Cross-Site Scripting

Stored cross-site scripting in MISP's cti-transmute visualization engine allows an attacker who can supply crafted STIX or MISP data to inject arbitrary HTML and JavaScript into ECharts Sunburst and Treemap tooltips, executing in a victim analyst's browser when they hover over an affected chart slice. All versions of cti-transmute prior to upstream fix commit c5b024a8ef5632f8939cfe2dad9026064698f4bb are affected, with vulnerable field values including STIX type, relationship_type, pattern prefix, and MISP category and type - all attacker-controllable in a shared threat intelligence environment. No active exploitation has been confirmed by CISA KEV, and no public exploit code has been identified at the time of analysis.

Cross-site scripting in cti-transmute's MISP event-browser allows a malicious or compromised remote MISP instance to inject arbitrary HTML and JavaScript into the operator's browser by returning crafted values in event data fields. Affected fields include event IDs, event information text, organization names, tags, tag colors, TLP labels, distribution labels, and flash/error messages - all previously interpolated via innerHTML without sanitization. No public exploit code has been identified at time of analysis and the vulnerability is absent from CISA KEV; the low CVSS 4.0 score of 2.3 reflects the hard prerequisite that an attacker must control or compromise the specific MISP instance being queried.

Stored cross-site scripting in Themeum's Kirki Freeform Page Builder plugin (all versions through 6.2.0) allows WordPress users holding Contributor-level access to inject persistent malicious scripts via the post_meta shortcode, which then execute in the browser of any subsequent visitor to the compromised page. The CVSS scope change (S:C) signals that the impact crosses from the contributor's own session boundary into victim sessions, enabling session hijacking, credential exfiltration, or privilege escalation toward site administration. A fix commit is available in the WordPress plugin repository (changeset 3636487), and no public exploit code or CISA KEV listing has been identified at time of analysis.

DOM-based reflected Cross-Site Scripting in SAP NetWeaver Application Server ABAP enables an authenticated attacker to craft a malicious URL and distribute it to other authenticated SAP users. When a victim accesses the link, unsanitized input is reflected and executed within the DOM in the victim's browser, resulting in high confidentiality impact - such as session token or credential theft - and low integrity impact. No public exploit code or CISA KEV listing exists at time of analysis, placing this in the medium-priority tier despite the high confidentiality component.

Stored cross-site scripting in SAPUI5's content adaptation feature allows a key user with content adaptation privileges to inject persistent malicious scripts into adapted application definitions. When any user subsequently opens the compromised adapted application, the injected script executes in their browser session, enabling session token theft and unauthorized actions on behalf of the victim. Affected versions span multiple SAPUI5 release tracks (754 through 816 and SAP_UI 750); no public exploit or CISA KEV listing has been identified at time of analysis.

SAP Data Services Management Console versions 4.3 and 2025 expose an overly permissive Content Security Policy that omits key restrictive directives, creating a prerequisite condition for script injection attacks within the application context. An authenticated attacker who also controls or exploits a separate vulnerability - such as a stored or reflected XSS vector - can leverage the absent CSP controls to execute malicious scripts in a victim user's browser session. Confidentiality and integrity suffer limited impact; availability is unaffected. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored cross-site scripting in SQLBot's SQText dashboard component allows any authenticated low-privilege user who can edit dashboard widgets to inject persistent HTML and JavaScript that executes in the browser of every user who views the affected dashboard. All versions through 1.10.0 are affected per CPE data (cpe:2.3:a:dataease:sqlbot:*:*:*:*:*:*:*:*), with the root cause confirmed by source code evidence as Vue's v-html directive rendering unsanitized TinyMCE output. No public exploit identified at time of analysis via active exploitation (CISA KEV), though publicly available exploit code exists via GitHub issue #1308, and a vendor-released patch is available as of commit c3f40a5.

Stored XSS in FlyEnv before 4.18.0 allows remote attackers to execute arbitrary JavaScript in the Electron renderer process by injecting unsanitized HTML through markdown sources or AI chat messages rendered via Vue v-html directives. Because FlyEnv's Electron renderer operates with Node.js API integration active, exploitation escalates beyond conventional XSS to effective local code execution with unrestricted filesystem access on the developer's machine. A publicly available exploit exists at GitHub issue #809, and vendor-released patch v4.18.0 addresses the flaw.

Persistent XSS in Typemill CMS 2.x enables authenticated users holding theme-configuration access to store malicious JavaScript URI payloads via Markdown link syntax, which execute in victim browsers upon link click. The vulnerability exists in ParsedownExtension.php and TwigMarkdownExtension.php, where href values in Markdown links are rendered into HTML anchor tags without filtering the javascript: URI scheme, resulting in stored payloads that persist across all page loads. Successful exploitation delivers session cookie theft, authenticated request forgery, and credential harvesting against every visitor who clicks an injected link. No public exploit code or CISA KEV listing has been identified at time of analysis.

Cross-site scripting in Discourse's discourse-local-dates plugin allows an authenticated attacker to inject arbitrary HTML by embedding crafted markup in local-date format attributes (data-format, data-displayed-timezone, data-timezone), which were interpolated directly into the DOM via template literals instead of safe DOM text APIs. Exploitation is gated by a non-default condition: the site's Content Security Policy must be modified or disabled from the default. No public exploit independent of the vendor fix commits exists at time of analysis, and this is not listed in CISA KEV. The CVSS 4.0 score of 2.0 reflects the constrained attack requirements (AT:P, PR:L, UI:A).

