Cross-Site Scripting

Path traversal in Cloudreve's WOPI PUT_RELATIVE handler permits authenticated attackers with a WOPI access token to write files to arbitrary locations within the same user account, bypassing the token's single-file scope. A crafted X-WOPI-SuggestedTarget header with directory traversal sequences (e.g., a/../../evil.docx) resolves outside the source

DOM-based cross-site scripting in Milkdown's @milkdown/plugin-emoji before version 7.21.3 allows unauthenticated attackers to execute arbitrary JavaScript in the origin of applications embedding Milkdown when a victim pastes attacker-controlled content. The flaw stems from unsanitized innerHTML stored during HTML-to-markdown parsing and later assigned directly to a live DOM element, bypassing DOMPurify sanitization in the rendering path. No active exploitation or public exploit is known, and the EPSS score is low (0.25%).

Stored cross-site scripting in Milkdown before version 7.21.3 allows an attacker with document write access to inject JavaScript via malicious Markdown links. The parseMarkdown runner fails to validate URL schemes, and ineffective DOMPurify sanitization causes javascript: payloads to reach anchor elements in read‑only mode and link‑tooltip previews. When any user opens the document or interacts with the rendered link, arbitrary JavaScript executes in their browser.

Reflected cross-site scripting in Polen Media Website Template before v2 allows unauthenticated remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction such as clicking a crafted link. EPSS score of 0.15% indicates very low exploitation probability, and no active exploitation or public exploit code has been identified.

DOMPurify before 3.4.12 fails to invoke the afterSanitizeElements hook for custom elements permitted via CUSTOM_ELEMENT_HANDLING.tagNameCheck, enabling attackers to retain

Reflected cross-site scripting in VikBooking Hotel Booking Engine & PMS plugin for WordPress versions up to 1.8.13 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser via a crafted link containing malicious code in the 'category_id' parameter. Exploitation requires user interaction and is limited to browsers that support access keys because the injection point is within a hidden element's accesskey attribute. EPSS indicates low exploitation probability (0.26%), and no active exploitation or public exploit code has been identified.

Stored cross-site scripting in the Rich Showcase for Google Reviews WordPress plugin allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the 'pagination' Shortcode Attribute. When a user accesses an injected page, the malicious scripts execute in their browser. No public exploit code has been identified, and exploitation is not confirmed in the wild.

Stored Cross-Site Scripting in SureDash WordPress plugin versions up to 1.10.0 allows authenticated attackers with contributor-level access or higher to inject malicious scripts via shortcode attributes, which execute when any user views the affected page. The vulnerability has a low EPSS score (0.20%) and no reports of active exploitation, though the attack requires only low privileges and no victim interaction beyond normal page viewing.

Stored XSS in the WP Hotel Booking WordPress plugin (all versions through 2.3.2) allows authenticated contributors to inject persistent JavaScript via the 'widget_search' shortcode attribute, exploiting insufficient sanitization before rendering in page templates. The payload is stored in a hidden HTML attribute and executes in a victim's browser when they access the injected page, though exploitation is constrained to browsers where access key interactions can trigger hidden-attribute payloads. No public exploit code has been identified and this CVE is not listed in CISA KEV; real-world risk is lower than the CVSS 6.4 suggests due to the browser-specific prerequisite.

Stored Cross-Site Scripting in the Visualizer - Tables & Charts Manager with Built-in AI Generator WordPress plugin (all versions through 4.0.5) enables persistent script injection via the 'backend-title' parameter due to missing input sanitization and output escaping. Any WordPress user holding contributor-level access or higher can plant malicious JavaScript that executes in the browser of any site visitor - including administrators - who loads a page containing the injected content. No active exploitation has been confirmed (not listed in CISA KEV), but the low access barrier and scope-changed impact (S:C) make this a meaningful risk on multi-author WordPress installations.

Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions up to and including 3.8.8) allows authenticated attackers holding contributor-level access or higher to inject persistent malicious scripts via an unsanitized 'width' shortcode attribute in the Divi Builder integration. The payload executes in the browser of any user who subsequently visits an injected page, with scope change confirmed by CVSS S:C. No public exploit code or CISA KEV listing was identified at time of analysis.

Stored Cross-Site Scripting in Cozy Blocks (WordPress plugin, versions ≤ 2.2.11) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'icon.view' block attribute in the Advanced Categories block. Once injected, the payload executes in the browsers of any user who loads an affected page, enabling session hijacking, credential theft, or further attacks against site visitors. No public exploit code has been identified at time of analysis, and the CVSS scope change (S:C) reflects that the impact crosses from the WordPress application into victim browser sessions.

Stored Cross-Site Scripting in the Open User Map - Interactive Leaflet Maps WordPress plugin (all versions through 1.4.45) allows authenticated attackers at contributor level to inject persistent malicious scripts via unsanitized shortcode attributes. Critically, the payload does not require the attacker's post to be published - submitting a draft for pending review is sufficient, because the script executes when an Administrator opens the pending-review preview in normal editorial workflow. No public exploit or CISA KEV listing has been identified at time of analysis, and a source-level patch changeset (3618639) is present in the WordPress plugin repository.

Stored Cross-Site Scripting in the Cozy Blocks WordPress plugin (versions up to and including 2.2.11) allows authenticated contributors to inject persistent JavaScript payloads via the `cozyCustomFont` block attribute, which executes in every visitor's browser upon page load. Reported by Wordfence with direct source-code references confirming the vulnerable output locations across multiple lines in `includes/functions.php`, the flaw affects a scope-changed attack surface: the injecting user targets other users' browser sessions rather than the WordPress server itself. No public exploit code has been identified at time of analysis, and no confirmed patched release is apparent from available references.

