Cross-Site Scripting

Reflected XSS in ProjectSend r2029 exposes privileged user sessions to complete account takeover: an unauthenticated attacker crafts a malicious URL targeting thumbnails-regenerate.php with injected payloads in the start_date or end_date GET parameters, which are echoed raw into HTML attribute values without escaping. When a victim holding edit_settings permissions is socially engineered into clicking the link, the injected script executes in the application origin, enabling session cookie theft and unauthorized administrative actions - including user management, file management, and global settings changes. No public exploit has been identified at time of analysis; an upstream patch is available via GitHub commit and was reported by VulnCheck.

Stored cross-site scripting in Ghost CMS feature image captions enables any authenticated staff user to inject unsanitized HTML into the post revision history modal, hijacking the Ghost Admin session of another staff or administrator user who views that revision. Affects Ghost npm package versions v4.9.0 through v6.54.0. No public exploit identified at time of analysis and not listed in CISA KEV, but the privilege escalation potential - a lower-privileged staff member compromising a full administrator session - makes this higher-impact than the CVSS 4.3 score implies for multi-tenant or shared Ghost Admin environments.

CVE-2026-70441 is assigned within the Jenkins security advisory published 2026-08-05, which discloses over a dozen vulnerabilities across Jenkins core (2.575 and earlier, LTS 2.568.1 and earlier) and multiple plugins. The provided description is the full oss-security announcement for this advisory batch; the specific vulnerability details mapped to CVE-2026-70441 are not isolated in the available data due to truncation of the source text. The advisory as a whole addresses remote code execution via deserialization filter bypass, arbitrary file write via path traversal and crafted archive extraction, CSRF, permission bypass, and user impersonation flaws. No public exploit, KEV listing, or EPSS score was provided for CVE-2026-70441 individually.

Multiple high-severity vulnerabilities in Jenkins core and a range of plugins disclosed in the August 2026 security advisory allow attackers to achieve remote code execution on the Jenkins controller, perform arbitrary file writes, bypass deserialization protections, impersonate users, and enumerate stored credentials. Affected versions include Jenkins 2.575 and LTS 2.568.1 and earlier, with the most critical issues residing in the Remoting deserialization layer (CVE-2026-70426), tar archive handling (CVE-2026-70427), and file parameter path traversal (CVE-2026-70428), all of which ultimately enable code execution on the controller JVM. No public exploit or CISA KEV listing is confirmed at time of analysis, but the attack surface breadth and severity of RCE-capable issues make this advisory a high-priority patching event for any Jenkins deployment.

Client-side template injection in ember-dynamic-render-template exposes Ember.js applications to cross-site scripting when the render-template component receives attacker-controlled data through its templateString property. The addon's render-template.js passes templateString directly to Ember/Glimmer's compileTemplate() with no sanitization, allowlisting, or validation, causing the runtime to compile and execute arbitrary Handlebars expressions in the victim's browser. All published versions are affected per the CPE wildcard; no CISA KEV confirmation exists and no public exploit code has been identified at time of analysis.

Reflected XSS in OpenBK7231T firmware's OTA update endpoint exposes authenticated admins to JavaScript injection via a crafted link. The `/ota_exec` handler in `src/httpserver/http_fns.c` echoes the `host` query parameter verbatim into an HTML response using `hprintf255()`, without HTML encoding, enabling an attacker to run arbitrary script in the admin's browser session. No public exploit code or CISA KEV listing exists at time of analysis; EPSS data was not provided.

Reflected XSS in 299Ko CMS's public contact form allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by submitting unsanitized POST field values that are echoed unescaped into HTML attributes and a textarea. The vulnerability is in the template engine's output function (`_show_var()` in `common/Template.php`), which lacks any `htmlspecialchars()` encoding, and is exploitable against any visitor - including a targeted administrator - enabling session token theft. No CISA KEV listing exists at time of analysis, but the CVE description provides exact code paths and a working payload, making independent exploit development trivial.

Reflected XSS in Smash Balloon Social Photo Feed for WordPress (all versions through 6.11.3) allows unauthenticated attackers to inject arbitrary JavaScript via the REQUEST_URI query string in admin callout pages. Successful exploitation requires tricking an authenticated WordPress user - likely an administrator - into clicking a crafted link, after which the injected script executes in their browser session. No public exploit code or CISA KEV listing has been identified; the CVSS vector assigns high attack complexity (AC:H) and required user interaction (UI:R), placing real-world risk below the raw severity suggests.

Stored XSS in SKT Skill Bar WordPress plugin (all versions up to and including 2.6) permits authenticated Contributor-level attackers to persist arbitrary JavaScript into any post or page by exploiting unsanitized handling of the `chart_size` attribute in the `skillwrapper` shortcode. The attribute value is concatenated directly into an inline `<style>` block without sanitization or output escaping, enabling CSS-context breakout and script injection that executes against every subsequent visitor. No public exploit code or CISA KEV listing was identified at time of analysis, though the vulnerable code is publicly browsable in the WordPress plugin repository, lowering the barrier to exploit development.

Stored Cross-Site Scripting in the Simple Yearly Archive WordPress plugin (all versions through 2.2.4) permits authenticated attackers holding Contributor-level access or higher to inject persistent malicious scripts via the `posttype` attribute of the `SimpleYearlyArchive` shortcode. The injected payload is stored in the WordPress database and executes in the browser of any visitor who loads the affected page, enabling session hijacking, credential theft, or administrative account takeover. No public exploit or CISA KEV listing has been identified at time of analysis, placing current exploitation risk in the opportunistic-but-not-mass-exploitation tier.