Reflected XSS in HCL BigFix Mobile allows authenticated attackers to inject and execute malicious scripts in the browsers of other authenticated users by crafting malicious URLs containing unsanitized payloads. The CVSS Scope:Changed attribute (S:C) indicates the injected script executes outside the vulnerable component's security boundary - enabling session hijacking, credential theft, or unauthorized administrative actions against higher-privileged victims. No public exploit code and no CISA KEV listing exist at time of analysis, though the vendor has self-disclosed via advisory KB0132661.

Stored cross-site scripting in Discourse's moderation review queue allows a low-privileged registered user to execute arbitrary JavaScript in a moderator's browser session. All Discourse deployments running versions prior to 2026.1.6, 2026.5.2, 2026.6.1, or 2026.7.0 are affected, but only when the platform's default Content Security Policy has been modified or disabled. No public exploit identified at time of analysis and no CISA KEV listing; real-world risk is bounded by both the CSP prerequisite and the requirement for moderator interaction.

Stored XSS in Discourse's staff action log interface allows authenticated users to inject malicious HTML into log entries that execute in administrator browser sessions. All Discourse releases prior to 2026.1.6 are affected, with the root cause being an unescaped rendering of previous_value and new_value fields in the admin frontend model. No active exploitation or public exploit code has been identified at time of analysis; vendor-released patches across four stable branches confirm the issue is fully remediated.

HTML injection in Discourse's PrettyText.format_for_email function allows authenticated users to embed arbitrary markup into outbound email notifications across all versions prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1. Three distinct code paths in the email conversion pipeline re-inject cooked HTML attribute values as raw markup strings rather than treating them as data - exploitable via crafted Vimeo iframe sources, secure-upload URLs or dimension attributes, and hashtag data-slug values. No public exploit code or CISA KEV listing is identified at time of analysis; the CVSS 3.1 score of 6.4 reflects a meaningful scope change to email recipients' clients combined with the low-privilege authentication requirement.

Stored cross-site scripting in CTI-Transmute's conversion graph allows attacker-controlled CTI content (MISP or STIX objects) to execute arbitrary JavaScript in any analyst's browser who views the graph. The Pivotick graph library rendered node labels, sublabels, edge labels, node types, property names, property values, and hash algorithm identifiers through HTML-parsing operations (innerHTML, template.innerHTML) without sanitization, and a separate sink used an interpolated document.write() for the raw-JSON popup. The CVSS 4.0 score is 5.1 (Medium) with no authentication required of the attacker but user interaction required of the victim; no public exploit or KEV listing has been identified at time of analysis.

Stored XSS in ReadyEcommerce before 4.5.2 allows authenticated customers to inject arbitrary JavaScript into chat and support ticket messages, which executes in the browsers of any shop owner or administrator who views the messages. The root cause is unsanitized rendering via Vue.js's v-html directive across four frontend components, bypassing the framework's built-in template escaping protections. Successful exploitation can lead to session cookie theft and full administrative account takeover. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored XSS in Magnolia CMS's import functionality enables authenticated editors to embed arbitrary JavaScript inside an uploaded image's filename, which executes in the browser of any CMS user who subsequently opens that image. The attack requires low-privileged editor access and passive victim interaction within the CMS backend. No active exploitation has been confirmed (not listed in CISA KEV), no public POC exists, and a vendor-released patch is available in version 6.3.10 as reported by CERT-PL.

Stored XSS in fastschema through v0.15.1 permits any low-privileged authenticated user to store a script-bearing SVG file in the application's web root by spoofing the HTTP Content-Type header during upload. The root cause is that the PutMultipart function in pkg/rclonefs/base.go trusts the client-supplied Content-Type value rather than inspecting actual file bytes, allowing an attacker to rename an SVG to .jpg while declaring image/svg+xml and fully bypass the MIME allow-list. When a privileged user later browses to the stored file URL, the browser renders the SVG and executes the embedded JavaScript in that user's session context - a scope-changing impact that elevates the real-world risk above what the medium CVSS score alone suggests. No public exploit has been identified at time of analysis.

Stored XSS in Bludit 4.0.0-beta allows an authenticated Author-role user to plant persistent JavaScript by uploading a crafted SVG file as the site logo. The /admin/ajax/logo-upload.php endpoint accepts SVG files permitted by ALLOWED_IMG_EXTENSION and ALLOWED_IMG_MIMETYPES but moves them directly to the web root via Filesystem::mv() without invoking the available sanitizeSVG() or transformImage() routines, leaving embedded script payloads fully intact and serving them to every subsequent site visitor. No CISA KEV listing or public exploit code was identified at time of analysis; however, the scope-change characteristic (S:C) and persistent delivery to all site visitors - including administrators - amplify practical impact beyond the moderate CVSS 5.4 score.

Stored cross-site scripting in cube-root/directory-serve through version 1.3.7 enables any authenticated user who can upload files to inject persistent JavaScript into the file listing viewed by other users. The root cause is unsanitized filename rendering in lib/helper/html.js at line 28, where filenames containing HTML attribute-breaking characters are embedded directly into HTML templates. No public exploit code or CISA KEV listing is associated with this CVE at time of analysis, but the stored nature of the XSS and the low-privilege upload requirement make it a realistic lateral attack vector in shared-use deployments.

