Cross-Site Scripting

Stored cross-site scripting in Johnson Controls FM Systems Employee (versions before 2025.3.1) enables a high-privileged authenticated attacker to inject persistent malicious scripts into the application that execute in victims' browsers when they view the affected content. The CVSS 4.0 vector (PR:H/UI:P) confirms exploitation requires an administrative-level account for payload injection and passive user interaction from a second victim. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Stored cross-site scripting in Roskus Prospero Flow CRM before v5.5.3 allows authenticated users holding the 'create lead' or 'update lead' permission to inject persistent JavaScript payloads via the lead name field. The application renders lead names through Blade's unescaped output directive and embeds them unsanitized inside a JavaScript string literal in an onclick attribute, providing two distinct injection sinks. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Reflected XSS in PHP Jabbers PHP Poll Script allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a specially crafted URL. The vulnerability affects versions prior to 4.1 and was reported by CERT.pl. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has issued a fix in version 4.1.

Stored XSS in ElementsKit Elementor Addons (WordPress plugin before 3.10.01) allows administrative users to inject malicious JavaScript into megamenu menu-item settings, which is rendered unsanitized to all page visitors. The most critical exploitation path targets WordPress multisite networks: a subsite Administrator - a role WordPress normally bars from injecting raw HTML via the unfiltered_html capability - can bypass this restriction through the plugin's misconfigured save routine, planting a payload that executes in Super Admin and site visitor sessions. A publicly available proof-of-concept exists per WPScan; EPSS is low (0.16%) but SSVC flags total technical impact due to the Super Admin session takeover potential on multisite deployments.

Stored XSS in WP Photo Album Plus (all versions up to 9.2.03.001) allows unauthenticated remote attackers to inject persistent malicious scripts into photo comments by exploiting a decode-after-sanitize flaw in the plugin's comment pipeline. The sanitization sequence in `wppa-functions.php` applies `wp_kses` then `wp_strip_all_tags()` on write, but neither function decodes HTML entities before inspecting markup - a double-encoded payload such as `<script>` passes both filters as harmless text, is stored one entity-decode level down, and renders as executable HTML when a victim's browser processes the page. A public proof-of-concept is available via WPScan; however, the vulnerability is not in CISA KEV and EPSS sits at 0.15% (5th percentile), indicating no observed mass exploitation at time of analysis.

Reflected cross-site scripting in the Ultimate Addons for WPBakery Page Builder WordPress plugin (all versions before 3.21.5) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL processed by the plugin's shared link-rendering function, uavc_link_init(). A publicly available proof-of-concept exploit was reported by WPScan, though EPSS places exploitation probability at just 0.15% (5th percentile), suggesting opportunistic rather than widespread active exploitation. No CISA KEV listing was identified at the time of analysis.

Stored XSS in the NewStatPress WordPress plugin (all versions before 1.4.5) allows unauthenticated remote attackers to inject persistent malicious scripts by supplying crafted HTTP request data that the plugin logs without sanitization and later renders in its statistics widgets. Any authenticated user - including administrators - who views the affected widget triggers the stored payload in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. A public exploit exists via WPScan, though EPSS at 0.17% (7th percentile) indicates exploitation has not yet become widespread.

Stored XSS in the Lightbox with PhotoSwipe WordPress plugin before 5.9.0 allows author-level users (lacking unfiltered_html) to inject arbitrary JavaScript into image lightbox captions via an unsanitized link data attribute. The payload executes in the browser of any visitor or administrator who opens the affected lightbox, enabling session hijacking or privilege escalation against site administrators. A publicly available exploit documents the technique; no active exploitation is confirmed via CISA KEV, though the author-level entry bar is low on sites with multiple contributors.

Reflected cross-site scripting in the FS Inc S3150-8T2F Switch web management interface allows remote unauthenticated attackers to execute arbitrary JavaScript in an authenticated administrator's browser by tricking them into clicking a crafted URL targeting the /logo.asp endpoint. The vulnerability carries a CVSS 6.1 score with changed scope, enabling session hijacking, credential theft, or unauthorized device reconfiguration through the victim's browser session. No public exploit code has been confirmed and EPSS sits at 0.14% (4th percentile), indicating negligible observed exploitation probability at time of analysis.

Reflected XSS in AdonisJS HTTP Server (versions 8.0.0-next.0 through 8.2.0 and 9.0.0 through 9.0.2) enables remote unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious 404 URL containing an embedded HTML payload. The framework's default exception handler interpolates the unescaped request path directly into the HTML error response when debug mode is disabled and no custom error handler is configured. No public exploit has been identified at time of analysis, but the fix commit includes a working proof-of-concept test demonstrating a cookie-exfiltration attack using `fetch('/dashboard',{credentials:'include'})`, confirming practical exploitability.

