Cross-Site Scripting

Unverified password change in Laravel Backpack CRUD's account-info endpoint allows any authenticated Backpack admin to permanently take over their own or a hijacked session's account by mass-assigning the `password` field without supplying the current password. Affected versions are backpack/crud < 6.8.11 and 7.0.0-alpha.1 through 7.0.33, running on Laravel 11 with the default `App\Models\User` model whose `$fillable` includes `password`. The attack converts time-limited stolen session access into permanent credential control, bypassing the dedicated change-password flow that enforces `old_password` verification. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack is trivially constructable given full public advisory detail.

Stored cross-site scripting in CVAT versions 2.68.0 through 2.69.x allows an authenticated user with annotation guide editing permissions to inject persistent malicious JavaScript into audio-task guide content, which executes in any other user's browser when they open the guide. The payload can silently issue arbitrary CVAT API requests - including data exports, task modifications, or privilege escalation actions - using the victim's active session credentials. No public exploit code has been identified at time of analysis; the vendor-confirmed fix is available in version 2.70.0.

Unauthenticated cross-site scripting in the NotificationX Pro WordPress plugin (all versions through 3.1.4) allows a remote, unauthenticated attacker to inject malicious script into pages served to authenticated users, including administrators. The scope change (S:C) in the CVSS vector indicates the injected script executes in a browser context outside the plugin's own trust boundary, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code or CISA KEV listing was identified at time of analysis, though Patchstack has published a database entry for this vulnerability.

Reflected Cross-Site Scripting in the Flatastic WordPress theme (all versions through 2.0) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS Scope:Changed metric confirms the injected script crosses trust boundaries, executing in the victim's browser context with access to session tokens and the ability to perform actions on behalf of authenticated users. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Unauthenticated reflected or stored cross-site scripting in Form Maker by 10Web WordPress plugin (versions <= 1.15.46) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) indicates network-reachable, low-complexity exploitation requiring only victim interaction, with scope change affecting the browser context. No public exploit code or CISA KEV listing has been identified at time of analysis, though Patchstack has reported and documented the vulnerability.

Unauthenticated reflected cross-site scripting in Podlove Podcast Publisher for WordPress (versions 4.5.4 and below) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in the browser of any authenticated user who can be tricked into clicking a crafted URL. The scope-changed CVSS vector (S:C) confirms the vulnerability crosses the trust boundary from the plugin's context into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions against the WordPress installation. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the zero-authentication prerequisite makes social-engineering-based delivery straightforward.

Unauthenticated cross-site scripting in SEO Plugin by Squirrly SEO versions 14.2.2 and below allows remote attackers without any credentials to inject and execute arbitrary JavaScript in the context of authenticated users who interact with crafted content. The vulnerability carries a CVSS 3.1 score of 7.1 (High) with a scope change flag, meaning successful exploitation crosses the trust boundary from the plugin into the victim's browser session. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated cross-site scripting in the Aora WordPress theme (all versions through 1.3.19) enables remote attackers to inject and execute arbitrary JavaScript in the browsers of site visitors without any prior authentication. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms this is network-reachable with low complexity, requiring only that a victim interact with a crafted link or page - a realistic bar for phishing-assisted delivery. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and scope-changed impact (S:C) elevate real-world concern for sites running this theme.

Unauthenticated cross-site scripting in the Paymob for WooCommerce WordPress plugin (versions 4.1.10 and earlier) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS scope-change flag (S:C) indicates the injected script can operate across origins, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis; the primary risk vector is opportunistic phishing or malicious link delivery targeting WooCommerce store customers or administrators.

Unauthenticated reflected Cross-Site Scripting (XSS) in the Advance Product Search WordPress plugin (by ThemeHunk) through version 1.4.8 allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session without any authentication. The CVSS scope-change indicator (S:C) confirms the vulnerability crosses the plugin's security boundary to affect the authenticated user's browser context, enabling session hijacking, credential theft, or malicious redirect. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero-authentication requirement make this straightforward to exploit once a victim is socially engineered.