Stored Cross-Site Scripting in the Fluent Support WordPress plugin (all versions through 2.3.0) allows authenticated contributors to inject persistent JavaScript via the 'redirect-to' shortcode attribute due to missing input sanitization and output escaping in AuthHandler.php. The injected payload executes in the browser context of any user who subsequently visits the affected page, enabling session hijacking, credential theft, or administrative action forgery. Practical exploitation is significantly constrained: the payload resides in a hidden HTML attribute and only triggers in certain browsers when the victim activates specific keyboard access keys, making mass exploitation unlikely despite the network-accessible attack path. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in the MapSVG plugin for WordPress (versions up to and including 8.14.0) allows contributor-level authenticated attackers to permanently inject arbitrary JavaScript via unsanitized map option attributes. The injected payload persists in the database and executes in any visitor's browser upon accessing an affected page, resulting in a scope change where the attacker's code runs in the context of higher-privileged users such as administrators. No public exploit identified at time of analysis, but contributor-level access is commonly obtainable on sites allowing open registration.

Stored DOM Cross-Site Scripting in the Firelight Lightbox WordPress plugin (distributed as 'easy-fancybox') versions through 2.3.20 enables authenticated contributors to permanently embed arbitrary JavaScript into any WordPress page containing a PDF lightbox link. The flaw traces to FancyBox V2's beforeLoad callback in inc/fancybox-2.php, where this.href is concatenated into an HTML string without escaping, allowing entity-encoded double-quotes in a stored href to break out of the surrounding data attribute and attach arbitrary event handlers. CVSS scope-change scoring (S:C) reflects that successful exploitation compromises visiting users' browser sessions rather than the WordPress application itself, though the provided UI:N metric conflicts with the description's click-to-trigger requirement - a discrepancy that bears verification with Wordfence.

Stored Cross-Site Scripting in the PostX WordPress plugin (all versions through 5.0.32) allows authenticated contributors to inject arbitrary JavaScript via the 'searchnoresult' block attribute of the Advanced Search Gutenberg block. The payload executes in the browser session of any Editor or Administrator who previews the affected draft or pending post, enabling a low-privileged contributor to escalate effective access to admin-level capabilities. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the precise vulnerable source lines are publicly disclosed via Wordfence and WordPress plugin repository references.

Stored/reflected cross-site scripting in Progress MOVEit Transfer (versions before 2025.1.5, and the 2026 branch from 2026.0.0 before 2026.0.3) allows an authenticated low-privilege user to inject script that executes in another user's browser session when the victim views the crafted content. Because MOVEit Transfer is an internet-facing managed file transfer platform, successful exploitation can hijack privileged sessions and manipulate transferred data. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Open redirect in React Router's `resolvePath` utility allows attackers to craft navigation URLs using protocol-relative paths (`//external.com`) or colon-containing relative paths that the library fails to normalize, resulting in external redirects or XSS execution in the victim's browser. Affected packages are `react-router` (npm) 7.9.6-7.12.0 and `react-router-dom` (npm) 6.30.2-6.30.4; only `react-router` has a confirmed fix (7.13.0). No public exploit code and no CISA KEV listing have been identified at time of analysis, though the CVSS scope-change and high confidentiality impact reflect cross-origin session theft potential via XSS.

Cross-site scripting in React Router's unstable RSC (React Server Components) error handling path allows network-based attackers to execute arbitrary JavaScript in a victim's browser via attacker-controlled redirect targets. Affected are React Router npm versions 7.11.0 through 7.17.x when the unstable RSC APIs are explicitly enabled; the vulnerability arises because the RSCErrorHandler component failed to validate the protocol of redirect URLs before assigning them to window.location.href or injecting them into a meta http-equiv='refresh' tag. This is a follow-up to GHSA-8646-j5j9-6r62, indicating the prior fix left a residual code path unvalidated. No public exploit code or CISA KEV listing is identified at time of analysis.

Reflected XSS in the Phoca Guestbook Joomla extension (versions 1.0.0 through 6.1.0) allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser via crafted, unsanitized URL parameters or form inputs reflected back by the extension without proper encoding. Exploitation requires the victim to click a specially crafted link (UI:A per CVSS 4.0), making phishing or social engineering the primary delivery mechanism. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Reflected XSS in Phoca Maps 1.0.0 through 6.0.9, a Joomla mapping extension by phoca.cz, allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL containing unsanitized input. The vulnerability stems from improper validation of user-supplied input that is reflected back into the HTTP response without adequate output encoding (CWE-79). No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects moderate impact limited by the mandatory active user interaction requirement.

Stored cross-site scripting in Fathom Lite through 1.3.1 permits unauthenticated attackers to poison the operator's Top Pages dashboard by submitting a crafted javascript: URI to the public /collect analytics endpoint, ultimately enabling session hijacking and full account takeover. The parseHostname and parsePathname functions perform no URI scheme validation, so a javascript: hostname combined with a newline-prefixed pathname is stored verbatim and later rendered as an unsanitized anchor href in the authenticated dashboard. A publicly available exploit demonstrates the full attack chain; while no CISA KEV listing is present, the zero-authentication injection barrier and realistic operator-click trigger make real-world impact materially higher than the CVSS 4.0 score of 5.1 suggests.

Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated users to inject arbitrary web script via the scheduled report name field in the MailInsights module. The injected payload is persisted by the server-side handler ReportScheduling.btnSaveReport_Click() without output encoding and fires only in the browser of the user who created the report, making this effectively a self-XSS - significantly constraining real-world impact unless the stored report name is also rendered in other authenticated users' sessions. No public exploit code or active exploitation confirmed by CISA KEV has been identified at time of analysis.

Stored cross-site scripting in GFI Archiver before version 15.13 enables authenticated attackers to persist arbitrary JavaScript in the Archive Assistant default import settings by injecting through the configured folders parameter at /Archiver/ImportSettingsWizard.ashx. The payload survives server-side because SaveAllConfigSettings() writes it to storage without output encoding, then executes in the browser of any subsequent user who views the import settings page - including potentially higher-privileged administrators. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects the authenticated entry requirement and the downstream scope change to other users' browser sessions.

Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated network-accessible users to inject persistent JavaScript into the File Archive Assistant configuration page via the excluded extensions parameter. The payload is stored server-side by `FileArchiveAssistantWizard.btnSave_Click()` without output encoding and executes in the browser of any user who subsequently views the File Archive Assistant settings page - typically an administrator. No public exploit identified at time of analysis and no CISA KEV listing; real-world impact is limited to browser-session-level attacks against users who access the specific settings page.

Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privileged users to inject persistent JavaScript into the SMTP server address field of the General Settings wizard, which subsequently executes in the browsers of any user who views that settings page. The flaw resides in the server-side method GeneralSettingsWizard.SaveAllConfigSettings(), which persists the SMTP address parameter without output encoding, enabling payload storage and deferred execution. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the low attack complexity and the likelihood that administrators frequently access General Settings elevates practical risk beyond the moderate CVSS 4.0 score of 5.1.

Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated attackers to inject persistent malicious scripts via the proxy server address field in the Call Home configuration wizard. The `CallHomeSettingsWizard.SaveAllConfigSettings()` method stores the attacker-supplied input without output encoding, and the payload subsequently executes in the browsers of any user who visits the General Settings Additional Settings page - including administrators, whose sessions could be harvested. No public exploit or CISA KEV listing is identified at time of analysis, but the stored nature of the XSS elevates impact beyond a reflected variant by enabling broad victim targeting post-injection.

Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to persistently inject arbitrary JavaScript or HTML via the server URL parameter on the IMAP Server configuration wizard at /Archiver/ImapServerWizard.aspx. The payload is written to persistent storage by ImapServerWizard.SaveAllConfigSettings() without output encoding, and executes in the browser of any user - typically an administrator - who subsequently navigates to the IMAP Server configuration page. No public exploit identified at time of analysis and this vulnerability is not listed in CISA KEV.

Stored cross-site scripting in GFI Archiver's web administration interface allows low-privileged authenticated users to inject persistent JavaScript payloads via the policy name field of the File History Retention Policy wizard. The injected payload is written to storage by `RetentionPolicyWizard.SaveAllConfigSettings()` without output encoding and subsequently executes in the browser of any user — including higher-privileged administrators — who views the File History Retention Policies page. No public exploit or active exploitation has been identified; the CVSS 4.0 score of 5.1 reflects the passive user-interaction dependency that limits immediate attacker control.

Stored cross-site scripting in GFI Archiver before version 15.13 allows authenticated low-privilege users to inject arbitrary script via the Retention Policy name field at /Archiver/RetentionPolicyWizard.aspx, with the payload persisting through SaveAllConfigSettings() and executing against any user who subsequently views the Retention and Spam Policies page. The CVSS 4.0 score of 5.1 reflects network-accessible reach offset by required authentication and passive victim interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, suggesting this has not yet seen active widespread exploitation.

Stored cross-site scripting in GFI Archiver before 15.13 allows authenticated low-privileged attackers to inject persistent malicious scripts via the Classification Rules configuration, specifically the rule name and email criteria fields in CategorizationPolicyWizard.aspx. The injected payload is written to the backend by SaveAllConfigSettings() without any output encoding, causing it to execute in the browsers of every subsequent user who views the Classification Rules page - including administrators. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.

Mutation-XSS in DOMPurify before 3.3.2 enables JavaScript execution in victim browsers when sanitized output is re-inserted into the DOM via innerHTML using wrapper elements such as xmp, noscript, iframe, noembed, noframes, or script. Attacker-controlled payloads containing wrapper-closing sequences (e.g., </xmp>) survive DOMPurify sanitization intact but mutate during the browser's second parse, breaking out of the wrapper context and activating injected event handlers. A working public proof-of-concept is confirmed in the GHSA advisory; no CISA KEV listing at time of analysis.

Prototype pollution in DOMPurify's USE_PROFILES mode enables DOM-based XSS by causing the sanitizer to accept event handler attributes it should block. Versions up to and including 3.3.1 of the npm package rebuild ALLOWED_ATTR as a plain JavaScript array when USE_PROFILES is active, making attribute allowlist lookups traverse the prototype chain - so a polluted Array.prototype (e.g., Array.prototype.onclick = true) causes DOMPurify to silently pass through event handlers like onclick into sanitized output. A proof-of-concept is included in the vendor advisory GHSA-cj63-jhhr-wcxv; no CISA KEV listing has been identified, indicating no confirmed active exploitation at time of analysis.

