plugin sanitizes the template string before substituting the {{draft}} placeholder with the raw post_title, meaning a crafted title containing a double-quote can break out of an HTML attribute context and execute arbitrary JavaScript in the browsers of visitors who load the affected page. Version 2.6.4 resolves the issue; no public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected cross-site scripting in ScadaLTS 2.7.8.1 enables an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL that causes the application to echo unsanitized user-supplied input into an HTML response. Because SCADA operators - the likely victims - typically hold privileged authenticated sessions controlling industrial processes, successful exploitation could lead to session token theft, credential harvesting, or unauthorized commands issued through the victim's browser context. No public exploit code and no CISA KEV listing are identified at time of analysis, but the SCADA operational environment elevates the realistic impact of even a medium CVSS score.

Stored XSS in Craft CMS's control panel allows a low-privilege author to execute arbitrary JavaScript in an administrator's authenticated session by injecting a malicious payload into a draft name, which is rendered without HTML encoding in element chips and cards. All Craft CMS installations running versions 5.0.0-RC1 through 5.10.8 (exclusive) are affected. An attacker who can create element drafts can harvest the administrator's CSRF token and issue privileged control-panel actions - including creating new administrator accounts - without the victim taking any action beyond routine browsing of element indexes or relation fields. No public exploit identified at time of analysis, though the vendor's GHSA advisory verified the account-creation impact end-to-end.

Stored cross-site scripting in IBM i versions 7.3 through 7.6 allows an authenticated low-privileged user to inject persistent JavaScript into the Web UI, executing it in other users' browser sessions within the same trusted environment. The Scope:Changed CVSS metric confirms the payload crosses session boundaries, enabling credential theft or session hijacking against other authenticated users. IBM has released a patch via advisory node/7283292; no public exploit code or active exploitation has been identified at time of analysis.

Cross-site scripting in Apache Allura's Markdown rendering (versions 1.10.0 up to but not including 1.19.1) allows an attacker to inject script-related HTML into content that other users view, executing arbitrary JavaScript in their browsers. Because Allura is a collaborative forge where users routinely post Markdown in tickets, wiki pages, and comments, the payload is most likely stored and delivered to victims who open the affected page. No public exploit identified at time of analysis, and there is no CISA KEV listing or POC signal; the Apache PMC has released version 1.19.1 as the fix.

Cross-site scripting (XSS) in Apache Allura's code-display feature allows an attacker who can place crafted content into a rendered code view to execute arbitrary JavaScript in the browser of any user who views that code, in all versions before 1.19.1. Because Allura is forge/project-hosting software, a successful attack can hijack the sessions of project members or administrators. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

DOM-based cross-site scripting in Nagios Core (before 4.5.14) and Nagios XI (before 2026R1.7) allows an authenticated low-privileged attacker to execute arbitrary JavaScript in the browser of any user who views pages rendered by the vulnerable jsonquery.js component. The flaw is stored rather than reflected, meaning injected payloads persist server-side and activate without requiring a victim to follow a crafted link. No CISA KEV listing and no public exploit code have been identified at time of analysis; the vendor has released patches for both product lines.

Reflected cross-site scripting in Nagios Core before 4.5.14 and Nagios XI before 2026R1.7 allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of an authenticated victim. The injection point is the NagFormId parameter in cmd.cgi, which is insufficiently sanitized before being reflected in server responses. No public exploit or active exploitation has been identified at time of analysis, but the low attack complexity and zero-privilege requirement for the attacker make phishing-style delivery straightforward against administrators of these monitoring platforms.

DOM-based cross-site scripting in Material for MkDocs versions 7.2.0 through 9.7.6 allows remote attackers to execute arbitrary JavaScript within a documentation site's origin by crafting a malicious `q` URL parameter targeting the optional search.suggest feature, which requires a single click from the victim to trigger. The vulnerability is confined to sites that have explicitly enabled the search.suggest feature, and exploitation results in Low confidentiality and integrity impact scoped to the affected origin. No public exploit code or active exploitation (CISA KEV) has been identified; the vendor released a confirmed patch in version 9.7.7.

Reflected XSS in LibreNMS 26.4.0 and earlier allows an authenticated attacker to inject arbitrary JavaScript into any victim's browser session by embedding a payload in the GET parameters `instance` or `vmid` of the Proxmox application module. The root cause is unsafe PHP string interpolation of unsanitized GET input directly into a `document.title` JavaScript assignment in `LegacyController.php:75`, bypassed with a simple single-quote injection. A working proof-of-concept demonstrating cookie exfiltration is publicly documented in the GitHub security advisory GHSA-jmqm-f8q4-v7wx; this CVE is not in CISA KEV.