Unauthenticated cross-site scripting in the SmartSMTP WordPress plugin (versions 1.2.0 and below) allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of any authenticated user who views the malicious content. The scope change confirmed by the CVSS vector (S:C) means impact extends beyond the injecting session to other users, including administrators. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Unauthenticated cross-site scripting in Swatchly - WooCommerce Variation Swatches for Products (versions ≤ 1.4.13) permits remote unauthenticated attackers to inject arbitrary JavaScript that executes in the browser context of site visitors or administrators who interact with a crafted URL or page. The scope-changed CVSS vector (S:C, UI:R, PR:N) indicates the injected script escapes the plugin's security context and runs under the victim's session, enabling session hijacking, credential theft, or malicious redirects against WooCommerce storefronts. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept code has been identified at time of analysis.

Cross-site scripting in the GeoDirectory WordPress plugin (versions ≤ 2.8.173) enables unauthenticated remote attackers to inject arbitrary JavaScript payloads that execute in the browsers of users who visit affected pages, including authenticated administrators. The CVSS:3.1 scope-changed vector (S:C) confirms that the attacker's script runs in a different security context than the vulnerable plugin itself, meaning a successful attack can affect the victim's authenticated WordPress session rather than just the plugin's isolated output. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity historically make WordPress XSS vulnerabilities attractive targets for rapid weaponization.

Unauthenticated cross-site scripting in B2BKing Premium (WordPress/WooCommerce plugin) versions 5.6.07 and earlier allows network-based attackers to inject arbitrary JavaScript into victim browsers without any authentication. The CVSS scope change (S:C) confirms that exploit payloads escape the plugin's context and execute within the victim's browser session, enabling session hijacking, credential theft, or malicious redirects targeting WooCommerce store visitors or administrators. No public exploit code or CISA KEV listing appears in the available intelligence, though the unauthenticated, low-complexity attack surface makes payload crafting straightforward once a reflective input vector is identified.

Unauthenticated Cross-Site Scripting in the wpDataTables WordPress plugin (versions 6.5.1.4 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in victims' browsers upon page interaction. The CVSS scope change (S:C) indicates the injected script escapes the plugin's context and can access session cookies, perform authenticated actions, or redirect users within the broader WordPress site. No public exploit or CISA KEV listing is confirmed at time of analysis, though Patchstack has published the vulnerability details.

Unauthenticated XSS in the Tagembed WordPress plugin (versions 7.4 and earlier) enables a remote, unauthenticated attacker to inject malicious JavaScript into pages rendered to other users, including administrators. The CVSS 3.1 vector records a scope change (S:C), meaning injected scripts execute in the victim's browser context outside the plugin's own boundary, enabling session hijacking, credential theft, or escalated site compromise. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.

Unauthenticated XSS in the TranslatePress WordPress plugin versions 3.3.2 and earlier allows remote, unauthenticated attackers to inject malicious JavaScript that executes in the browsers of visiting users. The CVSS 7.1 High rating reflects a scope change (S:C), meaning the injected script crosses the plugin's security boundary into the victim's authenticated WordPress session, enabling session hijacking or unauthorized actions on behalf of the victim. No active exploitation has been confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.

Unauthenticated Cross-Site Scripting in JetEngine (WordPress plugin by Crocoblock/JetImpex Inc.) versions 3.8.14.1 and earlier allows a remote, unauthenticated attacker to inject and execute malicious JavaScript in a victim's browser session when the victim interacts with crafted content or a malicious URL. The scope change (S:C) in the CVSS vector confirms the payload crosses the plugin's security boundary into the victim's browsing context, enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic targeting of WordPress sites running JetEngine.

Stored XSS in n8n's Form node completion page allows a low-privileged authenticated workspace member to bypass the origin's Content-Security-Policy and deliver arbitrary scripts to public form submitters. The flaw stems from a conditional CSP application gap: sandboxing was only enforced when `respondWith` was not set to 'redirect', yet `responseText` was rendered as raw HTML regardless of that setting. Scripts injected this way execute same-origin with the victim's n8n session, enabling session token theft, credential harvesting, or unauthorized actions. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in iCagenda Joomla extension versions 4.0.8 through 4.0.12 allows an authenticated event submitter to inject persistent JavaScript payloads via the `image` and `file` fields of the frontend 'Submit an Event' form. The injected script executes in any viewer's browser upon rendering the affected event page, with highest consequence when a Joomla administrator previews or approves the submission, enabling session hijacking and full backend compromise. No public exploit code or CISA KEV listing has been identified at time of analysis, but the stored nature of this XSS elevates risk above reflected variants due to its persistence and elevated-privilege victim profile.