URI validation bypass in DOMPurify 3.3.1 and earlier allows `javascript:` protocol payloads to survive HTML sanitization and execute as DOM-based XSS when a crafted link is activated. The flaw exists in the `_isValidAttribute` function, which short-circuits before URI-safe validation runs when a caller-supplied predicate via `EXTRA_ELEMENT_HANDLING.attributeCheck` returns `true` for a given attribute/tag pair. Exploitation is conditioned on the consuming application using the non-default `ADD_ATTR` predicate API, but a working proof-of-concept is confirmed in the official GHSA advisory; no CISA KEV listing is present at time of analysis.

DOMPurify through 3.3.3 leaks function predicate state across sanitize() calls on the same instance, enabling XSS bypass when applications invoke the library with mixed parameter types for ADD_ATTR or ADD_TAGS. Specifically, a function predicate supplied to one sanitize() call persists in the internal EXTRA_ELEMENT_HANDLING map and is not evicted when a subsequent call on the same instance supplies ADD_ATTR or ADD_TAGS as a plain array, allowing attacker-controlled event-handler attributes or vendor-forbidden tags to survive sanitization. No public exploit or CISA KEV listing is confirmed at time of analysis; the CVSS 4.0 score of 5.1 reflects user interaction required and impact scoped to the subsequent system (browser context), consistent with a reflected or stored XSS consequence.

DOMPurify's IN_PLACE sanitization mode silently bypasses XSS filtering when processing DOM elements sourced from a different JavaScript window context (e.g., an iframe's contentDocument), returning the unsanitized element - payloads intact - to the calling application. The private _isNode() function's instanceof check fails for foreign-realm nodes because prototype chains belong to distinct window objects, causing DOMPurify to misidentify the input, disable IN_PLACE mode silently, and pass through unfiltered content. The vendor has explicitly declined to issue a fix, categorizing this as outside DOMPurify's threat model, leaving all versions through 3.3.3 permanently exposed without a vendor-supplied remediation path.

Cross-site scripting in DOMPurify 3.4.6 and earlier enables script execution when the library's IN_PLACE sanitization mode processes attacker-supplied live DOM nodes whose nodeName property has been clobbered to masquerade as an allowed element. The vulnerability bypasses DOMPurify's existing clobbering protections, which were scoped only to form elements, leaving all other live non-form nodes susceptible to nodeName manipulation. No vendor-released patch exists at time of analysis; no public exploit code has been identified, though the GHSA advisory provides a detailed technical breakdown sufficient for exploit construction.

SAFE_FOR_TEMPLATES bypass in DOMPurify 3.0.0-3.4.7 allows template expressions such as ${evil}, {{evil}}, and <%evil%> to survive sanitization when DOM output modes (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE) are used alongside SAFE_FOR_TEMPLATES: true. The final normalization pass (_scrubTemplateExpressions) employs a NodeIterator that, per DOM specification, does not descend into <template>.content - a separate DocumentFragment outside the normal child-node tree - meaning split text nodes that merge into exploitable expressions inside template content are never caught. Downstream template engines receiving this output may evaluate attacker-supplied expressions, producing XSS or template injection outcomes; no public exploit is identified at time of analysis, and the string output path is explicitly confirmed unaffected.

Stored XSS is achievable in applications using DOMPurify's setConfig() API combined with an uponSanitizeAttribute hook that conditionally permits dangerous attributes for trusted elements. The 3.4.7 patch introduced a clone-guard to prevent hook-driven allowlist mutation, but that guard lives exclusively inside _parseConfig(); setConfig() sets an internal SET_CONFIG flag that causes sanitize() to skip _parseConfig() entirely, handing hooks the live shared ALLOWED_ATTR object. One trusted render permanently poisons the allowlist for the entire DOMPurify instance lifetime, so subsequent attacker-controlled content inherits the mutated policy and retains event-handler attributes like onerror or onclick unstripped. No public exploit or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 score of 5.1 reflects that exploitation requires prior privilege to trigger hook pollution and passive victim interaction to realize the XSS.

Stored Cross-Site Scripting in Modula Image Gallery WordPress plugin versions 2.14.25 through 2.14.30 allows an authenticated low-privileged user to inject persistent malicious scripts into gallery content, which execute in the browser of any higher-privileged user who views the affected page. The Scope:Changed CVSS metric confirms cross-context script execution, enabling session hijacking, credential theft, or administrator account takeover on vulnerable WordPress sites. No public exploit code and no CISA KEV listing exist at time of analysis.

HTML injection in JetBrains IntelliJ IDEA before version 2026.2 enables silent user activity tracking through maliciously crafted IDE notifications. A remote attacker who can influence notification content - such as through a malicious plugin, crafted project file, or server response reflected as a notification - can inject arbitrary HTML payloads that silently load remote resources, beaconing user activity without any visible indication to the developer. No public exploit has been identified at time of analysis, and the CVSS 4.3 Medium score reflects a limited confidentiality-only impact with no integrity or availability consequence.

Stored Cross-Site Scripting in the WPShopmart Tabs WordPress plugin (versions 2.5 and below) allows an authenticated Shop Manager to inject persistent malicious JavaScript into tab content fields, which then executes in the browsers of any user who visits the affected page - including administrators. The scope change (S:C in the CVSS vector) confirms the payload crosses trust boundaries from the attacker's session into victims' browser contexts. No public exploit code and no CISA KEV listing have been identified at time of analysis, limiting immediate urgency, though the high-privilege requirement provides meaningful friction against opportunistic exploitation.