Cross-site scripting in IBM Engineering Requirements Management DOORS Web Access allows unauthenticated remote attackers to inject arbitrary JavaScript into the Web UI by tricking an authenticated user into interacting with a malicious payload, potentially resulting in credential disclosure within a trusted session. Affected versions span two maintained branches: 9.7.2.1-9.7.2.11 and 9.6.1.1-9.6.1.13. No public exploit code or active exploitation (CISA KEV) has been identified at the time of analysis, and IBM has released a patch via advisory 7279145.

Cross-site scripting in IBM Sterling B2B Integrator and Sterling File Gateway 6.2.2.0-6.2.2.0_1 enables any authenticated low-privilege user to inject persistent JavaScript into the Web UI, which executes within the browser session of other authenticated users who load the affected page. The changed scope (S:C in CVSS) reflects that the injected script runs in the victim's browser context rather than the originating user's, enabling credential harvesting or session token theft within the trusted application session. No public exploit code or CISA KEV listing exists at time of analysis; IBM has issued a patch.

Cross-site scripting in the Ebics server component of IBM Sterling B2B Integrator and IBM Sterling File Gateway allows authenticated low-privileged users to inject arbitrary JavaScript into the Web UI, executing in the browser context of other users within a trusted session. Both products across four version branches (6.1.2.x, 6.2.0.x, 6.2.1.x, and 6.2.2.0) are affected, with the primary risk being credential disclosure or session hijacking of higher-privileged users including administrators. IBM has released a patch; no public exploit code or active exploitation has been identified at time of analysis.

Cross-site scripting in the Administrative Console of IBM Tivoli System Automation Application Manager 4.1 and IBM WebSphere Application Server allows an authenticated low-privileged user to inject malicious JavaScript that executes in the browser of other users who view the affected console page. The CVSS scope change (S:C) confirms the attack crosses security boundaries, enabling impact on sessions belonging to higher-privileged administrators. No active exploitation has been identified; no public POC is known at time of analysis.

Cross-site scripting in Apache JSPWiki's Markdown renderer error-handling path allows attackers with page-editing access to inject JavaScript that executes in victims' browsers, enabling session data theft and sensitive information exfiltration. All Apache JSPWiki releases through 2.12.3 are affected; the Apache Software Foundation has confirmed version 2.12.4 as the fix. No public exploit code has been identified at time of analysis and this CVE has no CISA KEV listing, but the edit-then-victim-view pattern is a well-understood XSS delivery model that requires minimal technical sophistication once editing access is available.

Stored XSS in Essential Addons for Elementor (WordPress plugin) before 6.6.10 allows any Contributor-level or higher user to inject arbitrary JavaScript via an unsanitized HTML tag name in the Pricing Table widget title field. The payload executes in the browser of any user who views the affected page - critically including administrators previewing or visiting the post - enabling session hijacking or privilege escalation to full site control. A publicly available proof-of-concept exists, raising the realistic threat above the CVSS 4.8 medium score.

Stored Cross-Site Scripting in Animation Addons for Elementor WordPress plugin (all versions before 2.7.0) allows authenticated users with the upload_files capability - Author role and above - to upload unsanitized SVG or SVGZ files containing embedded JavaScript. When a victim visits or previews a page rendering the malicious file, the script executes in their browser under the site's origin, potentially enabling session hijacking or privilege escalation to administrator. No active exploitation is confirmed via CISA KEV, but a publicly available proof-of-concept exists and a vendor patch has been released at version 2.7.0.

Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions before 6.2.6) allows a Contributor-level user with delegated form-management permissions to embed a persistent malicious script into a form field configuration setting, which executes against every subsequent visitor - including administrators - who loads any page rendering that form. The vulnerability is especially significant in multisite WordPress environments, where contributors routinely lack the unfiltered_html capability yet may hold form-management delegation rights. A publicly available proof-of-concept exists per WPScan; no active exploitation is confirmed in CISA KEV at time of analysis.

Stored cross-site scripting in the GiveWP WordPress plugin before version 4.16.3 allows authenticated users holding the GiveWP Worker role or above to inject arbitrary JavaScript into donation-form template settings, which then executes in the browsers of any visitor viewing the public donation form. The attack requires existing privileged access within the GiveWP role hierarchy, limiting opportunistic exploitation, though a publicly available proof-of-concept lowers the barrier for targeted abuse. EPSS sits at 0.17% (7th percentile) and the vulnerability has not been added to CISA KEV, suggesting limited observed exploitation in the wild despite POC availability.