Cross-site scripting in Cybozu Garoon allows a low-privilege authenticated attacker to inject and execute arbitrary JavaScript in the browsers of other logged-in users. The scope-changed CVSS vector (S:C) confirms this is a persistent or reflected XSS capable of crossing session boundaries, enabling high-integrity impact against victim accounts. No public exploit code or CISA KEV listing has been identified at time of analysis, but JPCERT/CC coordinated disclosure signals active vendor engagement.

Stored cross-site scripting in the s2Member WordPress plugin (all versions before 260805) allows contributors to inject arbitrary JavaScript into post content via unescaped shortcode attributes rendered inside an inline script block. Any site visitor who opens the affected post will execute the attacker's script in their browser. A publicly available proof-of-concept exploit exists, reported by WPScan, though EPSS sits at the 5th percentile suggesting opportunistic rather than widespread active exploitation at time of analysis.

Stored XSS in the Advanced Excerpt WordPress plugin before 4.5 permits administrators - critically including those without the `unfiltered_html` capability, such as site-level admins in WordPress multisite deployments - to inject persistent JavaScript payloads via unsanitized plugin settings, which then execute silently in every visitor's browser on affected pages. A publicly available proof-of-concept exists per WPScan's disclosure (EUVD-2026-55021), though EPSS remains very low at 0.16% (6th percentile) and the vulnerability is not confirmed in CISA KEV. The primary risk surface is WordPress multisite environments, where this plugin's settings bypass the platform-level capability restriction that normally prevents restricted admins from injecting raw HTML.

Stored XSS in the Saitama Addon Pack WordPress plugin (≤ 1.0.8) lets contributor-level users inject persistent JavaScript into post metadata fields that have no sanitization or escaping applied before output. When a higher-privileged user - editor or administrator - opens the affected content for review, the payload executes in their browser session. A public exploit is available via WPScan; no active exploitation is recorded in CISA KEV, and EPSS sits at the 6th percentile, consistent with targeted rather than opportunistic abuse.

Stored Cross-Site Scripting in the JetEngine WordPress plugin (all versions before 3.8.13.1) allows unauthenticated remote attackers to upload SVG files containing arbitrary JavaScript, which then executes persistently in the browser of any user who views the file. The plugin neither sanitizes SVG content on upload nor restricts the upload endpoint to authenticated users, making the attack fully unauthenticated. A publicly available proof-of-concept exists per WPScan, though EPSS of 0.17% (7th percentile) and absence from CISA KEV suggest exploitation remains targeted rather than widespread at this time.

Cross-site scripting in code-projects Task Management System 1.0 allows remote, unauthenticated attackers to inject malicious JavaScript via at least six unsanitized parameters processed by /user/CommentSave.php, including comment, task_id, mineId, recId, myName, and myImage. When a victim views the affected page or comment, the injected script executes in their browser context, enabling session hijacking, credential theft, or UI redirection. A publicly available proof-of-concept exploit exists, though no active exploitation has been confirmed via CISA KEV listing.

Stored cross-site scripting in the LWS Optimize WordPress plugin (all versions before 4.1.2) enables unauthenticated remote attackers to inject persistent JavaScript via the plugin's analytics endpoint, which then executes in the browser of any administrator who views the affected dashboard page. The vulnerability requires no authentication to exploit the injection phase, making mass poisoning of sites feasible before any admin interaction occurs. No public exploit is identified at time of analysis; a vendor-released patch is available in version 4.1.2.

Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.

Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.

Reflected XSS in the Link Library WordPress plugin before 7.9.4 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL containing an unsanitized parameter. The CVSS scope is Changed (S:C), meaning attacker-controlled script runs in the victim's browsing context, enabling session theft or privilege escalation against logged-in WordPress users. No public exploit identified at time of analysis is contradicted here - a publicly available exploit code exists per WPScan, though EPSS of 0.17% (7th percentile) indicates limited observed exploitation at time of analysis and no CISA KEV listing exists.

Stored Cross-Site Scripting in the Easy Accordion WordPress plugin (versions ≤ 3.1.8) enables authenticated contributors to persist malicious scripts in page content by supplying a crafted value for the `accordionTitleTag` block attribute. The `accordion_header_renderer()` function incorrectly uses WordPress's `esc_attr()` sanitizer - designed for HTML attribute values - when emitting a user-supplied tag name in an HTML tag-name context, where `tag_escape()` is required; this mismatch permits injection of arbitrary HTML elements and event handlers. No public exploit code or active exploitation has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Stored cross-site scripting in Domoticz's mobile dashboard (all versions prior to 2026.3) allows any authenticated API user to inject persistent JavaScript payloads via Text or Alert subtype device values. The ng-bind-html rendering path applies only an nl2br() newline transform with no HTML escaping, meaning stored payloads execute in every administrator's browser that loads the mobile dashboard. Successful exploitation enables session cookie theft and account takeover; no active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Stored cross-site scripting in HAPI FHIR's scan command allows an attacker who controls an Implementation Guide or FHIR profile to inject arbitrary JavaScript into generated scan.html reports. All versions of org.hl7.fhir.core, ca.uhn.hapi.fhir:org.hl7.fhir.validation, and ca.uhn.hapi.fhir:org.hl7.fhir.validation.cli prior to 6.9.11 are affected. When a developer or CI pipeline scans the malicious IG and subsequently opens or publishes the resulting HTML report, the injected payload executes in the viewer's browser context - no public exploit or CISA KEV listing exists at time of analysis, but the fix commit and advisory are public.