Stored Cross-Site Scripting in the Machete WordPress plugin (versions <= 5.2) allows authenticated users with Author-level privileges to inject malicious scripts into content that executes in victims' browsers when viewed. The vulnerability is classified as CWE-79 and carries a CVSS 5.9 score reflecting the scope change (S:C) typical of stored XSS, where payload execution occurs in a separate security context from where it was injected. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the attack vector is network-accessible with low complexity once attacker-controlled credentials are obtained.

Stored Cross-Site Scripting in the Custom Links in Elementor Image Carousel WordPress plugin (versions <= 1.1.1) enables authenticated attackers holding at least Author-level privileges to inject arbitrary JavaScript into carousel image link fields. The injected payload executes in any visitor's browser when they load a page containing the affected Elementor widget, crossing a scope boundary into the victim's session. No public exploit is identified at time of analysis, and the plugin's niche footprint limits widespread impact despite the network-accessible attack vector.

Stored Cross-Site Scripting in the Smart SEO Tool WordPress plugin (versions <= 4.1.2) allows an authenticated Contributor-level user to inject malicious JavaScript into SEO-related fields, which then executes in the browsers of higher-privileged users - such as administrators - who view the affected content. Successful exploitation could enable session hijacking and subsequent full site takeover if an admin account is compromised. No public exploit code or confirmed active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack.

Stored Cross-Site Scripting in the BSK PDF Manager WordPress plugin version 3.8 and earlier allows authenticated contributors to inject persistent malicious JavaScript into plugin-managed content. Because the CVSS vector reflects a scope change (S:C), the injected script executes in the security context of higher-privileged users - most critically WordPress administrators - who later view the affected page. No public exploit code or CISA KEV listing has been identified at time of analysis, but the contributor-to-admin privilege escalation path makes this a meaningful risk for multi-author WordPress installations.

Stored Cross-Site Scripting in the Liquid Speech Balloon WordPress plugin (versions <= 1.2.5) allows authenticated contributors to inject malicious scripts into speech balloon elements that execute in the browser context of higher-privileged users who view the affected content. The CVSS vector confirms PR:L and S:C, meaning a low-privileged contributor account is sufficient to plant the payload, and the scope change indicates impact extends to victim sessions. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the Manual - Documentation, Knowledge Base & Education WordPress Theme (versions 7.5.4 and earlier) allows authenticated Contributor-level users to inject persistent malicious scripts into theme-managed content. When a higher-privileged user such as an editor or administrator views the affected content, the script executes within their browser session, enabling session hijacking, credential theft, or unauthorized administrative actions. No active exploitation is confirmed (not listed in CISA KEV) and no public proof-of-concept code has been identified at time of analysis.

Stored Cross-Site Scripting in the GT3 Themes Photo Gallery WordPress plugin (versions <= 2.7.7.29) allows authenticated users holding at minimum the Author role to inject persistent malicious JavaScript into gallery content. When a privileged user such as an administrator subsequently views the affected gallery, the injected script executes in their browser context, enabling session hijacking or unauthorized administrative actions. No public exploit code exists and no CISA KEV listing is present at time of analysis, but the scope change (S:C) elevates practical risk by enabling privilege escalation from Author to Administrator.

Stored Cross-Site Scripting in the WordPress plugin Accept Donations with PayPal & Stripe (versions <= 1.5.5) allows contributor-level authenticated users to inject malicious JavaScript that executes in the browser of higher-privileged users, including site administrators. The scope change in the CVSS vector (S:C) confirms that a low-privileged contributor can affect sessions and actions of users outside their own security context. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored Cross-Site Scripting in the Appointment Hour Booking WordPress plugin (versions <= 1.5.86) allows authenticated contributors to inject and persist malicious JavaScript payloads that execute in the browsers of higher-privileged users, such as site administrators, who view the affected content. The CVSS vector (PR:L/UI:R/S:C) confirms this is a contributor-tier stored XSS with scope change, meaning the impact propagates beyond the attacker's own session into the administrative context. No active exploitation has been confirmed via CISA KEV, and no public exploit code has been identified at time of analysis.

Stored Cross-Site Scripting in the Ultimate Store Kit Elementor Addons WordPress plugin (versions <= 3.0.5) allows authenticated Contributor-level users to inject persistent malicious scripts into page content rendered for other users, including administrators. The Changed scope (S:C) in the CVSS vector confirms the injected payload executes in victims' browser sessions, enabling session hijacking, credential theft, or admin account takeover via crafted Elementor widget output. No public exploit code or CISA KEV listing is identified at time of analysis, but the low attack complexity and widespread use of Elementor-based WooCommerce stores make this a meaningful risk for multi-author WordPress deployments.

Cross-site scripting in the HashThemes Demo Importer WordPress plugin (versions up to and including 1.4.2) allows a high-privileged attacker to inject malicious scripts into author-related fields that execute in other users' browsers when the affected content is viewed. The vulnerability carries a scope change (S:C), meaning a compromised author context can impact administrative sessions, potentially enabling session hijacking or unauthorized actions on behalf of a victim admin. No public exploit code has been identified at time of analysis, and the vulnerability has not been added to the CISA KEV catalog.