Stored cross-site scripting in LifterLMS WordPress plugin versions before 10.0.10 allows authenticated course editors to inject event-handler JavaScript into course pricing fields, which then executes in administrator browser sessions when the course is viewed. A publicly available proof-of-concept from WPScan confirms exploitability. EPSS at 0.17% (7th percentile) indicates low opportunistic exploitation probability, consistent with the authenticated-insider requirement and dependence on manual admin interaction.

Stored cross-site scripting in the WP Real IP-based Access Control WordPress plugin (all versions through 1.3.1) allows unauthenticated remote attackers to inject persistent JavaScript into the plugin's settings page, which executes in the browser of any administrator who subsequently views that page. The root cause is a complete absence of capability checks and nonce validation on the option-storing endpoint, combined with unescaped output rendering on the settings page. A publicly available proof-of-concept exploit exists per WPScan; however, the vulnerability is not currently listed in the CISA KEV catalog and carries a low EPSS score of 0.19% (9th percentile), suggesting no confirmed widespread exploitation at time of analysis.

Script injection in Spring Tools for Eclipse's New Spring Starter Project wizard allows arbitrary JavaScript execution inside the IDE's embedded SWT browser when a developer hovers over dependency checkboxes rendered from a compromised or attacker-controlled Initializr endpoint. Affected are all versions through 5.2.0, per the vendor (VMware/Spring) advisory. Despite the 'RCE' tag in associated intelligence, the vendor explicitly bounds the impact to in-IDE UI spoofing and outbound network beaconing - not host-level code execution. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.

Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.

Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.

Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page that exploits an inappropriate CSS implementation. Because this is a UXSS class vulnerability - not ordinary reflected or stored XSS - exploitation bypasses the browser's same-origin policy entirely, potentially exposing authenticated sessions, cookies, and DOM content from any tab open in the browser. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates low current exploitation probability, though UXSS flaws in dominant browsers remain high-value targets.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 151.0.7922.72 permits remote attackers to inject arbitrary scripts or HTML that execute across same-origin boundaries within the victim's browser session. The CVSS Scope:Changed metric confirms the cross-origin breakout characteristic of UXSS - distinguishing this from ordinary reflected XSS by targeting browser internals rather than a web application. No public exploit has been identified at time of analysis, and an EPSS score of 0.17% (7th percentile) indicates low current exploitation probability; vendor patch is confirmed available at 151.0.7922.72.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component allows remote attackers to inject arbitrary scripts or HTML across same-origin policy boundaries via a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Unlike application-level XSS, UXSS exploits a flaw in the browser engine itself, enabling cross-origin script execution that bypasses website-level security controls. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), but the confirmed scope change (S:C in CVSS) signals genuine cross-origin impact potential.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation enables a remote attacker to inject arbitrary scripts or HTML across origin boundaries by directing a victim to a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected. No public exploit has been identified at time of analysis and CISA SSVC rates exploitation as none, but the cross-origin scope change makes this meaningfully more impactful than a standard reflected XSS, warranting timely patching given Chrome's ubiquitous deployment footprint.

Insufficient policy enforcement in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables Universal Cross-Site Scripting (UXSS), allowing an attacker who socially engineers a user into installing a malicious extension to inject arbitrary scripts or HTML across web origins. CVSS scores this at 4.2 (Medium) with high attack complexity reflecting the required social engineering; EPSS is negligible at 0.13% (3rd percentile). No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, suggesting it has not seen widespread or automated exploitation.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 allows a remote unauthenticated attacker to inject arbitrary scripts or HTML that can escape the browser's same-origin policy by delivering a crafted HTML page to an unsuspecting victim. All Chrome installations below 151.0.7922.72 across supported platforms are affected, with partial confidentiality and integrity impact. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' confirm low current exploitation probability, though UXSS primitives carry disproportionate value for credential and session theft.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Extensions subsystem, affecting all versions prior to 151.0.7922.72, allows a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by luring a user to a crafted HTML page. The inappropriate implementation in the Extensions component bypasses Chrome's normal script isolation boundaries, potentially enabling cross-origin script execution characteristic of UXSS class flaws. Vendor-confirmed fix is available in Chrome 151.0.7922.72; EPSS of 0.20% (11th percentile) and absence of KEV listing indicate limited active exploitation at time of analysis.