Cross-site scripting in SourceCodester Photo Share Website 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `content` parameter of the comment input box at `/social/ajax.php?action=save_upload`, executing arbitrary script in the browsers of users who subsequently view the injected content. The CVSS 4.0 vector (PR:L/UI:P) confirms exploitation requires an authenticated session and victim interaction, constraining opportunistic mass exploitation. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists, referenced via a GitHub issue (https://github.com/Andyov0/cve/issues/1), meaningfully elevating near-term risk for any reachable deployment.

Stored XSS in Sonatype Nexus Repository 3 enables an authenticated user holding blob store management permissions to inject arbitrary JavaScript into a blob store name, which later executes in the browser of any user who views the system health-check status page. The CVSS 4.0 vector's SC:H/SI:H scores underscore that the subsequent-system impact is high - an attacker-controlled script running in a victim's session can exfiltrate credentials or perform privileged actions on their behalf. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Sonatype has released a fix in version 3.95.0.

Stored XSS in the Code Embed WordPress plugin (versions prior to 2.6.1) permits a Contributor-role attacker to plant a URL embed token referencing an attacker-controlled server; when an Administrator or Editor previews or reviews the pending post, the plugin fetches the remote URL and injects the unfiltered response body-including arbitrary JavaScript-directly into the rendered page. The root cause is a dual omission in add-embeds.php: no output sanitization on fetched remote content and no unfiltered_html capability check before URL-embed expansion, a pattern confirmed by the commit diff from the fix release. No public exploit has been identified at time of analysis; vendor-released patch 2.6.1 is confirmed by a GitHub release tag, a commit, and the plugin changelog.

Stored or reflected cross-site scripting in SourceCodester Photo Share Website 1.0 enables remote authenticated attackers to inject arbitrary JavaScript via the Comment argument at /social/index.php?page=home, executing in the browsers of other users who view the affected page. A publicly available proof-of-concept exploit exists on GitHub (gensnext/cve/issues/1), though the vulnerability carries a low CVSS 4.0 score of 2.0 and is not listed in the CISA KEV catalog, indicating no confirmed widespread active exploitation. Practical impact is limited to session hijacking, phishing redirection, or DOM manipulation within the application context of other authenticated users.

Stored cross-site scripting in PHPGurukul Company Visitor Management System 1.0 allows a high-privileged authenticated attacker to inject malicious JavaScript via the `fullname` parameter in `/manage-newvisitors.php`, executing arbitrary scripts in the browsers of other users who view the affected page. The CVSS 4.0 score of 4.8 (Medium) reflects the high privilege prerequisite (PR:H) and required passive victim interaction (UI:P), substantially limiting real-world impact. A public proof-of-concept exploit exists (GitHub), though no active exploitation has been confirmed by CISA KEV.

Cross-site scripting in the ShareOpenly WordPress plugin (versions prior to 1.2.1) allows JavaScript injection into every visitor's browser via an unescaped `$url` variable concatenated directly into an HTML href attribute on all singular posts and pages where the sharing link is rendered. The root cause is the absence of WordPress's mandatory `esc_url()` function on a URL constructed from `home_url( add_query_arg( array(), $wp->request ) )`, meaning any plugin, theme, or server configuration that taints that base URL via a `home_url` filter can introduce HTML-special characters or a `javascript:` URI scheme into the rendered page without sanitization. No public exploit has been identified at time of analysis; vendor-released patch version 1.2.1 is available and confirmed.

Stored cross-site scripting in Tobit Laboratories AG TeamDavid's Webbox email interface allows any network-reachable attacker to embed malicious JavaScript within an email body; the payload executes in the browser context of any Webbox user who opens the message. All TeamDavid versions through Rollout 524 are affected per NCSC.ch disclosure and NVD CPE data. No public exploit identified at time of analysis and no CISA KEV confirmation, though the attack technique is trivial and requires no authentication from the sender.

Reflected XSS in the Webbox component of Tobit Laboratories AG's TeamDavid collaboration platform (marketed as a secure Microsoft 365 alternative) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The vulnerability is exploitable via three distinct injection points: the URL path, the `EntryInfo` query parameter, and the `!templateName=entryMail` parameter. Disclosed as part of a coordinated batch of 22 CVEs in TeamDavid by InfoGuard Labs and reported through NCSC.ch; no public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in Meow Gallery WordPress plugin (all versions before 5.5.2) allows any WordPress user holding the Author role or higher to persist a JavaScript payload via unsanitized attachment alt text in linked gallery anchor attributes. Any visitor - including site administrators - who subsequently loads a post containing the affected gallery executes the injected script, enabling session hijacking, credential theft, or malicious redirects. A publicly available proof-of-concept exists per WPScan; EPSS at 0.15% reflects low automated exploitation probability, though the threat to sites with multiple or untrusted author accounts is concrete.

Stored cross-site scripting in BNE Testimonials WordPress plugin (all versions before 2.0.8.2) allows contributor-level authenticated users to inject arbitrary JavaScript into an inline script block via an unescaped shortcode attribute. The payload persists in published content and executes in the browser of any visitor who views the affected page, including administrators. A public proof-of-concept is documented by WPScan; however, the vulnerability is not listed in CISA KEV and EPSS sits at the 5th percentile, indicating low automated exploitation probability.