Reflected XSS in the TranslatePress WordPress plugin (versions ≤ 3.2.5) allows unauthenticated attackers to inject and execute arbitrary JavaScript in victim browsers by abusing the plugin's internal `#!trpst#`/`#!trpen#` token-to-angle-bracket substitution, which runs after WordPress has already sanitized and escaped the search query parameter. Exploitation requires tricking an authenticated user into clicking a crafted search URL - no server-side authentication is required from the attacker (PR:N per CVSS vector). No confirmed active exploitation (not in CISA KEV) and no public POC have been identified at time of analysis, though the unauthenticated, low-complexity path and large WordPress plugin install base make this a meaningful exposure for unpatched sites.

Stored XSS in the Contact Form 7 Dynamic Text Extension WordPress plugin (all versions through 5.0.5) enables an authenticated Editor-level user to inject arbitrary JavaScript into form shortcode keys, which executes in an administrator's browser when the admin triggers the 'Scan Forms for Post Meta and User Data Keys' feature. The Scope:Changed CVSS metric correctly reflects that the injected payload runs in a higher-privilege context (administrator session) than where it was planted (editor account). No public exploit code and no CISA KEV listing exist at time of analysis; vendor-released patch version 5.0.6 resolves the issue.

Reflected Cross-Site Scripting in the Seraphinite Accelerator WordPress plugin (versions ≤ 2.29.15) allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by exploiting a PHP type-juggling flaw that completely bypasses the plugin's HMAC signature verification. The root cause is a two-part chain: the `CacheExtractPreparePageParams()` function uses PHP's loose `!=` operator to validate the nonce, which allows a JSON-decoded boolean `true` to compare as equal to any non-empty HMAC string, and the `_CbContentFinishSkip()` function then concatenates the attacker-controlled `selfTest` field from that unverified payload directly into the HTML response with no escaping. No public exploit or CISA KEV listing has been identified at time of analysis, but a patched version (2.29.18) is available and the Wordfence changeset confirms the vulnerable code paths.

Stored XSS in the Super Progressive Web Apps WordPress plugin (all versions through 2.2.43) enables authenticated WordPress administrators to persist arbitrary JavaScript payloads via the offline snackbar message setting, which executes in the browsers of site visitors when their browser transitions offline. The offline message is stored without sanitization, serialized into the page via wp_localize_script(), and rendered through innerHTML in the PWA snackbar component - a classic stored-to-DOM XSS chain crossing the administrator-to-visitor security boundary. No public exploit code or CISA KEV listing exists at time of analysis; the high privilege requirement substantially constrains real-world attack surface.

Stored Cross-Site Scripting in GeoDirectory WordPress plugin before 2.8.110 allows authenticated editors and higher-privileged users to persist malicious JavaScript via the place-category setting, which is rendered unsanitized on admin pages. The vulnerability is specifically significant in WordPress multisite deployments where the unfiltered_html capability is intentionally revoked for editors, as it bypasses that restriction through the plugin's own inadequate output handling. A public proof-of-concept exists via WPScan, though EPSS at 0.16% (6th percentile) and SSVC exploitation status of 'none' indicate no confirmed active exploitation at time of analysis.

Stored XSS in the WP Custom HTML Page WordPress plugin (≤0.6.2) enables users with the Author role to persist arbitrary JavaScript via an unsanitized custom page handler, which then executes for every visitor - including administrators - at a publicly accessible URL. The plugin fails both to sanitize HTML input and to enforce WordPress's native unfiltered_html capability restriction, effectively granting Author-level users a privilege they should not have. A publicly available exploit is documented by WPScan; EPSS (0.15%, 5th percentile) indicates no observed widespread opportunistic exploitation, though the public-URL delivery mechanism means admin-targeted attacks require no active phishing.

Stored XSS in the Orbit Fox WordPress plugin (versions before 3.0.8) allows authenticated users holding at least the Author role to upload malicious SVG files containing arbitrary JavaScript, which then executes in the browser context of any visitor who views the file - including administrators. The vulnerability is gated on the plugin's optional SVG upload feature being enabled. A public proof-of-concept is available via WPScan; CISA KEV listing is not confirmed, and EPSS sits at a low 0.17% (7th percentile), indicating limited automated campaign targeting at time of analysis. Vendor-released patch version 3.0.8 is available.

Reflected Cross-Site Scripting in the Football Pool WordPress plugin (all versions ≤ 2.13.4) allows unauthenticated attackers to inject arbitrary JavaScript into the browsers of authenticated WordPress subscribers via the Shoutbox widget's `shouttext` POST parameter. The flaw is triggered when a shoutbox submission fails validation - nonce mismatch, empty input, or save failure - causing the raw POST value to be echoed unescaped into a `<textarea>` via `printf('%s', ...)`. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but a remediation commit (changeset 3538628) has been pushed to the plugin trunk.

Cross-site scripting in Ghost CMS (versions 5.26.0 through 6.54.0) allows a high-privileged administrator to plant arbitrary JavaScript via the Universal Import feature, which fails to sanitize the `feature_image_caption` field and link card URLs before storing and rendering them. The fix in v6.54.1 introduces DOMPurify sanitization across both the Ember-based admin post history modal and the Node.js frontend rendering pipeline, alongside a strict URL protocol allowlist in the JSON-to-HTML importer. No active exploitation is confirmed (not in CISA KEV) and no public proof-of-concept is known; the high-privilege prerequisite substantially limits the realistic attacker pool.

Reflected XSS in Snowstorm's Web Route redirection endpoint allows remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by luring them to a crafted malicious link. The vulnerability resided in a Spring Boot REST controller's error-handling path, where attacker-controlled input in the `uri` parameter was reflected verbatim in a 400 Bad Request response body; when combined with an `Accept: text/html` request header, Spring's content negotiation rendered the response as HTML, enabling script injection. No CISA KEV listing or public exploit code was identified at time of analysis; two upstream patch commits and a CISA advisory reference confirm vendor acknowledgment and fix availability in versions 10.12.2 and 10.9.3.