Reflected Cross-Site Scripting in code-projects Blood System 1.0 allows unauthenticated remote attackers to inject and execute malicious JavaScript in victims' browsers via the unsanitized city parameter in /don.php. The CVSS Changed scope (S:C) confirms the script executes outside the vulnerable application's origin, enabling session hijacking, credential theft, or malicious redirection against authenticated users who can be socially engineered into following a crafted link. No public exploit or CISA KEV listing exists; EPSS at 0.14% (4th percentile) reflects extremely low exploitation interest, consistent with this product's negligible production footprint.

DOM-based Cross-Site Scripting in CleverTap Web SDK v1.15.1 allows an attacker to execute arbitrary JavaScript in a victim's browser by sending a crafted message via the window.postMessage API. The SDK's renderCustomHtml function processes postMessage payloads without sanitization before injecting them into the page DOM, enabling script injection in the context of any hosting site that integrates this SDK. No public exploit confirmed at time of analysis; EPSS is very low (0.16%, 6th percentile), and this vulnerability is not listed in the CISA KEV catalog.

Reflected cross-site scripting in Ecommerce Fruits Bazar 1.0 allows a remote unauthenticated attacker to inject malicious JavaScript into the admin panel via the admin/edit_product.php endpoint, with execution occurring in the context of an authenticated administrator's browser session. The scope-changed CVSS vector (S:C) confirms the payload escapes the server's security context into the victim browser, enabling session hijacking or credential theft against administrative users. A proof-of-concept exists in the TaintRadar vulnerability research repository; EPSS is 0.14% (4th percentile), indicating no widespread automated exploitation observed to date.

Reflected cross-site scripting in GitLab CE/EE across a vast version range (14.0 through pre-patch releases) enables an unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by enticing them to open a crafted URL. The CVSS vector confirms no authentication is required on the attacker side (PR:N), user interaction is needed (UI:R), and the scope changes (S:C) - meaning the injected script runs outside the originating page's trust boundary, enabling session hijacking, credential theft, or actions performed on the victim's behalf. A publicly available exploit exists on HackerOne (report #3539833), raising the practical risk above what the moderate CVSS score of 4.7 alone suggests.

Cross-site scripting in MathLive (npm/mathlive <= 0.109.2) allows arbitrary JavaScript execution when applications render untrusted LaTeX containing \text{} or \mbox{} commands. The vulnerability bypassed a prior partial fix in version 0.104.0 that addressed attribute-bearing constructs but left text-content reflection in both the HTML (Box.toMarkup) and MathML (atom-to-math-ml.ts) rendering paths unescaped, with both outputs flowing into innerHTML sinks. A publicly available proof-of-concept exploit is documented in the GitHub advisory; no active exploitation has been confirmed in CISA KEV at time of analysis.

Stored cross-site scripting in the Gridbox Joomla extension by balbooa.com allows attackers to inject persistent malicious scripts via the comment avatar field, affecting all releases from version 1.0.0 through 2.20.1. The payload is stored server-side and executes in the browsers of all subsequent visitors who load the affected page, with scope change enabling cross-origin impact such as session theft or UI manipulation. No public exploit code or active exploitation has been identified at time of analysis; the vendor released version 2.20.2 as the corrective fix.

Cross-site scripting vulnerabilities in RO CSVI's AJAX endpoint handlers allow unauthenticated remote attackers to inject malicious scripts into the browsers of Joomla site users. All versions from 1.0.0 up to (but not including) 9.11.0 are affected. No public exploit code or active exploitation has been identified at time of analysis, though the CVSS scope-changed vector (S:C) and absence of authentication requirement make this an accessible attack for opportunistic threat actors targeting Joomla deployments running the extension.

Stored XSS in the Booking System Trafft WordPress plugin (versions up to and including 1.0.17) allows authenticated attackers holding Subscriber-level access to permanently replace the plugin's embed-script origin with an attacker-controlled URL, causing arbitrary JavaScript to execute in every site visitor's browser on any page rendering the booking shortcode. The root cause is a missing capability check on the `set_options` AJAX handler - the plugin relies solely on a nonce that is printed inline on every WordPress admin page (including profile.php), making it reachable by any logged-in user when the plugin operates in agency mode. No public exploit has been identified at time of analysis, but the persistent site-wide impact - including against administrators - elevates real-world risk significantly beyond what the 6.4 CVSS base score alone conveys.