Stored Cross-Site Scripting in the Comments WordPress plugin (all versions before 7.6.60) permits unauthenticated attackers to permanently inject malicious JavaScript into the site database by submitting a crafted URL that the plugin fails to escape before rendering inside an HTML attribute. Any authenticated user - including site administrators - who subsequently views the affected content triggers payload execution in their browser, potentially enabling session hijacking and full site takeover. A publicly available exploit is referenced via WPScan, though EPSS at 0.17% (7th percentile) indicates low observed exploitation volume at time of analysis, and the vulnerability is not listed in CISA KEV.

Reflected XSS in the Subscribe2 WordPress plugin (versions before 10.46) allows an unauthenticated attacker to inject arbitrary JavaScript into a public subscription form by luring a visitor to a crafted link. Exploitation requires the victim to interact with the malicious URL - no server-side authentication is needed - enabling session theft, credential harvesting, or DOM-based actions scoped to the victim's browser. A publicly available proof-of-concept exists per WPScan; EPSS at 0.16% (5th percentile) indicates limited automated exploitation despite the low attack complexity.

Stored Cross-Site Scripting in the Ultra Addons for Contact Form 7 WordPress plugin (all versions through 3.5.43) permits authenticated contributors to inject persistent malicious scripts via the Range Slider widget's 'data-label' and 'data-separator' attributes. The Scope:Changed CVSS metric confirms that once injected, the payload executes in the security context of any user who subsequently visits the affected page - including administrators - enabling session hijacking, credential theft, or admin-level action forgery. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Stored cross-site scripting in AIL Framework's Chat Explorer and Forum Explorer views allows an attacker who can influence indexed dark-web content to inject arbitrary JavaScript into translation button onclick handlers, executing in the analyst's browser under the AIL security origin. Versions up to and including 7.0.0 are affected; the vulnerability stems from Jinja2 templates passing message and post identifiers through HTML escaping rather than JavaScript-safe encoding, leaving single-quote and escape-sequence injection paths open. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified; exploitation requires the victim analyst to click the 'Translate to preferred language' button, limiting automated attack surface.

Stored XSS in AIL Framework's crawler domain view (versions ≤ 7.0.0) lets a low-privileged attacker embed executable JavaScript inside crawled URL values that persist in the AIL datastore. The payload triggers within an authenticated analyst's browser session the moment they click the screenshot icon for the malicious crawler entry, granting the attacker access to session data and the ability to perform application actions as that analyst. No CISA KEV listing or public exploit code has been identified at time of analysis; the CVSS 4.0 score of 6.9 reflects high confidentiality impact tempered by required user interaction and low-privilege preconditions.

Stored cross-site scripting in Frappe's Data Import feature allows an authenticated user with import permissions to inject persistent script payloads via maliciously crafted column headers in imported files. The unescaped headers are rendered in import preview and warning messages, causing script execution in the browser of any other user who subsequently views the import interface. Affected are all Frappe deployments on the 15.x branch prior to 15.109.0 and the 16.x branch prior to 16.19.0; no active exploitation has been confirmed (no CISA KEV listing) and no public exploit code has been identified at time of analysis.

Workspace Save API in Frappe prior to version 16.18.0 permits any authenticated user to overwrite another user's private workspace by supplying an arbitrary workspace identifier, and to inject persistent malicious scripts into that workspace. The root cause is a missing ownership check in the `save_page` handler in `frappe/desk/doctype/workspace/workspace.py`, confirmed by the vendor fix and classified as stored XSS (CWE-79). No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the low exploitation complexity for any authenticated user and the persistent, targeted nature of the injection make it a meaningful risk in all multi-user Frappe and ERPNext deployments.

Stored cross-site scripting in DataGear up to version 5.0.0 allows a high-privileged authenticated attacker to inject malicious script into dashboard chart titles, which executes in the browser of any user who subsequently views the affected dashboard. The vulnerability resides in HtmlTplDashboardWidgetHtmlRenderer.java within the Chart Name Handler, where the Title argument is rendered without adequate output encoding. A proof-of-concept has been publicly disclosed; the vendor did not respond to pre-disclosure contact, meaning no official patch is confirmed at time of analysis.

WSO2 API Manager's Swagger UI Try-out console in the API Publisher portal accepts an externally supplied OpenAPI/Swagger definition URL, allowing that definition to override the legitimate API specifications rendered to users. An attacker who tricks an API Publisher user into visiting a crafted URL can substitute attacker-controlled backend endpoints for real ones, potentially harvesting authentication tokens, credentials, or other sensitive payloads submitted via the Try-out console. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; exploitation requires user interaction, confining realistic risk to targeted social engineering against developer or API management personnel.

HTML sanitization bypass in jsoup versions 1.14.3 through 1.23.0 allows cross-site scripting when applications deploy a custom Safelist that explicitly permits raw-text elements. The parser's tag-name normalization trimmed trailing control characters (e.g., U+001E) from malformed tag names, causing a crafted element to acquire the parsing behavior of a recognized raw-text element; content intended to remain escaped text was then serialized as active markup, bypassing sanitization. jsoup's built-in Safelists are unaffected, and no public exploit or CISA KEV listing has been identified at time of analysis.