Stored Cross-Site Scripting in LA-Studio Element Kit for Elementor versions up to and including 1.6.2 allows contributor-level WordPress users to inject and persist malicious JavaScript payloads within Elementor elements. When a privileged user such as a site administrator views the affected content, the script executes in their browser session, enabling potential session hijacking or unauthorized administrative actions. No public exploit code or CISA KEV listing has been identified at time of analysis, though the contributor-level access bar and scope-change impact make this a meaningful internal threat for multi-author WordPress deployments.

Stored Cross-Site Scripting in TheGem WordPress theme versions up to and including 5.11.1 allows low-privileged Contributor-role users to inject malicious JavaScript into site content, which then executes in the browsers of higher-privileged users - such as administrators - who view or manage that content. The CVSS scope-changed attribute (S:C) confirms the injected payload crosses security boundaries, extending impact beyond the contributor session into an admin or editor context. No public exploit code or active exploitation has been identified at time of analysis; the vulnerability was reported by Patchstack with a CVSS 6.5 Medium rating.

Cross-site scripting in the Nexcess Virtue/Ascend/Pinnacle Toolkit WordPress plugin (versions up to and including 4.9.12) allows authenticated contributors to inject malicious scripts that execute in the browser sessions of higher-privileged users such as administrators. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires WordPress Contributor-level access and victim interaction, but achieves a scope change - meaning the payload runs in the victim's browser context outside the plugin's own trust boundary. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis, though the Patchstack disclosure provides an actionable reference for affected site operators.

Stored Cross-Site Scripting in Fluent Support (WordPress plugin by WPManageNinja) versions up to and including 2.3.0 allows a Contributor-level authenticated attacker to inject persistent malicious JavaScript into support-related content. Because the CVSS vector carries S:C (scope change), the payload executes in the browser context of higher-privileged users - such as administrators - who subsequently view the injected content, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Stored cross-site scripting in JetElements For Elementor (≤2.9.1.1) allows authenticated WordPress Contributors to inject malicious JavaScript into widget fields that later executes in the browsers of higher-privileged users such as Administrators or Editors. The Changed scope in the CVSS vector (S:C) confirms the payload crosses the contributor's own trust boundary, enabling session hijacking, credential theft, or privileged WordPress API actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at the time of analysis.

Cross-site scripting in the MapSVG WordPress plugin (versions 8.14.0 and earlier) allows authenticated Contributor-level users to inject malicious JavaScript that executes in the browsers of higher-privileged users who view the affected content. The scope change in the CVSS vector confirms the injected script escapes the plugin's context and can compromise the victim's browser session, enabling session hijacking or unauthorized administrative actions. No public exploit has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in Masteriyo LMS WordPress plugin versions up to and including 2.3.0 allows authenticated subscriber-level users to inject malicious scripts that execute in the browsers of higher-privileged users such as administrators. The scope change (S:C in CVSS) indicates that a low-privilege attacker can impact users outside their own session, making this a privilege escalation vector in practice - a subscriber could steal admin session cookies or trigger unauthorized actions on behalf of administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Stored Cross-Site Scripting in WishList Member X WordPress plugin (versions 3.32.0 and below) allows authenticated subscribers to inject persistent malicious scripts into content rendered in other users' browsers, including administrators. The CVSS Scope Changed (S:C) designation confirms the attack crosses the trust boundary from the subscriber's session into victims' browsing contexts. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low privilege requirement (subscriber-level account) widens the realistic attacker pool on membership-gated sites.

Stored Cross-Site Scripting in FunnelKit Funnel Builder PRO (WordPress plugin by WiseTR Inc.) versions 3.15.0.4 and earlier allows low-privileged authenticated users - likely customer-tier accounts - to inject malicious JavaScript payloads that execute in other users' browsers upon viewing affected content. The scope-changed CVSS vector (S:C) confirms the injected script breaks out of the vulnerable component's security boundary to affect other browser sessions, enabling session hijacking, credential theft, or unauthorized admin actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, but Patchstack reported this vulnerability and the attack complexity is low.

Contributor-level stored Cross-Site Scripting in the Hubbub Lite WordPress plugin (versions <= 1.36.3) allows an authenticated attacker with Contributor role to inject persistent malicious JavaScript that executes in the browsers of higher-privileged users - including administrators - who subsequently view the affected content. The changed scope in the CVSS vector (S:C) confirms the payload escapes the contributor's own session context and can be used to hijack administrator sessions or perform unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis.

Cross-site scripting in the Photo Gallery by Supsystic WordPress plugin (versions ≤ 1.16.3) allows a high-privileged administrator to inject malicious scripts that execute in the browser context of other users visiting affected gallery pages. The CVSS scope-changed flag (S:C) indicates the injected payload escapes the administrative context and impacts the browsers of non-admin visitors or editors. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS signal was not provided in source data.

Cross-site scripting in WP-Polls WordPress plugin versions 2.77.3 and earlier allows authenticated administrators to inject persistent malicious JavaScript into poll configurations, which then executes in the browsers of site visitors who encounter the affected polls. The vulnerability requires administrator-level access to trigger, but the scope change (S:C in CVSS) means the impact crosses from the privileged admin context into the front-end visitor context, enabling session hijacking or content manipulation against unprivileged users. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Stored Cross-Site Scripting in the Header Footer Script Adder WordPress plugin (all versions through 2.1) allows any authenticated user holding author-level access or above to persistently inject arbitrary JavaScript via the 'asm_code' Snippet Meta field. The injected payload executes automatically in the browsers of any user who visits an affected page, enabling session hijacking, credential theft, or malicious redirects across the site's visitor base. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Cross-site scripting in the Keyboard Shortcuts extension for Joomla (versions 1.0.0-3.2.5) by Regular Labs allows injection of arbitrary JavaScript via the shortcut configuration interface, executing in the browser context of any user who subsequently triggers the affected shortcut. The Changed Scope (S:C) in the CVSS vector confirms script execution crosses into the victim's session context, enabling session hijacking, credential theft, or unauthorized site actions. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' both indicate low-probability opportunistic targeting.