Stored Cross-Site Scripting in the WPC Badge Management for WooCommerce WordPress plugin (all versions through 3.1.6) allows authenticated attackers with Contributor-level access to inject persistent JavaScript via the 'text' attribute of the wpcbm_best_seller shortcode. The injected payload executes silently in the browser of any visitor who loads an affected page, with scope change indicated by the CVSS S:C metric. No public exploit or CISA KEV listing is identified at time of analysis.

Cross-site scripting in the Link Library WordPress plugin (versions before 7.9.4) allows unauthenticated network-based attackers to inject malicious JavaScript that executes in the context of other users' browsers. The CVSS 4.0 vector assigns High subsequent-system impacts (SC:H/SI:H/SA:H), indicating exploitation could compromise visiting administrators and cascade to full WordPress site control. No public exploit code or CISA KEV listing has been identified at time of analysis, though Tenable reported the finding (TRA-2026-52) and a patched release (7.9.4) is available.

Stored cross-site scripting in the PhotoSwipe WordPress plugin (all versions through 4.1.1.1) allows an authenticated Author-level user to plant a persistent JavaScript payload inside a link's title attribute, which the plugin writes unescaped into the page DOM as a lightbox caption. Any visitor - including site administrators - who clicks the link triggers payload execution in their browser, enabling session hijacking and full WordPress takeover. A publicly available proof-of-concept exists; no patched release has been identified at time of analysis.

Stored Cross-Site Scripting in WowStore (all versions ≤ 4.4.24) permits authenticated contributors to plant arbitrary JavaScript into WordPress pages via the unsanitized 'currentPostId' block attribute in the Filter block, which then executes silently in the browser of any subsequent visitor - including administrators. The CVSS 6.4 score reflects Changed scope, meaning low-privilege attackers can impact higher-privilege users. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile) with SSVC confirming no active exploitation, placing this in a prioritize-but-not-emergency tier.

Stored cross-site scripting in the WowStore WordPress plugin up to v4.4.24 allows authenticated attackers with contributor-level access to inject arbitrary web scripts via the 'filterMobileText' block attribute. The payload is stored inside a Gutenberg block delimiter JSON comment, bypassing wp_kses_post sanitization and executing when any user visits the affected page. No public exploit or active exploitation (KEV) identified at time of analysis; CVSS 6.4 (Medium) with EPSS risk unknown.

Stored Cross-Site Scripting in the Contact Form to Any API WordPress plugin (versions ≤ 3.0.6) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via the cf7anyapi_form_field post meta field. Any user who subsequently loads a page containing the injected content will silently execute the attacker's script within their browser session, potentially exposing session tokens or enabling unauthorized actions. No active exploitation is confirmed - CISA KEV status is absent, EPSS sits at the 9th percentile (0.19%), and SSVC classifies exploitation as 'none' - indicating this is a low-urgency but real risk for multi-author WordPress deployments.

Stored Cross-Site Scripting in Newsletters Lite WordPress plugin versions ≤4.15 permits authenticated attackers with contributor-level access to inject arbitrary web scripts by abusing the 'link' attribute of the post_thumbnail and newsletters_post_thumbnail shortcodes. When a privileged user accesses a page containing the injected shortcode, the script executes in their session, potentially leading to session hijacking or credential theft. No active exploitation or public proof-of-concept is identified at time of analysis.

Stored cross-site scripting in Newsletters Lite WordPress plugin allows authenticated attackers with Contributor-level access or above to inject arbitrary scripts via the 'target' attribute of the [newsletters_post] shortcode. This affects versions up to 4.15 and can lead to script execution when other users view affected posts. No public exploit identified at time of analysis.

Reflected or stored cross-site scripting in Sourcecodester Fantastic Blog CMS 1.0 allows network-accessible attackers to inject malicious scripts via the address field in pageEditMember.php, executing arbitrary JavaScript in a victim's browser session. The Changed scope (S:C) in the CVSS vector confirms the injected script escapes the page context and can affect the victim's broader browser environment, enabling session hijacking or credential theft. EPSS stands at 0.14% (4th percentile), and no CISA KEV listing exists, though exploit documentation is publicly available via the TaintRadar research repository on GitHub.

Cross-site scripting in IBM WebSphere Application Server traditional 8.5 and 9.0 allows remote attackers to inject arbitrary JavaScript or HTML via reflected input. A crafted link clicked by an authenticated user can execute scripts in the victim's browser, leading to session hijacking or credential theft. No active exploitation or public exploit code is currently known, and a vendor patch is available.