Stored XSS in league/commonmark's AttributesExtension allows remote attackers to inject and execute arbitrary JavaScript in victim browsers by embedding WHATWG URL control bytes (TAB, CR, LF, or leading C0 controls) within a javascript: scheme in href or src attribute values. The unsafe-link filter (RegexHelper::isLinkPotentiallyUnsafe()) uses an anchored prefix regex that does not normalize inputs as browsers do, so java<TAB>script: passes the filter but executes as javascript: in every compliant browser. Critically, this bypass defeats the allow_unsafe_links => false configuration - the library's own documented hardening recommendation for untrusted input - meaning even security-conscious deployments running versions 1.5.0 through 2.8.3 remain exploitable. No public exploit confirmed as KEV; however, the advisory provides explicit PoC payloads, substantially lowering attacker effort.

Stored Vue template injection in CTI-Transmute ≤ 1.5.0 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser of any user who views a compromised public conversion detail page. The attack bypasses Jinja2 HTML escaping because server-rendered values are injected into DOM regions subsequently compiled by Vue's runtime engine, which interprets the attacker-controlled `[[ ... ]]` expressions as live template code. The application's nonce-based CSP provides no protection because Vue's runtime compiler requires the `unsafe-eval` exception, permitting Function constructor escalation; no public exploit code beyond the proof-of-concept payload technique described in the advisory has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Stored cross-site scripting in Silverstripe CMS's admin page list view allows an authenticated CMS editor to execute arbitrary JavaScript in the browser session of any CMS user who views the page list. The flaw exists in composer/silverstripe/cms prior to 6.2.1, where ancestor page titles were concatenated directly into rendered HTML without HTML-entity escaping in the breadcrumb component. No public standalone exploit code and no CISA KEV listing have been identified; however, the patch diff, GHSA advisory, and test-case payloads are all publicly accessible, making reproduction straightforward for any researcher.

HTML injection via unescaped form submissions in Statamic CMS's automagic email notification template allows unauthenticated attackers to deliver malicious HTML content to site administrators and other configured email recipients. Statamic's Antlers templating engine rendered all user-controlled form field values - including text, select, radio, and checkbox inputs - directly into HTML email bodies without sanitization, enabling payload delivery through a standard public-facing form submission. No public exploit code or CISA KEV listing has been identified at time of analysis, but the vulnerability requires no authentication and is accessible to any user who can submit a Statamic form.

Open redirect in html_sanitize_ex (Elixir, versions 0.3.1 through 1.5.2) allows remote attackers to force page visitors to navigate to attacker-controlled URLs by injecting `<meta http-equiv="refresh">` elements that the HTML5 scrubber (HtmlSanitizeEx.Scrubber.HTML5) passes through intact into sanitized output. Because a meta refresh acts at document scope rather than fragment scope, it overrides the host page's navigation regardless of where the sanitized fragment is embedded. The CVE description explicitly rules out JavaScript execution - this is a pure redirect primitive - and no public exploit has been identified at time of analysis.

html_sanitize_ex's HTML5 scrubber (versions 0.3.1 through before 1.5.3) passes attacker-controlled URIs through the `data` attribute of `<object>` elements after a trivially bypassed case-sensitive prefix check, allowing remote attackers to embed arbitrary external or same-origin documents into sanitized pages viewed by victims. The `<object>` tag was never registered through the library's `allow_tag_with_uri_attributes/3` URI-validation mechanism, and its sole guard - a literal lowercase `javascript:` prefix match - is defeated by mixed-case variants, `data:` URIs, protocol-relative URLs, and same-origin relative paths. No public exploit has been identified at time of analysis, and no active exploitation (CISA KEV) has been confirmed; the CVSS 4.0 score of 2.3 correctly reflects constrained real-world impact due to browser-enforced origin isolation on embedded `<object>` content.

Stored Cross-Site Scripting in the WordPress Subscribe to Comments plugin (versions up to and including 2.3.1) allows a high-privileged authenticated attacker to inject malicious scripts via author-related fields, which execute in the browsers of other users who view the affected content. The vulnerability carries a CVSS 3.1 score of 5.9 with scope change (S:C), meaning the impact crosses the security boundary from the plugin into victims' browser sessions. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-accessible attack surface and scope change elevate practical concern for multi-tenant or high-traffic WordPress deployments.

Stored Cross-Site Scripting in MailOptin WordPress plugin (versions ≤ 1.2.78.0) allows Contributor-level authenticated users to inject malicious JavaScript payloads that execute in the browser context of higher-privileged users - typically site administrators - when they view the affected content. The CVSS scope change (S:C) confirms the injected script escapes the contributor's own context, making this an effective privilege escalation vector in multi-author WordPress environments. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin (versions <= 1.45.2) allows authenticated contributors to inject persistent malicious scripts that execute in the browsers of higher-privileged users such as site administrators. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-level stored XSS with scope change - a low-privilege WordPress role can trigger execution in an admin's browsing context, enabling session hijacking or privilege escalation. No public exploit or KEV listing has been identified at time of analysis, but Patchstack has formally reported and documented this vulnerability.

Stored Cross-Site Scripting in the Business Directory WordPress plugin (versions up to and including 6.4.24) allows authenticated subscribers to inject malicious scripts into directory listings or plugin-managed fields, which execute in the browsers of higher-privileged users - typically administrators - who subsequently view the affected content. The Scope change (S:C) in the CVSS vector confirms the injected payload escapes the attacker's privilege context and affects other users' browser sessions. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and minimal privilege requirement (subscriber account) make this straightforward to weaponize in any WordPress deployment where user registration is open.

Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.