Stored cross-site scripting in Prowler's HTML report formatter (all versions prior to 5.37.0) allows any cloud principal with resource tag-write permissions to inject arbitrary HTML or JavaScript that executes when a security operator opens the generated report. The flaw resides in prowler/lib/outputs/html/html.py, where resource tags assembled via unroll_dict and parse_html_string were interpolated into HTML table cells without HTML entity escaping. No public exploit identified at time of analysis; a vendor-released patch is available in version 5.37.0.

Stored cross-site scripting in Vulnerability-Lookup's render_tag_badges Jinja filter allows an authenticated user holding the vulnerability:create or vulnerability:modify permission to persist arbitrary JavaScript in public vulnerability record pages by submitting crafted reference tags via the CNA API. The flaw stems from markupsafe.Markup being applied to attacker-controlled tag values before HTML escaping, effectively suppressing Jinja's automatic sanitization and causing the payload to execute in any visitor's browser - including unauthenticated users - upon page load. No public exploit has been identified at time of analysis beyond the functional XSS payload embedded in the fix's test suite; a patch is available as upstream commit d29901655c50cf3c25737d9ea86180268df51b57.

Stored cross-site scripting in Ultimate POS (Stock Management & Point of Sale) version 7.2 and earlier enables low-privileged authenticated attackers to compromise higher-privileged user sessions by injecting script payloads into the first-name field at account creation time. When the attacker submits a leave request through the HRM/Leave module, the unsanitized first-name payload is rendered in the leave-application notification pane of any administrator or manager who views it, executing within the admin browser origin and enabling session theft or unauthorized administrative actions. A researcher-published proof-of-concept is publicly available; no CISA KEV listing has been confirmed at time of analysis.

Stored Cross-Site Scripting in the Royal Addons for Elementor WordPress plugin (all versions before 1.7.1065) allows authenticated users holding the Contributor role or higher to inject persistent malicious scripts by supplying an unsanitized value in a widget setting that is written directly into an HTML tag. When a higher-privileged user such as an administrator subsequently views the affected page, the injected script executes in their browser session. A publicly available proof-of-concept exists and EPSS is 15%, placing this above the median exploitation probability for medium-severity WordPress plugin flaws.

Reflected Cross-Site Scripting in the WP Photo Album Plus WordPress plugin (all versions before 9.2.07.002) allows unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by reflecting an unsanitized parameter directly into an inline script block on gallery pages. Exploitation requires social engineering - the victim must open a crafted link - but no attacker credentials are needed. A publicly available proof-of-concept exists, reported by WPScan, and EPSS places exploitation probability at 17%, a notably elevated figure for a reflected XSS in a plugin.

Stored cross-site scripting in the Welcart e-Commerce WordPress plugin (all versions before 2.11.34) allows any authenticated user holding the Author role or above to permanently inject malicious JavaScript into product pages, executing in every subsequent visitor's browser. A publicly available proof-of-concept exploit exists and the EPSS score of 16% reflects above-average exploitation probability for a medium-severity plugin flaw. The vendor has released a fix in version 2.11.34, and patching is the primary recommended action.

Stored XSS in the Patterns Kit WordPress plugin (versions through 1.0.3) enables any Contributor-level user to inject a JavaScript payload into an unescaped link attribute, which a client-side script inserts directly into the DOM. Victim browsers execute the payload when a user views the content and clicks the affected element, with the CVSS scope change (S:C) confirming the attack crosses from the WordPress application into the victim browser context. No vendor-released patch has been identified at time of analysis; a public proof-of-concept is available and the 16% EPSS score indicates above-average real-world exploitation probability for this severity class.

Stored XSS in tablib's HTML export path before version 3.10.0 allows an authenticated attacker to inject arbitrary JavaScript via maliciously named worksheet titles sourced from imported XLSX, ODS, XLS, or YAML files. The export_book method in _html.py previously interpolated dataset titles directly into HTML h3 tags using an f-string, bypassing all escaping; script payloads assigned to the Dataset title attribute execute in a victim's browser when the exported HTML is rendered. No active exploitation confirmed in CISA KEV; vendor-released patch is available as v3.10.0.