Stored cross-site scripting in IBM Sterling B2B Integrator and File Gateway allows privileged users to inject arbitrary JavaScript into the Web UI, altering intended functionality and potentially leading to credential disclosure within trusted sessions. No public exploit identified at time of analysis.

Cross-site scripting in Pivotick's inspect and edit node modals allows attackers who can inject malicious node labels or descriptions into graph data to execute arbitrary JavaScript when a victim opens the affected modal. This can lead to theft of session cookies, sensitive information exposure, or unauthorized actions on behalf of the victim. The fix, available in a GitHub commit, switches from unsafe HTML interpolation to safe textContent assignment.

Reflected cross-site scripting (XSS) in the Joomdle Joomla extension before version 3.1.1 allows remote attackers to inject arbitrary web scripts via the 'goto' URL parameter of the Moodle wrapper endpoint. When a victim clicks a crafted link, the attacker can execute script in the victim's browser, potentially stealing session cookies or performing actions on behalf of the user. The vulnerability requires user interaction and has no publicly known exploit code or active exploitation at this time.

Stored Cross-Site Scripting in the Cozy Blocks plugin for WordPress allows authenticated attackers with contributor-level access to inject arbitrary scripts via the 'postMeta.font.size' block attribute. The script executes whenever a user views an infected page, potentially leading to session hijacking, defacement, or phishing. Versions up to and including 2.2.11 are affected; no active exploitation or public exploit has been reported.

Stored cross-site scripting in the Paid Memberships Pro WordPress plugin allows authenticated attackers with subscriber-level access to inject arbitrary web scripts via the readonly user field rendered by the [pmpro_member_profile_edit] shortcode. The vulnerability affects all plugin versions up to and including 3.8.1. Upon successful exploitation, injected scripts execute when any user accesses a page containing the malicious payload, potentially leading to session hijacking or other browser-based attacks.

Stored cross-site scripting in Pivotick’s Markdown node-reference renderer allows JavaScript execution when a victim opens a crafted graph or note. The root cause is missing HTML escaping of attacker-controlled node names before interpolation into HTML attributes and element bodies. A patch is available from the vendor; no public exploit or active exploitation has been reported.

Stored Cross-Site Scripting in the Shortcodify WordPress plugin up to version 1.4.3 enables authenticated contributors to inject arbitrary JavaScript via the 'name' shortcode attribute. No known active exploitation or public POC exists at time of analysis, but the low privilege requirement and typical impact of stored XSS make this a moderate priority for sites using the plugin.

Reflected cross-site scripting in the News Theme V8 WordPress theme by THEWP Digital Solutions up to version 16.06.2026 allows unauthenticated remote attackers to inject and execute arbitrary web script in a victim's browser. A user clicking a maliciously crafted link can lead to session hijacking, content spoofing, or redirection to harmful sites. No active exploitation or public exploit code has been identified.

Reflected cross-site scripting in the WebUI of ELECOM wireless LAN routers and access points allows an attacker on the adjacent network to execute arbitrary scripts in the browser of a logged-in user, potentially leading to session hijacking or unauthorized admin actions. The vulnerability is reachable via crafted links and requires user interaction. No known public exploit code or active exploitation reported.

Stored cross‑site scripting in the GamiPress WordPress plugin (≤ 7.9.9.1) allows authenticated attackers with contributor‑level access to inject JavaScript via the heading_size shortcode attribute. The wp_kses_post sanitizer applied at save‑time does not neutralize the payload because the malicious HTML is generated dynamically by the shortcode handler during page rendering, bypassing all input filtering. No active exploitation or public exploit code has been identified at the time of analysis.

Stored cross-site scripting in the Event Tickets and Registration WordPress plugin before 5.28.4 enables Editors and above to inject malicious scripts in event titles, which execute against higher-privileged users on multisite setups when they view the ticket history log. The vulnerability has a low CVSS of 3.5 and a low EPSS of 0.15%, but exploit code is publicly available. A patch in version 5.28.4 is available from the vendor.

Cross-site scripting in nice-select2 before 2.4.1 allows attackers to inject arbitrary scripts via malicious <select> element content that is rendered unsanitized into the DOM. Vulnerable if the application reflects user-controlled data into a <select> element that is transformed by nice-select2. User interaction required; no public exploit or active exploitation known.

Cross-site scripting (XSS) in the AcyChecker WordPress plugin allows attackers with low-privileged access (e.g., subscriber) to inject malicious scripts into admin pages. No public exploit code or active exploitation has been reported, and the absence of KEV and EPSS data suggests low current risk.