Stored Cross-Site Scripting in Powerkit plugin for WordPress (versions <= 3.1.0) allows authenticated contributors to inject malicious scripts into content that executes in victims' browsers when viewed. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier, stored XSS with changed scope, meaning a low-privileged user can target higher-privileged users such as editors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack pattern is well-understood and straightforward to execute within WordPress contributor workflows.

Stored Cross-Site Scripting in the UsersWP WordPress plugin (all versions through 1.2.69) allows authenticated attackers with subscriber-level access to inject persistent JavaScript payloads via unsanitized variable substitution in the Badge Widget. The vulnerability stems from two distinct unsanitized code paths - the `uwp_get_user_badge()` function's `%%input%%` and `%%profile_url%%` template substitutions, and the `uwp_replace_variables()` function - both of which fail to apply `esc_html()` or `esc_url()` before rendering user-controlled values into page output. No public exploit has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog.

Stored XSS in E-Logo Purchasing Portal (all versions before 1.52) by Logo Software Industry and Trade Inc. permits authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other portal users. The CVSS scope change (S:C) confirms the payload crosses trust boundaries, enabling session hijacking, credential theft, or unauthorized actions against procurement administrators and reviewers who visit affected pages. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the FormGent WordPress plugin (all versions through 1.9.2) allows unauthenticated remote attackers to inject persistent malicious scripts via form submission fields, which execute in the browsers of any user - including administrators - who subsequently view pages containing the injected content. The vulnerability stems from insufficient input sanitization and output escaping in form submission handling, carrying a CVSS 7.2 with scope change (S:C), reflecting that injected scripts break out of the plugin's security context into the broader browser session. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated nature and scope change elevate real-world risk for sites with publicly accessible forms.

Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.

Stored XSS in PostX (Post Grid Gutenberg Blocks) up to and including version 5.0.13 allows authenticated contributors to persist malicious JavaScript in WordPress pages via the unescaped 'inputPlaceHolder' parameter. Any site visitor loading an injected page will execute attacker-controlled scripts in their browser, enabling session hijacking, credential harvesting, or malicious redirects. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Stored Cross-Site Scripting in the Nexter Blocks WordPress plugin before 5.0.2 allows any authenticated user with file upload capability (Author role by default) to upload a malicious SVG file containing embedded JavaScript that executes in any victim's browser upon accessing the file. A publicly available proof-of-concept exists per WPScan, though EPSS at 0.15% (5th percentile) and absence from CISA KEV indicate low observed exploitation to date. The NVD-assigned CVSS PR:N conflicts with the description's clear authentication requirement - defenders should treat this as an authenticated vulnerability, which meaningfully narrows real-world exposure.

Stored Cross-Site Scripting in the Slick Slider WordPress plugin before 0.5.3 allows any authenticated user holding the Contributor role or higher to inject persistent JavaScript through an unsanitized shortcode attribute value that is rendered directly into an HTML attribute. The payload executes in the browser of any user - including administrators - who subsequently views the affected post, enabling session hijacking, credential theft, or privilege escalation. A publicly available proof-of-concept exploit exists and a vendor patch (version 0.5.3) has been released; no active exploitation has been confirmed by CISA KEV at time of analysis.

Stored Cross-Site Scripting in the Child Pages Card WordPress plugin (all versions before 1.09) allows contributors and higher-privileged authenticated users to inject persistent JavaScript payloads via unsanitized shortcode attributes. When an administrator or other privileged user views a page containing the malicious shortcode, the injected script executes in their browser, enabling session hijacking or unauthorized privileged actions. A public exploit is available via WPScan; no confirmed active exploitation (CISA KEV) has been observed, though the public PoC meaningfully lowers the barrier to abuse.

Stored XSS with privilege bypass in the EONSR AEO Agent WordPress plugin (versions through 3.7.9) allows unauthenticated remote attackers to inject persistent arbitrary JavaScript into published posts, attributed to administrators, that executes in the browser of any site visitor including administrators. The REST API route responsible for post creation performs no authorization check and explicitly disables HTML sanitization before saving content, making this a trivially exploitable unauthenticated write-then-persist attack chain. A publicly available exploit has been published by WPScan; no active exploitation has been confirmed in CISA KEV at time of analysis.

Stored XSS in the MetaSlider WordPress plugin (versions up to and including 3.111.0) allows authenticated Author-level users to inject arbitrary JavaScript via the unprotected 'delay' post meta setting, which executes in the browser of any visitor who loads a page containing the affected slider. The attack path leverages the WordPress XML-RPC API: the ml-slider custom post type is registered without custom capability restrictions and the ml-slider_settings meta key is unprotected, enabling Author-level accounts to plant persistent payloads that bypass normal UI-layer permission checks. This vulnerability is not listed in CISA KEV and no public exploit code has been identified at time of analysis; a patched release (3.111.1) is confirmed by the WordPress plugin SVN changeset.

Reflected cross-site scripting in ttttonyhe OBlog's /tags.php endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers by manipulating the unsanitized `day` parameter. All installations up to commit 3ca6a45a2fcc81f6086751d8af124658720e8f8f are confirmed affected under CPE cpe:2.3:a:ttttonyhe:oblog:*:*:*:*:*:*:*:*. A public proof-of-concept is available on GitHub Gist, and no patch has been issued - the vendor was unresponsive to coordinated disclosure.