Multiple XSS vulnerabilities in SonicWall Global Management System (GMS) 9.5.1 and earlier allow unauthenticated remote attackers to execute arbitrary JavaScript in authenticated users' browsers. The Changed scope (S:C) in the CVSS vector confirms injected scripts run in the victim browser's security context - not the server - enabling session hijacking, credential theft, or phishing overlays targeting GMS administrators. No public exploit code exists and no CISA KEV listing is present at time of analysis; SSVC classifies exploitation as none.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) enables an authenticated, low-privileged attacker to inject malicious script content that renders in a victim's browser upon interaction with a crafted page, enabling spoofing and potential session compromise. All three actively-supported on-premises SharePoint product lines are affected, with patched builds available via Microsoft's Security Response Center advisory. No public exploit code and no CISA KEV listing exist at time of analysis, placing this in the routine patching tier rather than an emergency-response scenario.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated low-privilege attacker to inject malicious script that, when rendered by a victim's browser, performs network-based spoofing within the SharePoint web application. All three current on-premises SharePoint product lines are affected across the 16.0.x branch, with specific fixed builds identified by EUVD-2026-56718. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released patches for all affected versions.

Cross-site scripting in Microsoft SharePoint Server allows an authenticated attacker to inject malicious script content that executes within other users' browser sessions, enabling spoofing and potential session compromise. Affected are SharePoint Server Subscription Edition, 2019, and 2016 Enterprise editions running builds below the July 2026 cumulative update thresholds. Exploitation requires contributor-level authenticated access and victim interaction; no active exploitation is confirmed and no public exploit code has been identified at time of analysis, though the CVSS scope change confirms that successful injection reaches beyond the SharePoint application boundary into victims' browser contexts.

Cross-site scripting in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated, low-privilege attacker to inject malicious scripts that execute in other users' browsers upon interaction, enabling session hijacking and spoofing attacks within the SharePoint context. The CVSS 7.3 score reflects high confidentiality and integrity impact bounded to the SharePoint application scope, gated by both valid credentials and victim interaction. Microsoft has released patches for all three affected product lines; no public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Microsoft SharePoint Server enables an authenticated attacker with low privileges to inject malicious scripts into web-rendered content, executing arbitrary JavaScript in victims' browsers and enabling spoofing attacks over the network. All three actively-supported SharePoint Server product lines are affected: Enterprise 2016, 2019, and Subscription Edition - making this a broad enterprise exposure. SSVC rates exploitation as none and not automatable, and no public exploit has been identified at time of analysis, though the scope change (S:C) and low attack complexity elevate theoretical impact beyond the 5.4 CVSS score suggests.

Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.

Cross-site scripting in Microsoft SharePoint Server allows an authenticated network attacker to perform spoofing attacks against users by injecting malicious script content into web pages served by the platform. Affected deployments include SharePoint Server Subscription Edition prior to build 16.0.19725.20522 and SharePoint Server 2019 prior to build 16.0.10417.20198. Exploitation requires victim interaction (UI:R) and attacker authentication (PR:L), and no public exploit code or active exploitation has been identified at time of analysis per SSVC data.

Cross-site scripting in Microsoft SharePoint Server enables an authenticated low-privilege attacker to inject malicious scripts into SharePoint content that execute in a victim user's browser, enabling session token theft, credential harvesting, or on-behalf-of actions under the victim's identity. Affected products are SharePoint Server Subscription Edition prior to 16.0.19725.20522 and SharePoint Server 2019 prior to 16.0.10417.20198. Vendor-released patches are available via MSRC; no public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected XSS in Activepieces' OAuth callback endpoint `/api/redirect` allows an unauthenticated attacker to steal session tokens or execute authenticated API calls on behalf of logged-in users. Versions prior to 0.83.0 embed the user-supplied `code` query parameter directly inside an inline `<script>` block, enabling script context breakout via closing tag injection - a flaw the public patch commit fully discloses, substantially lowering the barrier to exploit development. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Stored XSS in Adobe ColdFusion 2023 (≤2023.0.22) and 2025 (≤2025.0.11) allows a low-privileged attacker to persist malicious JavaScript in vulnerable form fields, which then executes in the browsers of other users who view the affected page. The CVSS scope change (S:C) reflects that injected scripts can impact users beyond the attacker's own session - including potentially higher-privileged administrators. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as none and technical impact as partial at time of analysis.