Stored cross-site scripting in Django admin's URLField rendering allows a malicious URL value (e.g., using a `javascript:` scheme) to be displayed as a clickable link on changelist views and read-only admin fields without scheme validation. Any application that accepts URLField input via public-facing forms and exposes those records in the Django admin is affected, covering Django 5.2 through the 6.1 release candidate. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; patches were released August 4, 2026 as Django 5.2.17 and 6.0.8.

URI scheme injection in @a2ui/web_core's openUrl function enables stored or reflected XSS by allowing an agent-controlled javascript: URI to be passed directly to window.open() without validation. Any application using the Button component's functionCall action on default deployments is affected, since the Basic Catalog is enabled with no special configuration required. CVSS 4.0 impact metrics VC:H/VI:H confirm full confidentiality and integrity compromise at the vulnerable-system level; no active exploitation is confirmed (CVSS E:U, no CISA KEV listing).

Cross-site scripting in Perspective 5.0.0's built-in Debug plugin enables an authenticated attacker with low privileges to inject arbitrary HTML and JavaScript into the embedding page's origin by writing crafted table cell values that bypass RFC 4180 quoting. The Debug plugin's CSV serialization renderer assigns table cell content directly to innerHTML without sanitization, meaning event handler attributes and unquoted injection payloads execute as script in any page embedding the component. A publicly available proof-of-concept exists; the vulnerability is not listed in CISA KEV, but the low attack complexity and available exploit code elevate practical risk above the moderate CVSS 4.0 score of 5.1.

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 23.1.0 through 25.1.3 allows a high-privileged developer-role user to inject persistent malicious JavaScript into a UI component, which then executes in the browser context of any user who subsequently views the affected interface. The attack requires both a developer-role account to plant the payload and victim user interaction to trigger it, substantially limiting realistic blast radius compared to typical stored XSS. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Stored XSS in HUMANIST Digital Human Resources version 26.0 enables authenticated low-privilege users to inject persistent malicious scripts that execute in the browsers of other platform users, including higher-privileged HR administrators. The vulnerability was disclosed by TR-CERT (advisory TR-26-0737) and is resolved in version 26.1. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Unrestricted file upload in the Chat Widget WordPress plugin before 1.8.2 allows any network-reachable user to submit arbitrary files to the plugin's public response endpoint, bypassing all validation of type, extension, content, and size. Uploaded files are stored in the WordPress uploads directory under bare UUIDs - stripping the original extension - which explicitly prevents code execution or stored XSS despite the CWE-434 classification. Real-world impact is bounded to disk exhaustion and abuse of the hosting environment to serve attacker-controlled static content, conditional on the channel's response storage or mail-forwarding feature being configured. No public exploit identified via CISA KEV; however, a proof-of-concept is publicly available per WPScan, and EPSS at 0.16% (6th percentile) signals minimal observed exploitation activity.

Stored Cross-Site Scripting in the PowerPress Podcasting plugin by Blubrry (WordPress) before version 11.16.11 allows any authenticated user holding the Contributor role to inject and persist arbitrary JavaScript via unsanitized Podcast Episode settings fields. The injected payload executes in the browsers of higher-privileged users - including editors and administrators - who view the affected content, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed by CISA KEV, and the EPSS probability stands at a low 0.15%, suggesting opportunistic rather than widespread exploitation at this time.

Stored cross-site scripting in the Brizy WordPress plugin before 2.8.19 allows any authenticated user with Contributor role or above to plant persistent XSS payloads via unsanitized featured-image focal-point coordinates submitted through an AJAX action. When a higher-privileged user (Editor or Administrator) later opens the affected post for review, the injected script executes silently in their browser session, enabling session hijacking or unauthorized administrative actions. A publicly available exploit exists per WPScan; the vendor has released a fix in version 2.8.19.

Stored XSS in the Brizy WordPress plugin (all versions before 2.8.19) allows authenticated Author-level users to inject arbitrary JavaScript into site-global design data, which is then rendered unsanitized on every front-end page of the affected site. Every visitor's browser - including site administrators - silently executes the payload upon page load, enabling session hijacking, credential theft, or full site takeover. A publicly available proof-of-concept exists per WPScan, though no active exploitation is confirmed in CISA KEV; EPSS sits at 0.16% (6th percentile), suggesting opportunistic rather than automated mass exploitation.

Stored cross-site scripting in the Nested Pages WordPress plugin (all versions before 3.2.15) allows authenticated users holding the Editor role - or Contributor/Author roles when the plugin is configured to manage those post types - to inject arbitrary JavaScript via unsanitized post titles that are reflected unescaped into HTML attributes on the plugin's administrative listing screen. Any higher-privileged user (including Administrators) who subsequently loads that screen will execute the attacker-controlled script within their own authenticated session, enabling session hijacking, credential theft, or unauthorized administrative actions. A publicly available proof-of-concept exploit exists per the WPScan advisory; the vulnerability is not listed in CISA KEV and the EPSS score is negligible (0.15%, 5th percentile), suggesting opportunistic rather than widespread active exploitation.

Stored cross-site scripting in the Quiz and Survey Master (QSM) WordPress plugin before 11.2.2 allows contributor-level (and higher) WordPress users to inject arbitrary JavaScript into quiz question settings via an unquoted HTML attribute. The injected payload persists and executes in the browser of any site visitor who views the affected quiz, enabling session hijacking, credential theft, or defacement targeting the broader user base. No active exploitation is confirmed by CISA KEV, but a public proof-of-concept is available via WPScan, and vendor-released patch version 11.2.2 is available.

Reflected XSS in O2OA v10's Forum posting function allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by convincing them to click a crafted URL. The Changed scope (S:C) in the CVSS vector confirms the exploit breaks out of the application's origin into the broader browser context, enabling session token theft or unauthorized actions on behalf of the victim. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.22% (12th percentile) alongside SSVC 'Exploitation: none' indicate low real-world exploitation activity at time of analysis.