Stored Cross-Site Scripting in the Grid/List View for WooCommerce WordPress plugin (versions ≤ 3.0.9) enables authenticated contributors to inject persistent malicious scripts via the unsanitized 'position' shortcode attribute, executing against every visitor who loads an affected page. The plugin's all_page="1" shortcode attribute compounds severity by forcing the widget to render site-wide, meaning a single injected post can target all visitors rather than only those on shop or category pages. No public exploit or CISA KEV listing identified at time of analysis; a patch has been committed to the WordPress plugin repository.

Stored Cross-Site Scripting in the Equalize Digital Accessibility Checker WordPress plugin (all versions through 1.46.0) permits authenticated contributors to inject persistent malicious scripts via the 'html' parameter of the plugin's REST API endpoint, which executes in the browser of any subsequent visitor to the affected post. The attack surface is the unguarded `/accessibility-checker/v1/post-scan-results/{id}` endpoint, protected only by the low-privilege `edit_post` WordPress capability, making exploitation trivial for any contributor-level account on multi-author sites. No public exploit has been identified and the plugin is absent from CISA KEV, but the low authentication bar and persistent payload nature elevate real-world risk beyond the medium CVSS score suggests for sites with multiple editors.

Stored Cross-Site Scripting in the Brands for WooCommerce WordPress plugin (versions through 3.8.8) allows authenticated contributors to permanently embed arbitrary JavaScript into pages via the unsanitized 'style' shortcode attribute, executing in any visitor's browser upon page load. The scope change (S:C) in the CVSS vector confirms cross-boundary impact: the attacker operates at contributor privilege level but the payload compromises site visitors' browser sessions. A plugin trac changeset (revision 3608899) indicates an upstream fix has been committed. No public exploit or CISA KEV listing identified at time of analysis.

Stored cross-site scripting in the BeRocket Brands for WooCommerce WordPress plugin (all versions through 3.8.8) enables authenticated Shop Manager-level users to inject persistent JavaScript via the br_brand_tooltip term meta field, executing against any visitor who loads an affected page. A notable architectural bypass is central to this flaw: because the payload is stored in WordPress term meta rather than post content, the platform's unfiltered_html capability gate - which normally prevents Shop Managers from injecting raw HTML - does not apply, granting that role unexpectedly full exploitation capability. No public exploit code and no CISA KEV listing exist at time of analysis.

Stored cross-site scripting in the Lpagery (Bulk Page Generator) WordPress plugin, versions up to and including 2.5.7, allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via crafted post titles. The vulnerability stems from the lpagery_add_filter_text_template_post() function echoing a raw post_title directly into an inline JavaScript single-quoted string literal on every admin page load, with no encoding applied. When an administrator accesses an admin page bearing the ?lpagery_template parameter pointing to the attacker's post, the injected payload executes in the admin's browser context, enabling session hijacking or unauthorized privileged actions. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the WP Shortcode by MyThemeShop WordPress plugin (versions up to and including 1.4.17) allows authenticated contributors to permanently embed malicious JavaScript into WordPress pages via the unsanitized 'title' parameter of the [tab] shortcode. The mts_tabs() function in wp-shortcode.php renders this attribute verbatim between HTML anchor tags, causing any visitor who loads an injected page to execute attacker-controlled script in their browser. No active exploitation is confirmed (not listed in CISA KEV) and no public exploit code has been identified at time of analysis; however, the contributor-level access requirement meaningfully lowers the bar on multi-author WordPress deployments.

Stored Cross-Site Scripting in the Webpushr Push Notifications WordPress plugin (versions ≤4.39.0) allows authenticated contributors to permanently inject arbitrary JavaScript into WordPress pages via the notification title and body parameters. The injected payload persists in post meta storage and executes in any victim's browser - including administrators - upon visiting an affected page, enabling session hijacking, credential theft, or privilege escalation to admin-level access. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Reflected XSS in Post Status Notifier Lite WordPress plugin (all versions before 1.13.0) allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in a logged-in WordPress administrator's browser by tricking them into following a crafted URL targeting `admin.php?page=post-status-notifier-lite`. The plugin fails to escape the `mod` GET parameter before reflecting it into the admin settings page output, producing a Scope:Changed impact per CVSS - meaning successful exploitation crosses the plugin boundary into the broader WordPress admin session context. A publicly available POC exists via WPScan, though EPSS sits at just 0.21% (11th percentile), indicating low observed exploitation activity and no CISA KEV listing at time of analysis.

Reflected XSS in WP Compress WordPress plugin (versions before 7.10.04) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious link that injects the attacker's domain as the CDN host for script assets. The plugin's loader emits script elements pointing to the attacker-controlled origin without sanitizing the CDN host query parameter, achieving cross-site scope execution within the target WordPress site. Publicly available exploit code exists per WPScan reporting; no active exploitation is confirmed in CISA KEV, and EPSS is low at 0.20% (11th percentile), consistent with SSVC's 'poc, non-automatable, partial impact' classification.