Cross-site scripting (XSS) in Pivotick's sidebar property-list component allows an attacker to execute JavaScript in a victim's browser session by injecting a malicious URI (e.g., javascript:) into node or edge property values. Affects all versions prior to the patch. No public exploit or active exploitation has been reported, and EPSS data is not available.

Stored cross-site scripting in Ekushey CRM through version 5.0 allows authenticated client users to inject arbitrary HTML and JavaScript via the Ticket Title field on the Create New Ticket page. The payload executes in the browser of any staff or administrator

Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject arbitrary HTML and JavaScript via the client Name field on the Edit Profile page, which is not sanitized. When staff or administrators view the Manage Clients or Manage Client Projects pages, the malicious scripts execute in their browser sessions. A proof-of-concept exploit is publicly available, though no active exploitation has been confirmed in CISA KEV.

Stored cross-site scripting in Ekushey Project Manager CRM through version 5.0 allows authenticated client users to inject JavaScript via the Reply Ticket field, which executes when staff or administrators view the support ticket detail page. A public proof-of-concept is available, but no active exploitation has been reported. The flaw can expose privileged users to session theft or credential phishing.

Cross-site scripting (XSS) in Apache Wicket versions 9.0.0-9.23.0 and 10.0.0-10.9.0 allows attackers to inject client-side scripts into pages rendered by the affected application, potentially compromising user sessions or redirecting victims. The vulnerability arises from insufficient neutralization of user input during HTML generation, enabling script injection via crafted URLs or form submissions. No public exploit is known, but upgrading to version 10.10.0 eliminates the issue.

Stored cross-site scripting (XSS) in the WooCommerce Checkout Manager plugin allows authenticated shop managers to inject arbitrary JavaScript into checkout field settings. When another administrator views the affected configuration, the malicious script executes in their browser session, potentially leading to session hijacking or unauthorized actions. No active exploitation has been reported, and the vulnerability is not listed as known exploited by CISA.

Cross-site scripting (XSS) in the Gallery Photoblocks WordPress plugin through version 1.3.3 allows authenticated contributors to inject web scripts. An attacker with contributor-level access can craft a malicious input that executes in the browser of a victim who views the affected gallery page. No active exploitation or public exploit code has been reported at this time.

Stored cross-site scripting (XSS) in Open User Map WordPress plugin versions up to 1.4.46 allows authenticated contributor-level users to inject arbitrary JavaScript into map marker content, which executes when other users view the affected map. No active exploitation has been reported (SSVC: exploitation none), and no public exploit code is identified.

Stored cross-site scripting in the Photonic Gallery & Lightbox plugin for WordPress allows authenticated attackers with Contributor-level privileges to inject arbitrary web scripts. When an administrator or other higher-privilege user views a crafted gallery or album configuration, the malicious script executes in their browser, potentially leading to session hijacking or account takeover. This affects all versions up to and including 3.33.

Stored cross-site scripting in the Location Weather WordPress plugin (≤ 3.0.6) allows authenticated users with contributor-level privileges to inject arbitrary JavaScript. When a higher-privileged user (such as an administrator) views the malicious content, the script executes in that user’s browser, potentially leading to session hijacking, site defacement, or other client-side attacks. No active exploitation or public proof-of-concept is reported, and the EPSS probability is not available.

Stored cross-site scripting (XSS) in Orbit Fox by ThemeIsle versions 3.0.7 and below allows authenticated administrators to inject malicious scripts that execute when another administrator views the affected plugin content. This vulnerability requires high privileges and user interaction; no public exploit has been identified.

Stored Cross-Site Scripting (XSS) in the BetterDocs WordPress plugin version 4.6.2 and earlier allows authenticated users with Contributor-level access to inject arbitrary web scripts. When an administrator views the crafted content, the script executes in their session, potentially leading to session hijacking or content manipulation. No active exploitation has been publicly reported.

Cross-site scripting (XSS) in WordPress Social Login and Register plugin version 7.8.0 and earlier allows contributor-level attackers to inject arbitrary scripts. An administrator visiting a compromised page could have their session hijacked or be redirected to malicious sites, leading to data exposure or further compromise. No public exploit or active exploitation is confirmed at this time.

Cross-site scripting (XSS) in Abandoned Cart Lite for WooCommerce allows authenticated shop managers with high privileges to inject malicious scripts, potentially leading to account takeover or data theft when an administrator views crafted content. No public exploit identified at time of analysis.

Cross-site scripting in RT Mega Menu <=1.5.1 allows authenticated attackers with subscriber-level access to inject malicious JavaScript into menu items. The injected script executes in the context of any user visiting a page with the corrupted mega menu, enabling session token theft, site defacement, or redirection. No active exploitation or public exploit code is currently confirmed.