Cross-site scripting in Soliton Systems MailZen Management Portal versions 2.62 and 2.63 allows a network-accessible, unauthenticated attacker to inject malicious JavaScript into user-controlled fields (Role Name, First Name, Last Name, Username) that is subsequently rendered to authenticated users - most likely administrators reviewing account data. Exploitation yields client-side arbitrary JavaScript execution in the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is recorded in CISA KEV, and EPSS indicates a 0.19% probability of near-term exploitation; however, a public researcher writeup exists on GitHub (FahadAljuaid), meaningfully raising practical risk.

Stored XSS in Microweber CMS through version 2.0.20 allows admin-authenticated attackers to persist arbitrary JavaScript via the tag_names parameter of the GET /api/save_content_admin endpoint, defeating three independent sanitization layers through a combination of HTTP-method blind middleware, an overly narrow unsafe-attribute pattern, and a titlecase normalizer that passes HTML decimal entity-encoded payloads unchanged. Injected scripts execute silently for every public blog visitor and within the admin post editor, enabling same-origin CSRF token abuse for session riding and account takeover chaining. A public proof-of-concept exploit exists; no CISA KEV listing is present at time of analysis.

Stored cross-site scripting in OpenAkita's File Upload API (/api/upload) allows remote attackers to inject persistent malicious scripts by manipulating file-related arguments, affecting all versions through 1.27.12. The Notion-hosted proof-of-concept confirms this is a storage-type XSS, meaning the payload persists server-side and executes in victims' browsers upon subsequent access to the affected content. A public exploit exists and the vendor did not respond to responsible disclosure, leaving no official patch; exploitation is constrained by high attack complexity (AC:H) and required user interaction (UI:P), reflected in the low CVSS 4.0 score of 2.3.

Stored cross-site scripting in OPNsense before 26.1.9 allows any authenticated user with certificate management access to plant a persistent JavaScript payload via the trust certificate API's description field. Once stored, the payload executes in the browser of every authenticated user who opens the Dashboard, because Certificates.js interpolates the raw description directly into an HTML attribute template literal without output encoding. No active exploitation has been confirmed (not in CISA KEV), and a vendor-released patch is available as of OPNsense 26.1.9.

Stored cross-site scripting in OPNsense before 26.1.9 allows low-privileged authenticated attackers holding firewall rule management rights to inject arbitrary JavaScript into rule description fields via the filter API, which then executes in any authenticated administrator's browser when the Firewall Rules page is loaded. Impact is limited to subsequent-system effects - session hijacking or credential theft targeting other authenticated users - rather than direct host compromise. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis; a vendor-released patch is available in OPNsense 26.1.9 as of June 2, 2026.

Reflected XSS in oaskit (Elixir/Plug OpenAPI request-validation library) versions 0.1.0 through 0.14.0 allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser by inducing them to navigate to a crafted GET URL. The default HTML error handler interpolates request-controlled strings - object keys from query parameters or request bodies that appear in JSON Schema instance paths, and the raw Content-Type header - directly into HTML error pages without escaping. Both HTML error rendering and the vulnerable handler are enabled by default, so all applications following documented oaskit usage are exposed without any opt-in configuration; no public exploit tool is identified at time of analysis, though the advisory contains a working payload example demonstrating trivial exploitability.

Stored cross-site scripting in OpenEMR's patient portal template system (through version 8.2.0) allows authenticated administrators to inject persistent JavaScript payloads that execute in the browsers of any admin, clinician, or portal patient who views a poisoned template. The combination of absent output encoding at the template retrieval endpoint and missing HttpOnly attributes on session cookies enables direct document.cookie exfiltration, resulting in full session hijacking of privileged healthcare accounts. No public exploit identified in CISA KEV, but a publicly available proof-of-concept and detailed researcher writeup (VulnCheck / jivasecurity.com) significantly lower the bar for exploitation in targeted scenarios.

Cross-site scripting in HP DesignJet large-format printers allows adjacent-network unauthenticated attackers to inject malicious scripts via crafted HTTP requests that execute when a user views print job previews through the device's embedded web interface. The CVSS 4.0 vector (AV:A/VI:H) constrains the attack to local network adjacency while indicating high integrity impact - consistent with an attacker manipulating displayed print job content or forging actions within the printer's management UI. No public exploit has been identified at time of analysis, and HP has self-disclosed the issue.

Reflected XSS in Admidio's SSO/SAML endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers by injecting payloads into SAML Issuer elements or LightSaml library parameters, which the server echoes back unencoded in exception messages. All Admidio installations before version 5.0.11 with SSO/SAML functionality enabled are affected. Successful exploitation can lead to session hijacking and account takeover. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.

Stored XSS via Vue template injection in FlowIntel allows an authenticated low-privilege user to persist malicious Vue interpolation expressions across multiple data fields, causing arbitrary JavaScript execution in the browsers of any user who views the poisoned content. The root cause is that Jinja2's standard HTML escaping neutralizes raw HTML tags but does not prevent FlowIntel's custom [[ ... ]] Vue delimiters from being evaluated when the server-rendered output is later compiled by Vue on the client side. Successful exploitation can expose session tokens, sensitive case data, and any information visible to the victim, or perform privileged actions within the victim's authenticated session. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in the Simple Membership WordPress plugin before 4.7.8 allows unauthenticated attackers to inject arbitrary JavaScript into the WordPress administration dashboard by supplying a malicious subscriber name in a payment approval request. Because the plugin neither sanitizes the input at ingestion nor escapes it on output when rendered for administrators, the payload persists server-side and executes in any administrator's browser session upon viewing the affected dashboard panel. A public proof-of-concept exploit exists (reported by WPScan); however, EPSS stands at 0.17% (7th percentile) and CISA KEV listing is absent, indicating limited observed mass exploitation at time of analysis.