Stored XSS in Phoca Cart (Joomla extension by phoca.cz, versions 5.0.0-6.1.7) allows any unauthenticated network attacker to inject a persistent JavaScript payload via a crafted HTTP User-Agent header submitted during order creation. The payload is stored in the order database and executes in the Joomla administrator's browser when they open the Admin Order View, placing admin sessions at risk of hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in Splunk Enterprise's Dashboard Studio allows a user holding the 'power' role to persist a crafted workflow action URL that, when triggered by a separate authenticated victim, executes attacker-controlled JavaScript in the victim's browser session. All four actively maintained branches are affected: 10.4.x below 10.4.2, 10.2.x below 10.2.6, 10.0.x below 10.0.9, and 9.4.x below 9.4.14. No public exploit has been identified at time of analysis, and exploitation is constrained by a required internal 'power' role and mandatory victim social engineering, meaningfully limiting the realistic attacker population despite the high impact ratings.

Stored cross-site scripting in Splunk Enterprise allows a 'power' role user to persist a malicious ui-tour knowledge object that executes arbitrary JavaScript in the browser of any authenticated user who visits an affected Splunk Web page. Affected are all Splunk Enterprise deployments running versions below 10.4.2, 10.2.6, 10.0.9, or 9.4.14, a broad multi-branch footprint reported via Cisco and confirmed by Splunk advisory SVD-2026-0801. No public exploit code or CISA KEV listing has been identified at time of analysis, but the CVSS 7.3 rating and high confidentiality and integrity impact scores reflect meaningful lateral risk within an enterprise's Splunk deployment.

Stored cross-site scripting in Etherpad before 3.3.1 lets any user with write access to a pad execute arbitrary JavaScript in the browser of anyone - including an administrator - who later opens the pad or its /timeslider view. The root cause is the numbered-list rendering path interpolating an attacker-controlled ordered-list 'start' value, sourced from a crafted .etherpad import, directly into unquoted markup assigned to innerHTML. A vendor patch exists in 3.3.1; no public exploit identified at time of analysis, though the vendor's regression test embeds a working payload.

Stored cross-site scripting in Wekan's HTML board export function allows a board member - including one whose access has since been revoked - to inject JavaScript that executes when any recipient clicks a card in a downloaded HTML export file. Wekan versions 8.72 through 10.23 are affected; the exploit survives membership removal and is capable of exfiltrating all board data embedded in the export to an attacker-controlled endpoint. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Scope:Changed CVSS classification and post-revocation persistence make this more dangerous than its 7.6 score suggests.

Stored XSS in Grav Shortcode Core Plugin (prior to 6.2.2) allows an authenticated user with admin.pages permission to inject arbitrary JavaScript into page content by supplying a crafted shortcode attribute value that breaks out of an HTML attribute context. The plugin's shortcode syntax bypasses Grav's save-time XSS filter because shortcode notation never contains a literal less-than character, and multiple attribute handlers (ColorShortcode, DivShortcode, ColumnsShortcode, and others) then concatenate the raw parameter directly into rendered HTML. The stored payload executes in the browser of any visitor or administrator who subsequently views the affected page. No public exploit or CISA KEV listing is identified at time of analysis.

Stored cross-site scripting in HumHub 1.18.4 lets a Space administrator embed arbitrary HTML or JavaScript into the deletion-reason field of a comment-removal notification sent to the comment's original author. When the victim renders the notification in their browser, the injected script executes within their authenticated HumHub session, enabling session-token theft or unauthorized actions on their behalf. No public exploit code or active exploitation has been identified at time of analysis; an upstream patch is available as GitHub PR #8365, though a tagged release version has not been independently confirmed.