Cross-site scripting in the Cisco Integrated Management Controller (IMC) web-based management interface allows an authenticated remote attacker with high privileges to execute arbitrary JavaScript in a victim's browser. The attack requires the attacker to craft a malicious link and social-engineer another IMC interface user into clicking it, at which point the attacker can steal browser-based session data or perform actions on behalf of the targeted user. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog, placing practical risk well below the nominal CVSS 4.8 medium score.

Cross-origin iframe autofill popup positioning in Electron allows a malicious iframe to render the native autofill popup outside its own bounds, overlapping the embedding application's trusted UI and enabling clickjacking or UI spoofing attacks. Affected are only Electron applications that deliberately embed untrusted cross-origin iframes within windows that also present trusted native UI - apps without such patterns are explicitly not at risk. No public exploit code has been identified at time of analysis, and the vendor-confirmed CVSS score of 3.1 (Low) reflects the high attack complexity and constrained impact, though the nature of the spoofing risk makes it qualitatively more dangerous than the score alone suggests for vulnerable app architectures.

Reflected XSS in ProjectSend r2029 exposes privileged user sessions to complete account takeover: an unauthenticated attacker crafts a malicious URL targeting thumbnails-regenerate.php with injected payloads in the start_date or end_date GET parameters, which are echoed raw into HTML attribute values without escaping. When a victim holding edit_settings permissions is socially engineered into clicking the link, the injected script executes in the application origin, enabling session cookie theft and unauthorized administrative actions - including user management, file management, and global settings changes. No public exploit has been identified at time of analysis; an upstream patch is available via GitHub commit and was reported by VulnCheck.

Stored cross-site scripting in Ghost CMS feature image captions enables any authenticated staff user to inject unsanitized HTML into the post revision history modal, hijacking the Ghost Admin session of another staff or administrator user who views that revision. Affects Ghost npm package versions v4.9.0 through v6.54.0. No public exploit identified at time of analysis and not listed in CISA KEV, but the privilege escalation potential - a lower-privileged staff member compromising a full administrator session - makes this higher-impact than the CVSS 4.3 score implies for multi-tenant or shared Ghost Admin environments.

CVE-2026-70441 is assigned within the Jenkins security advisory published 2026-08-05, which discloses over a dozen vulnerabilities across Jenkins core (2.575 and earlier, LTS 2.568.1 and earlier) and multiple plugins. The provided description is the full oss-security announcement for this advisory batch; the specific vulnerability details mapped to CVE-2026-70441 are not isolated in the available data due to truncation of the source text. The advisory as a whole addresses remote code execution via deserialization filter bypass, arbitrary file write via path traversal and crafted archive extraction, CSRF, permission bypass, and user impersonation flaws. No public exploit, KEV listing, or EPSS score was provided for CVE-2026-70441 individually.

Multiple high-severity vulnerabilities in Jenkins core and a range of plugins disclosed in the August 2026 security advisory allow attackers to achieve remote code execution on the Jenkins controller, perform arbitrary file writes, bypass deserialization protections, impersonate users, and enumerate stored credentials. Affected versions include Jenkins 2.575 and LTS 2.568.1 and earlier, with the most critical issues residing in the Remoting deserialization layer (CVE-2026-70426), tar archive handling (CVE-2026-70427), and file parameter path traversal (CVE-2026-70428), all of which ultimately enable code execution on the controller JVM. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack surface breadth and severity of RCE-capable issues make this advisory a high-priority patching event for any Jenkins deployment.

Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.

Reflected XSS in OpenBK7231T firmware's OTA update endpoint exposes authenticated admins to JavaScript injection via a crafted link. The `/ota_exec` handler in `src/httpserver/http_fns.c` echoes the `host` query parameter verbatim into an HTML response using `hprintf255()`, without HTML encoding, enabling an attacker to run arbitrary script in the admin's browser session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.

Reflected XSS in 299Ko CMS's public contact form allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by submitting unsanitized POST field values that are echoed unescaped into HTML attributes and a textarea. The vulnerability is in the template engine's output function (`_show_var()` in `common/Template.php`), which lacks any `htmlspecialchars()` encoding, and is exploitable against any visitor - including a targeted administrator - enabling session token theft. No CISA KEV listing exists at time of analysis, but the CVE description provides exact code paths and a working payload, making independent exploit development trivial.

Reflected XSS in Smash Balloon Social Photo Feed for WordPress (all versions through 6.11.3) allows unauthenticated attackers to inject arbitrary JavaScript via the REQUEST_URI query string in admin callout pages. Successful exploitation requires tricking an authenticated WordPress user - likely an administrator - into clicking a crafted link, after which the injected script executes in their browser session. No public exploit code or CISA KEV listing has been identified; the CVSS vector assigns high attack complexity (AC:H) and required user interaction (UI:R), placing real-world risk below the raw severity suggests.

Stored XSS in SKT Skill Bar WordPress plugin (all versions up to and including 2.6) permits authenticated Contributor-level attackers to persist arbitrary JavaScript into any post or page by exploiting unsanitized handling of the `chart_size` attribute in the `skillwrapper` shortcode. The attribute value is concatenated directly into an inline `<style>` block without sanitization or output escaping, enabling CSS-context breakout and script injection that executes against every subsequent visitor. No public exploit code or CISA KEV listing was identified at time of analysis, though the vulnerable code is publicly browsable in the WordPress plugin repository, lowering the barrier to exploit development.

Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, placing current exploitation risk in the opportunistic-but-not-mass-exploitation tier.

Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites.

Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.