Stored cross-site scripting in the Blog Floating Button WordPress plugin (≤1.4.20) allows unauthenticated attackers to inject malicious JavaScript via the HTTP User-Agent header into the plugin's visitor tracking REST endpoint. The payload persists in the database and executes in the browser session of any administrator who opens the plugin's access report page, enabling full site takeover through the hijacked admin session. A publicly available proof-of-concept from WPScan confirms the attack path; no vendor-released patch has been identified at time of analysis.

Stored XSS in the SVG Support WordPress plugin (before 2.5.17) is achieved by uploading a script-bearing .svgz file, bypassing the plugin's sanitization logic that applies only to .svg uploads despite both extensions being registered and served as SVG content. Any WordPress user role granted SVG upload access - such as an Author - can plant the payload, which then executes in the browser of any subsequent visitor, including administrators, enabling session hijacking or privileged action injection. A public proof-of-concept exists via WPScan; EPSS is low (0.16%, 6th percentile) and SSVC rates exploitation as non-automatable, but the stored nature of the payload and admin-reachability elevate practical impact.

Stored XSS in Emlog CMS versions up to and including 2.6.14 enables an authenticated attacker with article submission access to inject persistent JavaScript into the backend admin review workflow, ultimately achieving full administrative compromise. The payload executes in the administrator's browser when they review or preview the malicious article via /admin/article.php, enabling the attacker to silently create backdoor administrator accounts. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS is 0.20% at the 10th percentile, indicating low opportunistic exploitation probability, though the privilege escalation impact exceeds what the CVSS Medium score alone suggests.

Stored XSS in osTicket v1.18.3 allows unauthenticated attackers to inject persistent JavaScript into ticket thread views by embedding a malicious payload in the From display name of an inbound email. The unsanitized value is extracted by class.mailparse.php and written raw to the poster field of ost_thread_entry, where it is later rendered without HTML encoding across at least six PHP templates serving both the staff panel and client portal. The upstream commit fix is publicly available, a researcher proof-of-concept disclosure exists, and every staff agent or client who opens the affected ticket executes the payload - multiplying impact from a single malicious email.

Stored XSS in osTicket 1.18.3 allows an unauthenticated external attacker to inject arbitrary JavaScript through the ticket thread entry title field, with the payload executing in the staff portal whenever a support agent views the affected thread. Source code references confirm that at least four PHP templates echo `$entry->title` without calling the existing `Format::htmlchars()` sanitization helper, a straightforward omission patched in commit 1e39bf1. A public researcher disclosure (fr3akhacks/cve-disclosures) confirms proof-of-concept details are available, though SSVC rates exploitation status as none and no CISA KEV listing has been issued, indicating no confirmed active exploitation at time of analysis.

Stored cross-site scripting in luci-app-adblock-fast before 1.2.4-4 allows a lower-privileged LuCI user to inject malicious JavaScript into the blocklist name field, which executes in an administrator's browser under the LuCI origin when the AdBlock Fast status page is viewed. Because the payload runs within the LuCI same-origin context, a successful attack could enable session hijacking, unauthorized router reconfiguration, or privilege escalation from low-privileged user to effective admin control. No public exploit is identified at time of analysis; a vendor patch is available via the GitHub Security Advisory GHSA-q335-4c83-c88h.

Stored cross-site scripting in Exclusive Addons for Elementor (WordPress plugin, all versions through 2.7.9.8) allows any authenticated contributor-level WordPress user to permanently inject arbitrary JavaScript into pages via the `exad_infobox_image` parameter of the infobox widget. The injected payload executes in the browser of any user who subsequently views the compromised page, including administrators, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though Wordfence's changeset reference suggests source-code-level details are publicly accessible.

Stored Cross-Site Scripting in the Charitable WordPress donation plugin (versions before 1.8.5.3) allows authenticated users holding a high-privilege campaign-management role to inject persistent malicious scripts via an unsanitized campaign image text field that is rendered unescaped inside an HTML attribute on the public-facing campaign page. Any site visitor who loads that page becomes a potential victim, enabling session hijacking, credential theft, or defacement against the site's front-end audience. A publicly available proof-of-concept exploit exists; however, no active exploitation has been confirmed in CISA KEV, and the EPSS score of 0.16% (6th percentile) reflects low broad-exploitation probability consistent with the high-privilege prerequisite.

Stored cross-site scripting in the Event Booking Manager for WooCommerce WordPress plugin (all versions before 5.3.7) permits any authenticated user holding the Author role or higher to permanently inject arbitrary JavaScript into event timeline content. Because the plugin fails to sanitize or escape this input before storing and rendering it on public event pages, every site visitor - including administrators - who loads the affected event page executes the attacker's script in their own browser context. A publicly available proof-of-concept exists; no active exploitation is confirmed in CISA KEV, but the low barrier to entry (any Author-level account) elevates practical risk on sites permitting open or semi-open registration.

Stored cross-site scripting in the Narrative Publisher WordPress plugin (≤1.0.7) lets contributor-level authenticated users inject arbitrary JavaScript into a REST-accessible post meta field that is neither access-controlled nor escaped on output. When any higher-privileged user - editor, administrator - views the affected post, the malicious script executes in their browser session, enabling session hijacking or privilege escalation to site administrator. A public proof-of-concept is available via WPScan; no KEV listing is present and the EPSS score (0.15%, 5th percentile) indicates limited opportunistic exploitation at time of analysis.

Stored cross-site scripting in Element Pack Addons for Elementor WordPress plugin before 8.7.13 allows contributor-level (or higher) authenticated users to inject persistent JavaScript payloads via unsanitized data attributes, which a bundled front-end library subsequently re-parses and renders in victim browsers. Any site visitor loading the compromised page executes the attacker's script in their browser session, enabling session token theft, credential harvesting, or arbitrary actions on behalf of the victim - including administrators. A public proof-of-concept exists via WPScan, though EPSS at 0.16% and SSVC exploitation status of 'none' indicate no observed widespread exploitation at time of analysis.