Reflected cross-site scripting in HumHub Community Edition 1.18.4 allows a low-privileged attacker to inject arbitrary JavaScript into the browser session of an authenticated non-member by embedding malicious button configuration in the `options` query-string parameter of the `space/membership/request-membership-form` endpoint. When a social-engineering lure causes the victim to submit the membership request form, the server reflects attacker-controlled markup inside a script context, enabling account takeover-class impact. No active exploitation has been confirmed (no CISA KEV listing); an upstream patch is available as GitHub PR #8381, though a formally tagged release version has not been independently confirmed.

Stored XSS in HumHub Community Edition 1.18.4 and 1.18.4-pl1 allows authenticated low-privilege users to inject arbitrary HTML and JavaScript into the oEmbed confirmation prompt rendered for other users. The attacker-controlled URL prefix was passed unencoded into the HTML consent dialog via Html::tag() in UrlOembed.php, and a secondary code path flaw allowed confirmation content to flow through a CSP nonce injection routine - meaning embedded markup could acquire a valid nonce and bypass Content Security Policy. No public exploit identified at time of analysis, though Fluid Attacks has published a coordinated disclosure advisory with proof-of-concept detail.

Stored cross-site-scripting-to-RCE in SiYuan (the open-source personal knowledge-management/note app) before v3.7.4 lets an attacker-crafted document execute arbitrary OS commands on a victim's machine. Document metadata fields (bookmark, alias, memo, and an alternate name field) are concatenated unescaped into the aria-label attribute of the file-tree 'move/link to' path-picker tooltip; a double quote breaks out of the attribute and injects an inline event handler. Because every SiYuan Electron window runs with nodeIntegration:true, contextIsolation:false and no CSP, the handler reaches require('child_process') and achieves command execution the moment the victim hovers the malicious entry. There is no public exploit identified at time of analysis and it is not in CISA KEV.

Stored cross-site scripting escalating to arbitrary OS command execution affects the SiYuan personal knowledge-management application through version 3.7.3. Because the '((' block-reference autocomplete popup renders a candidate block's name, alias, and memo fields into HTML without escaping, an attacker who controls those metadata fields can plant a self-firing payload that runs the moment a victim types '((' and surfaces the crafted block; SiYuan's Electron shell runs with nodeIntegration enabled, contextIsolation disabled, and no CSP, so the injected script reaches require('child_process') and executes host commands. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the XSS-to-RCE chain is fully described by the VulnCheck advisory and vendor GHSA.

Unauthenticated cross-site scripting in the SimplyRETS Real Estate IDX WordPress plugin (versions 3.2.8 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. Exploitation is gated on user interaction - the victim must visit a crafted URL - which limits automated mass exploitation but still enables session hijacking, credential theft, or malicious redirects targeting site visitors or administrators. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Unauthenticated reflected or stored Cross-Site Scripting in the Global Gallery WordPress plugin (versions up to and including 11.1.2) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by authenticated users - most critically administrators. With scope changed in the CVSS vector (S:C), successful exploitation can result in session hijacking, credential theft, or unauthorized administrative actions within the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but unauthenticated XSS in a WordPress plugin is a well-understood attack class with a low exploitation barrier.

Unauthenticated Cross-Site Scripting in the BBQ Pro WordPress firewall plugin (versions 3.9 and earlier) allows remote attackers to inject and execute arbitrary JavaScript in the browsers of victims who interact with a crafted URL, with no authentication required. The CVSS Scope:Changed metric confirms the injected payload crosses browser security boundaries, enabling attacks such as admin session hijacking, credential theft, or malicious redirects even though the attacker requires no WordPress account. No active exploitation or public proof-of-concept has been identified at time of analysis, but the unauthenticated attack vector and low complexity lower the barrier for exploitation significantly.

Unauthenticated cross-site scripting in the WordPress Newsletter plugin (versions 9.3.3 and earlier) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to authenticated site visitors. With a Changed scope (S:C in the CVSS vector), the malicious script executes in the victim's browser context rather than being confined to the vulnerable plugin component, enabling session hijacking, credential theft, or administrative action impersonation. No public exploit code or active CISA KEV listing has been identified at the time of analysis, but the zero-authentication barrier and widespread WordPress deployment surface make this a meaningful risk for any site running the affected plugin.