CRLF injection in Netty's HttpPostRequestEncoder allows authenticated network attackers to inject arbitrary MIME headers into multipart HTTP request bodies by embedding CR/LF characters in user-controlled filenames. Affected are all Netty 4.1.x releases before 4.1.136.Final and 4.2.x releases before 4.2.16.Final that use the codec-http multipart encoder. Publicly available exploit code has been verified against 4.2.12.Final; no public exploit identified at time of analysis as confirmed active exploitation (not in CISA KEV), though the PoC lowers the bar considerably for Content-Type spoofing, stored XSS, and multipart boundary confusion attacks.

Stored cross-site scripting (XSS) in multiple Regular Labs Joomla extensions allows an authenticated content author to inject arbitrary JavaScript. The script executes in visitors' browsers, potentially stealing session tokens or performing actions on their behalf. No active exploitation or public exploit code has been identified; EPSS score indicates very low likelihood of exploitation.

Stored cross-site scripting in Regular Labs Conditional Content and related Joomla extensions enables authenticated administrators to execute

Stored cross-site scripting in Froiden TableTrack through version 1.3.10 enables unauthenticated attackers to plant persistent JavaScript payloads via the customer order notes field, which execute in the admin's browser session when order details are reviewed. The attack vector is entirely unauthenticated - any visitor can submit an order containing a crafted payload - while the impact lands on the privileged admin context, enabling session token theft or unauthorized administrative actions. A publicly available proof-of-concept exploit exists; no CISA KEV listing has been confirmed at time of analysis.

Reflected XSS in JoomShopping's product frontend controller allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim clicks a crafted link. The flaw affects Joomla-based e-commerce sites running the JoomShopping extension, and successful exploitation could enable session hijacking, credential theft, or malicious page manipulation targeting shoppers. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis.

Stored Cross-Site Scripting in the Ultimate Addons for Elementor WordPress plugin allows authenticated contributors to implant persistent JavaScript payloads via the Navigation Menu Widget's data-toggle-icon and data-close-icon attributes, affecting all versions through 2.9.1. The attack survives WordPress's wp_kses_post sanitization because the filter does not decode HTML entities within data-* attribute values at save time, while the browser subsequently decodes them client-side before jQuery's .html() renders them as live markup. No public exploit code or CISA KEV listing is identified at time of analysis, but the low privilege bar - contributor access on any multi-user WordPress site - and the scope-changed CVSS impact make this a meaningful risk wherever open or broad contributor registration is permitted.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote, unauthenticated attackers to inject arbitrary JavaScript into a victim's browser by manipulating the `day` parameter in `/BSIS.php`. The CVSS 4.0 score of 2.1 reflects constrained real-world impact — user interaction is required and integrity impact is low — though a public proof-of-concept has been disclosed via a GitHub issue, confirming exploitability. No active exploitation has been confirmed via CISA KEV.

Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote attackers to inject arbitrary JavaScript into victim browsers by manipulating the `day` argument in /class.php, requiring only passive user interaction (UI:P). Publicly available exploit code exists per VulDB submission and a referenced GitHub proof-of-concept issue, though no CISA KEV listing has been issued. The CVSS 4.0 score of 2.1 reflects the narrow impact profile — limited integrity effect on the vulnerable system only, with no confidentiality or availability consequences recorded.

Stored cross-site scripting in FOG Project's inventory pipeline allows an unauthenticated network-adjacent attacker who knows any registered host's MAC address to inject persistent JavaScript payloads into the FOG database via POST requests to `/service/inventory.php`. When an administrator opens the Group Inventory tab, the unescaped payload executes in their browser, enabling session hijacking or unauthorized admin-level actions. No public exploit has been identified at time of analysis; patches are available in versions 1.5.10.1832 (stable) and 1.6.0-beta.2313 (beta).

Release attachment extension allowlist bypass in Gitea before v1.27.0 lets any authenticated repository write-permission holder rename an existing release attachment to a forbidden extension (e.g., .exe, .html, .svg) via the web release edit form, silently defeating the operator-configured `Repository.Release.AllowedTypes` enforcement. This is a variant of CVE-2025-68939: the parent fix (PR #32151) patched the API edit endpoint but left the web `EditReleasePost` handler unguarded, constituting CWE-424 (Improper Protection of Alternate Path). A self-contained Python PoC (GITEA-R007) is publicly available demonstrating end-to-end exploitation; no CISA KEV listing at time of analysis.

Stored cross-site scripting in SolarWinds Serv-U enables session hijacking and information disclosure from administrator accounts via malicious script persistence in the application. The vulnerability requires a high-privileged attacker to inject the payload, which then executes in the browser context of any administrator who views the poisoned content - a classic privilege-boundary-crossing XSS pattern confirmed by the CVSS scope-change flag. No public exploit code has been identified at time of analysis, and a vendor fix appears in Serv-U 2026.3 based on release note references.

Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to execute arbitrary JavaScript in the Home Assistant web origin. The `async_get_media_image()` method fetches the device's `thumb` field without validating that the returned content is an image MIME type, permitting a malicious `data:text/html` URI to be proxied and re-served by the HA backend with `Content-Type: text/html` to the victim's browser. Exploitation is conditional on attacker control of an integrated Shelly device and requires active user interaction; no CISA KEV listing or public proof-of-concept exists at time of analysis, but successful exploitation grants access to session tokens and authenticated control of locks, alarms, and covers.