Stored XSS in the RT Mega Menu WordPress plugin (versions before 1.5.2) allows any subscriber-level authenticated user to inject persistent JavaScript into the site's public navigation, executing against every visitor who hovers over menu items - including administrators - enabling session theft and full site takeover. The AJAX endpoint that saves mega-menu configuration performs no capability check, relying solely on a nonce that any logged-in user can read from a standard admin page, making the access barrier trivially low. A public exploit is documented by WPScan, and the vendor has released version 1.5.2 as the confirmed fix; no public exploit identified at time of analysis corresponds to active widespread exploitation (no CISA KEV listing), though the public exploit code exists and the low subscriber-level barrier makes this dangerous on sites with open registration.

Stored Cross-Site Scripting in JetEngine WordPress plugin before 3.8.12 allows users holding the Contributor role or higher to inject persistent malicious scripts via unescaped post meta values rendered by plugin shortcodes, with execution occurring in the browser context of higher-privileged users including administrators. A publicly available exploit exists per WPScan, though EPSS remains low at 0.15% (5th percentile), suggesting limited observed mass exploitation at time of analysis. The scope-change characteristic (S:C in CVSS) elevates the real-world impact: successful exploitation can lead to admin session hijacking or unauthorized privileged actions despite the medium base score.

Reflected XSS in King Addons for Elementor (all versions before 51.1.76) permits unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding a malicious payload in an unsanitized grid setting parameter reflected verbatim into an HTML attribute via an unauthenticated AJAX endpoint. The attack requires social engineering to deliver a crafted URL to a target user, with no privilege or authentication prerequisite on the server side. A publicly available exploit exists per WPScan; exploitation is not confirmed in CISA KEV, and EPSS at 0.17% (7th percentile) indicates limited observed exploitation at this time.

Stored XSS in better-auth's deprecated oidc-provider and mcp plugins allows an attacker to register an OAuth client with a javascript: redirect_uri, which the authorization server stores and later returns unchanged in the consent response. If the deployment's consent page is a client-side component that assigns the returned redirectURI to window.location.href or equivalent, the attacker's JavaScript executes in the authorization-server origin - exposing the victim's session tokens and enabling account takeover. No public exploit or CISA KEV listing has been identified; the CVSS 4.0 score of 5.1 reflects required user interaction and limited subsequent-system impact, though deployments with unauthenticated dynamic client registration face elevated real-world risk.

Reflected XSS in better-auth's /api/auth/error endpoint enables arbitrary JavaScript execution in a victim's browser when a user visits an attacker-crafted URL containing a malicious 'error' query parameter that is reflected as unsanitized HTML. All npm releases of better-auth from version 0.0.2 up to (but not including) 1.1.16 are affected, spanning virtually the entire release history of the library. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the attack surface is inherently internet-accessible and requires only social engineering to trigger.

Stored cross-site scripting in JupyterLab's Extension Manager allows an attacker who publishes a malicious PyPI package to execute arbitrary JavaScript in the JupyterLab browser origin. The frontend in widget.tsx renders PyPI package metadata URLs as raw anchor hrefs without protocol validation, so a `javascript:` URL placed in `[project.urls]` metadata fires the moment a victim clicks the extension name. Affects all JupyterLab releases before 4.5.9; no confirmed active exploitation (not in CISA KEV) but the attack barrier is low - only a PyPI account is required to stage the payload.

Stored cross-site scripting in luci-app-https-dns-proxy allows a highly privileged but potentially lower-trust authenticated LuCI user to persist a malicious JavaScript payload via the resolver_url parameter, which then silently executes in any administrator's browser when the HTTPS DNS Proxy status page is loaded. All currently tracked LuCI versions appear affected per EUVD listing (luci 0 <*). No public exploit code or CISA KEV listing is confirmed at time of analysis, though the stored nature of this XSS makes it more dangerous than a reflected variant because no additional attacker interaction is needed after initial injection.

Reflected XSS in the WP Responsive Thumbnail Slider WordPress plugin (all versions before 1.1.53) enables unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing the 'id' parameter. The vulnerable surface is the responsive_thumbnail_image_management() function, which echoes raw GET input into an HTML attribute without esc_attr() and whose only guard - a loose PHP numeric comparison - is trivially bypassed by any string prefixed with a digit. Exploitation requires social engineering a privileged WordPress user into clicking the crafted link; no public exploit or CISA KEV listing has been identified at time of analysis.

Reflected Cross-Site Scripting in the Fluent Forms WordPress plugin (versions up to and including 6.2.8) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by embedding malicious payloads in the 'param' parameter. The vulnerability originates from insufficient sanitization and output escaping in Component.php (lines 1452 and 1456), and exploitation requires social engineering - the attacker must trick a user into clicking a crafted URL. A patch was released in version 6.2.9, confirmed by the WordPress Trac changeset. No public exploit code or CISA KEV listing is identified at time of analysis.

Stored cross-site scripting in the Powerkit plugin for WordPress (all versions up to and including 3.1.0) allows authenticated attackers holding contributor-level access to inject persistent JavaScript payloads via the 'style' shortcode attribute, which execute silently in any visitor's browser upon viewing an injected page. The root cause is confirmed by Wordfence (security@wordfence.com) and traceable to missing output escaping in the plugin's basic-elements module across at least two code paths and one template file. No CISA KEV listing or public exploit code has been identified at the time of analysis, though the low privilege bar - contributor access - makes this a practical threat on multi-author WordPress deployments.

Stored Cross-Site Scripting in the Powerkit plugin for WordPress (all versions through 3.1.0) allows authenticated attackers with contributor-level access to inject arbitrary JavaScript via shortcode attributes in the basic-elements module. The injected payload persists server-side and executes in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS Scope:Changed rating and Wordfence disclosure reflect meaningful cross-user impact.