Stored cross-site scripting in TastyIgniter's Media Manager allows low-privileged authenticated users to execute arbitrary JavaScript when an administrator views a malicious SVG file. Chaining with CSRF enables an attacker to steal the admin's CSRF token and take full control of the administrative account. No public exploit or active exploitation has been identified; EPSS is low (0.23%), and the vulnerability is rated CVSS 6.3 in CVSS 4.0.

Reflected cross-site scripting (XSS) in the Phoca Commander extension for Joomla (versions 5.0.0 through 6.1.1) allows remote attackers to inject arbitrary JavaScript into a victim's browser via a crafted URL that reflects unvalidated input. Exploitation requires the victim to click a malicious link (UI:R), and while no authentication is needed to deliver the payload, the impact is limited to the victim's session context, yielding Low confidentiality and integrity impact. No public exploit code or active exploitation has been identified at time of analysis, and EPSS is low at 0.32% (24th percentile), indicating a moderate-to-low priority issue.

Stored cross-site scripting (XSS) in the Calendar WordPress plugin prior to version 1.3.18 allows authenticated users with Contributor-level access to inject arbitrary JavaScript into an event field. The script executes in the browsers of any user viewing the calendar page, potentially leading to session hijacking or privilege escalation. A public exploit is available, increasing the immediate risk despite the privilege requirement.

Stored cross-site scripting in Smart Manager for WordPress before version 8.92.0 enables authenticated attackers with at least Contributor role to inject JavaScript that executes in an administrator's browser via the management grid. A publicly available proof-of-concept exists, though no active exploitation is confirmed. The vendor has released patched version 8.92.0.

Reflected XSS in the Sina Extension for Elementor WordPress plugin allows unauthenticated attackers to execute arbitrary JavaScript in victims' browsers. The vulnerability exists in an unauthenticated AJAX handler that fails to escape user input before reflecting it. Public exploit code is available, and the vendor has released a patch in version 3.10.2.

Stored Cross-Site Scripting in Simply Schedule Appointments up to 1.6.12.2 allows unauthenticated attackers to inject arbitrary web scripts. A double‑encoding fault causes payloads to bypass the plugin’s wp_kses_post() sanitizer and then execute when an administrator views appointment notifications. The vulnerability is fixed in version 1.6.12.4; a public proof‑of‑concept exists but no active exploitation has been confirmed.

Reflected cross-site scripting (XSS) in the WordPress Document Gallery plugin before version 5.1.1 allows unauthenticated attackers to inject malicious scripts via an unsanitized parameter in an AJAX action. A publicly available proof-of-concept exploit exists, increasing the immediate risk for sites running affected versions.

Stored cross-site scripting in the Advanced Ads WordPress plugin versions before 2.0.23 allows authenticated users with Contributor role or higher to inject arbitrary web scripts via an unsanitized shortcode parameter. An attacker can leverage this to execute JavaScript in the browser of anyone viewing the affected page, potentially hijacking sessions or escalating privileges when administrators visit the content. A public proof-of-concept exists, but no active exploitation is confirmed.

Cross-site scripting in Milk Admin versions up to 0.9.8 enables remote attackers to inject arbitrary web scripts or HTML via the action parameter of the Docs module. A public proof-of-concept exploit is available, though active exploitation has not been reported. The vulnerability requires user interaction and could lead to session hijacking or other browser-based attacks.

Stored Cross-Site Scripting in the Yoast SEO WordPress plugin (all versions through 28.0) allows authenticated attackers holding author-level accounts or higher to inject persistent JavaScript via a crafted post slug (post_name field) that executes in the browsers of any user who later visits the affected page. The vulnerability traces to insufficient sanitization in the bulk-editor list table (class-bulk-editor-list-table.php, lines 898-900) combined with get_permalink() embedding the stored percent-encoded post_name in generated URLs without adequate escaping. No confirmed active exploitation (no CISA KEV listing) and no public exploit code has been identified at time of analysis, though the scope-changed CVSS vector (S:C) reflects cross-user browser impact consistent with a medium-priority persistent XSS.

Reflected XSS in OpenAM's OAuth2/OIDC consent page allows attackers to execute arbitrary JavaScript in the victim's authenticated session, enabling session theft and administrative takeover. Affects OpenAM versions 13.0.0 through 16.1.1. No active exploitation confirmed, but the attack vector is straightforward and publicly documented.