Cross-site scripting in BlackBerry AtHoc IWS Web Portals allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the context of an authenticated victim's session. All versions of AtHoc IWS prior to 7.21 HF-734 are affected. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms no special attacker privileges are needed, though a user interaction step is required, limiting mass-scale opportunistic exploitation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in SWC's HTML minifier allows attacker-controlled JSON data embedded in application/json and application/ld+json script elements to break out of those elements and execute arbitrary JavaScript in the rendered page's origin. Applications that use swc_html_minifier or @swc/html to minify server-rendered HTML containing dynamic JSON script blocks are vulnerable - the minifier parsed JSON (unescaping unicode-escaped less-than signs) then re-serialized without re-escaping them, letting a crafted closing sequence terminate the script element prematurely. No public exploit has been identified at time of analysis, but the attack technique is a well-understood HTML parser quirk and the fix commit provides a clear reproduction case.

Stored cross-site scripting in Pentestify's finding renderer allows any authenticated user with finding-creation privileges to inject arbitrary JavaScript into the application by storing malicious markup in a finding's severity field. Because the frontend JavaScript (js/app.js) interpolates the severity value directly into HTML class attributes and CSS custom property references without sanitization, every subsequent authenticated user who views an affected findings list or report preview executes the injected script in the application's browser origin. No public exploit code has been identified at time of analysis, and no CISA KEV listing was provided; however, the stored nature of the flaw means a single malicious payload persists and silently affects all future report viewers until the database is sanitized.

Stored cross-site scripting in AVideo's user registration flow allows any attacker who can reach the registration form to inject persistent JavaScript via the phone field, which later executes in administrator browsers when the users management page loads. The injected payload is rendered through JavaScript innerHTML in the admin bootgrid component without sanitization, running in the admin's session context and enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck has documented and published an advisory for this vulnerability.

Persistent JavaScript injection in HortusFox 5.9 enables authenticated workspace members to execute arbitrary scripts in the browsers of all users who view affected plant notes, including administrators. The vulnerability stems from Parsedown's Markdown renderer operating without safe mode, allowing raw HTML and script tags embedded in plant notes to pass through to the DOM unescaped. An attacker with workspace membership can harvest session cookies or perform privileged actions on behalf of any user who visits the compromised plant entry. No public exploit code or active exploitation has been confirmed at time of analysis.

Stored cross-site scripting in ElkArte Forum 2.0 Beta 1 enables any registered member to persist malicious JavaScript in the cust_blurb and cust_locate profile fields, which render unescaped when administrators view affected profiles. The scope-changing nature of the flaw (CVSS S:C) means the payload executes within an administrator's browser session, creating a realistic path to session hijacking or privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low barrier to exploitation - any registered account suffices - makes this a meaningful risk for forums with open registration.

Cross-site scripting in MISP's cti-transmute library allows an authenticated attacker to inject arbitrary HTML through conversion-table values rendered by the highlight() function. When processing content for search highlighting, the function inserted conversion data directly into an HTML sink without escaping special characters such as <, >, &, and quotes, allowing malicious markup embedded in CTI conversion data to execute in a victim's browser. No public exploit is identified at time of analysis; the CVSS 4.0 score of 5.1 reflects limited scope impact constrained by authenticated access requirements and necessary user interaction.

Stored cross-site scripting in MISP's cti-transmute allows a low-privileged authenticated user to inject arbitrary HTML and JavaScript into the administrative triage interface by supplying a crafted icon value when creating or editing a tag. The malicious payload persists in the database and silently executes in the browser of any user who subsequently renders the affected tag, including administrators. No public exploit code or active exploitation has been identified at time of analysis; a remediation commit (cc13416d) is available in the MISP/cti-transmute repository.

Stored cross-site scripting in MISP cti-transmute allows authenticated users to inject arbitrary script into shared graph configurations that are later executed in other users' browsers, including administrators. The flaw exists because the Pivotick graph rendering component interprets the svgIcon style property as raw HTML, and saved configurations were persisted without schema validation and shared across all users on the instance. No public exploit code and no CISA KEV listing have been identified at time of analysis, but the admin-targeting path gives low-privileged attackers a meaningful privilege escalation surface in multi-user deployments.

Stored cross-site scripting in MISP's cti-transmute visualization engine allows an attacker who can supply crafted STIX or MISP data to inject arbitrary HTML and JavaScript into ECharts Sunburst and Treemap tooltips, executing in a victim analyst's browser when they hover over an affected chart slice. All versions of cti-transmute prior to upstream fix commit c5b024a8ef5632f8939cfe2dad9026064698f4bb are affected, with vulnerable field values including STIX type, relationship_type, pattern prefix, and MISP category and type - all attacker-controllable in a shared threat intelligence environment. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.

Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.

Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.

DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.

Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.

SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.