Stored Cross-Site Scripting in GamiPress WordPress plugin (versions through 7.9.9.1) enables contributor-level authenticated users to inject persistent JavaScript payloads via the 'gamipress_rank' shortcode, which then executes silently in any visitor's browser upon page load. The CVSS Scope Changed metric (S:C) reflects that injected scripts escape the plugin's component boundary and can compromise administrator sessions or site visitors. No public exploit code has been identified at time of analysis, and this CVE does not appear in CISA KEV.

Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin allows authenticated contributors to persist malicious JavaScript in pages, which executes silently in any visitor's browser. All plugin versions up to and including 2.2.11 are affected via the 'layoutCircle.alignment' block attribute in the progress-bar block, where attacker-controlled input is neither sanitized on entry nor escaped on output. Wordfence reported this flaw; no public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar is low on many WordPress sites.

Stored cross-site scripting in the Download Manager WordPress plugin (all versions through 3.3.66) allows authenticated contributors to inject persistent JavaScript payloads via the 'icon' shortcode attribute, which execute automatically in the browser of any user who visits an injected page. The flaw exploits a gap in WordPress's wp_kses_post() sanitization: it processes post content at save time but does not intercept shortcode attribute values that are echoed unescaped at render time, as confirmed by source code at UI.php#L81 and Shortcodes.php#L18. No public exploit code or CISA KEV listing is present at time of analysis, but the low privilege bar (contributor access) and automatic payload execution upon page view elevate practical risk on multi-author WordPress sites.

Stored Cross-Site Scripting in the GamiPress WordPress plugin (all versions through 7.9.9.1) permits contributor-level authenticated users to inject persistent JavaScript payloads via the `heading_size` attribute of the `gamipress_achievement` shortcode. The root cause is a WordPress-specific sanitization gap: wp_kses_post strips disallowed HTML at save time but cannot neutralize payloads embedded inside shortcode attribute strings, which are only interpolated into HTML output at render time without escaping — meaning the injected script executes in any visitor's browser who loads the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of the payload and the low privilege bar make this a meaningful risk on multi-author WordPress deployments.

Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8.1) lets authenticated contributors permanently embed malicious scripts into WordPress pages via the Identity Block's inner image content, with those scripts executing in the browsers of any subsequent visitor. The vulnerable code path inside build_html() is only reachable when the Identity Block's urlTransparent attribute is explicitly set to a non-empty value, narrowing exposure to sites where contributors actively configure this specific block attribute. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified, though the CVSS Scope:Changed rating reflects that injected payloads execute in victim browser contexts rather than being confined to the server side.

Stored Cross-Site Scripting in the Kadence Blocks WordPress plugin (all versions through 3.7.8) allows authenticated contributors to inject persistent JavaScript payloads via the 'toggleIcon' block attribute, which execute in the browsers of any user who subsequently visits the poisoned page. The scope change (S:C in CVSS) means impact crosses from the plugin into victim browser sessions, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing is identified at time of analysis, but the low barrier to exploitation-contributor-level access is readily obtained on multi-author WordPress sites-elevates practical risk above the moderate CVSS score might suggest.

Stored Cross-Site Scripting in the Powerkit - Supercharge Your WordPress Site plugin (versions up to and including 3.1.0) enables authenticated contributors to inject persistent malicious scripts via the 'nav' shortcode attribute that execute in any visitor's browser upon page load. Reported by Wordfence, the flaw originates in the tabs.php template and the public class handler where shortcode input is passed to output without sanitization or escaping. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS scope-changed vector (S:C) indicates cross-user impact with a 6.4 medium-high base score.

Stored Cross-Site Scripting in the Advanced Woo Labels - Product Labels & Badges for WooCommerce WordPress plugin (all versions through 2.48) allows authenticated contributors to permanently inject malicious JavaScript via the 'bg_color' parameter into product label definitions. Insufficient input sanitization across multiple rendering functions - confirmed at specific lines in class-awl-label-view.php, awl-functions.php, and class-awl-admin.php - means the payload persists in the database and executes in any visitor's browser on affected product pages. No active exploitation has been confirmed (not in CISA KEV), and no public POC has been identified; a fix was committed in WordPress SVN changeset 3627180.

Stored Cross-Site Scripting in the GenerateBlocks WordPress plugin (all versions through 2.3.0) allows authenticated contributors to permanently inject malicious JavaScript into published pages by exploiting unsanitized dynamic tag rendering in non-URL HTML attributes. An attacker with contributor-level WordPress access can chain a dynamic tag placeholder (e.g., {{post_meta key:...}}) in an element attribute with a crafted post meta value containing attribute-breaking syntax, causing script execution in the browser of any subsequent visitor. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the detailed technical disclosure from Wordfence lowers the bar for independent exploitation.

Stored Cross-Site Scripting in the Easy Property Listings WordPress plugin (all versions up to and including 3.5.24) allows any authenticated subscriber-level user to permanently inject malicious JavaScript through the 'facebook' User Contact Method profile field. The injected payload persists in the WordPress database and executes automatically in the browser of any site visitor who views a property listing page rendering the compromised author profile, enabling session hijacking, credential theft, or administrative account takeover. No KEV listing or confirmed public exploit code was identified in the available input data; a fix changeset exists in the WordPress plugin repository but an exact patched release version is not confirmed from the provided data.

Stored cross-site scripting in the Download Manager WordPress plugin before 3.3.66 allows any authenticated user with the Author role or above to inject a malicious JavaScript payload into a download package title, which then executes in the browser of every visitor - including unauthenticated users - who views any page rendering that package. A publicly available proof-of-concept exists, though the EPSS score of 0.19% (9th percentile) and absence of a CISA KEV listing suggest exploitation remains limited and targeted rather than widespread. Vendor-released patch version 3.3.66 is available.

Stored cross-site scripting in wpForo Forum WordPress plugin before 3.1.2 allows a subscriber-level authenticated user to inject persistent JavaScript into a profile field that executes in any visitor's browser - including logged-in administrators - upon viewing the attacker's public participant profile page. A publicly available proof-of-concept exploit exists, and the CVSS scope change (S:C) reflects that the injected script runs in victim browser contexts entirely outside the plugin's security boundary, enabling credential theft or admin-level site takeover. EPSS is low (0.15%, 5th percentile), suggesting mass exploitation has not yet materialized despite the public POC.

Stored cross-site scripting in the Codeless Page Builder WordPress plugin (versions through 1.1.4) allows contributor-level users to inject arbitrary HTML and JavaScript by supplying unsanitized input as an HTML tag name via a shortcode attribute. When a higher-privileged user such as an administrator views the crafted content, the payload executes in their browser session, enabling session hijacking or unauthorized administrative actions. A public exploit proof-of-concept is available via WPScan; exploitation probability is low per EPSS (0.15%, 5th percentile), suggesting opportunistic rather than widespread active targeting.

Stored cross-site scripting in Admin Columns for ACF Fields WordPress plugin (through 0.3.2) allows contributor-level users to inject unsanitized JavaScript via Advanced Custom Fields values that execute in the browser session of any higher-privileged user who views the affected post-list admin screen. The scope change (S:C in CVSS) reflects that the payload crosses privilege boundaries - a low-privileged contributor can target editors and administrators. A publicly available exploit has been published by WPScan, though EPSS at 0.15% (5th percentile) indicates limited observed exploitation in the wild, and this CVE is not listed in the CISA KEV catalog.

Stored cross-site scripting in the Bit Form WordPress plugin (versions before 3.1.4) allows administrator-level users to inject persistent JavaScript into a conversational-form display setting that then executes in the browser of any site visitor who views the affected form. The vulnerability is particularly relevant on WordPress multisite installations, where administrators do not hold the unfiltered_html capability and are therefore expected to be constrained to safe content - making this a bypass of that trust model. A public proof-of-concept exists per WPScan, though EPSS sits at 0.16% (6th percentile), suggesting negligible observed exploitation activity at time of analysis.

Stored Cross-Site Scripting in the SendPulse Email Marketing Newsletter WordPress plugin (all versions through 2.2.5) allows authenticated contributors to inject persistent malicious scripts that execute against any visitor - including administrators - who views a page rendering the [sendpulse-form] shortcode. The attack exploits an allow-list bypass in the _sp_form_code Post Meta: by prepending a benign SendPulse loader script tag to an arbitrary payload (such as an img onerror handler), the sanitization check is circumvented and the script is stored and later reflected into victim browsers. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed bypass technique described in the disclosure lowers the bar for reproduction significantly.

Stored Cross-Site Scripting in the SureForms WordPress plugin (all versions through 2.8.1) allows authenticated contributors to inject persistent JavaScript payloads via the unsanitized 'headingWrapper' parameter in the Advanced Heading Gutenberg block. Any user who subsequently visits a page containing the injected block triggers script execution in their browser, creating a realistic path to admin session hijacking when site administrators review contributor-submitted content. No public exploit code has been identified at time of analysis, and a patch is available in version 2.8.2.

Stored and DOM cross-site scripting in the Jodit WYSIWYG editor (npm, all versions before 4.13.6) allows attacker-supplied JavaScript to survive the clean-html sanitizer by exploiting a case-sensitivity flaw in the deny/allow tag filter. SVG- and MathML-namespaced elements return lowercase nodeName values, while the denyTags hash is keyed by uppercase strings, so a `<script>` nested inside `<svg>` reports 'script' instead of 'SCRIPT' and passes the filter unblocked. A publicly disclosed proof-of-concept exists; the vulnerability is not listed in CISA KEV.

Stored click-XSS in Jodit WYSIWYG editor (all versions through 4.12.30) allows a low-privileged content author to persist obfuscated `javascript:` hrefs that bypass the editor's sanitizer and execute attacker-controlled JavaScript in the victim's browser on click. The bypass exists because `sanitizeHTMLElement` uses a case-sensitive `href.trim().indexOf('javascript') === 0` check—without lowercasing or stripping control bytes—while every other URL attribute already routes through the stricter `isDangerousUrl()` normalizer. No public exploit is listed in CISA KEV, but a working proof-of-concept is confirmed in the GitHub Security Advisory (GHSA-j839-gqq4-gf9j) against the shipped 4.12.30 build.

Stored cross-site scripting in AWS Ops Wheel's participant URL handling allows an authenticated user to inject persistent malicious JavaScript via a crafted participant_url containing a dangerous URI scheme (e.g., javascript:). When a higher-privileged user - most critically an administrator - views the affected participant entry, the payload executes in their browser, enabling session token theft and full administrative takeover of the deployed instance. No public exploit or active exploitation has been identified at time of analysis; remediation requires redeployment from the latest source incorporating PR #168.

Stored or reflected cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) allows a high-privileged authenticated attacker to inject script-related HTML tags into web pages that are subsequently rendered in other users' browsers. The attack requires passive user interaction from a victim and yields low-confidentiality impact, consistent with session token or cookie theft scoped to the vulnerable application. No public exploit code and no CISA KEV listing have been identified at time of analysis; CVSS 4.0 score of 4.8 reflects the constrained, privilege-gated nature of the vulnerability.

Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Stored cross-site scripting in Roskus Prospero Flow CRM before v5.5.3 allows authenticated users holding the 'create lead' or 'update lead' permission to inject persistent JavaScript payloads via the lead name field. The application renders lead names through Blade's unescaped output directive and embeds them unsanitized inside a JavaScript string literal in an onclick attribute, providing two distinct injection sinks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.

Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. A publicly available proof-of-concept exists per WPScan; EPSS is low (0.16%) but SSVC flags total technical impact due to the Super Admin session takeover potential on multisite deployments.