Cross-site scripting in Contest Gallery (WordPress plugin, versions 30.0.5 and earlier) allows unauthenticated remote attackers to inject arbitrary JavaScript that executes in victims' browser sessions. The CVSS scope-change metric (S:C) confirms the payload can break out of the plugin's own trust boundary and affect the broader WordPress administrative context, enabling session token theft or unauthorized admin actions. No public exploit code or CISA KEV listing has been identified at time of analysis, but the combination of zero authentication requirements and low attack complexity lowers the barrier to exploitation significantly.

Stored Cross-Site Scripting in the TranslatePress WordPress plugin (versions up to and including 3.2.5) allows unauthenticated attackers to inject executable HTML into pages viewed in secondary languages by exploiting the plugin's internal translation marker system. Plain-text markers (#!trpst# / #!trpen#) pass through WordPress's wp_kses sanitizer undetected at comment submission, are stored in the database, and are unconditionally converted to angle brackets during page rendering - materializing attacker-controlled text as live HTML tags such as <img onerror=...>. No public exploit has been identified at time of analysis and the vulnerability does not appear in CISA's Known Exploited Vulnerabilities catalog, but the zero-privilege stored nature of the flaw and the plugin's broad WordPress deployment make it a credible priority for any multilingual site with public commenting enabled.

Stored cross-site scripting in WP Statistics (all versions through 14.16.8) allows unauthenticated remote attackers to permanently inject arbitrary JavaScript into a WordPress site's database and have it execute in any privileged user's browser session when viewing the plugin's statistics dashboards. The vulnerability chain is precise: the REST API signature required to submit a hit request is exposed on the public homepage, and a base64-encoded page_uri POST parameter to the /wp-statistics/v2/hit endpoint overrides the previously sanitized REQUEST_URI, smuggling an unsanitized utm_campaign value into the database. No public exploit code or CISA KEV listing has been identified at time of analysis, though the low exploitation complexity and large WordPress install base elevate practical urgency significantly.

Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin (versions before 2.0.11) allows an unauthenticated remote attacker to execute arbitrary JavaScript in the browser session of an authenticated WordPress administrator by inducing them to submit a specially crafted request targeting an affected administrative page. The unsanitized parameter is reflected directly into an HTML attribute without escaping, satisfying CWE-79. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, though the CVSS Scope:Changed rating reflects potential for cross-boundary impact within the WordPress installation.

Reflected Cross-Site Scripting in the ProSolution WP Client WordPress plugin before version 2.0.11 enables unauthenticated remote attackers to inject arbitrary JavaScript into victims' browsers via crafted URLs targeting public plugin pages. Multiple URL parameters are reflected unsanitized into HTML attributes, exposing any site visitor - including logged-in administrators - to session hijacking, credential theft, or unauthorized in-browser actions if tricked into clicking a malicious link. No public exploit or CISA KEV listing exists at time of analysis; EPSS at 0.16% (6th percentile) indicates low opportunistic exploitation probability, though administrator-targeting scenarios carry elevated business risk.

Stored Cross-Site Scripting in the Simple File List WordPress plugin (versions through 6.3.11) allows unauthenticated users to inject persistent malicious scripts via unsanitized file description fields when the plugin's front-end file management feature is enabled. The injected payload executes in the browser of every subsequent visitor who views the public file list, enabling session hijacking, credential theft, or malicious redirects targeting site visitors including administrators. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.18% at the 8th percentile signals very low automated exploitation probability, though the unauthenticated write path and broad victim exposure make it a priority for any site with front-end file management enabled.

Reflected Cross-Site Scripting in NextScripts Social Networks Auto-Poster WordPress plugin (all versions before 4.4.8) enables network-based attackers to inject and execute arbitrary JavaScript in the browsers of logged-in WordPress administrators by delivering a crafted URL. The plugin fails to escape query-string parameters before reflecting them in admin page output, a textbook CWE-79 failure. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Stored cross-site scripting via malicious SVG upload in the Booking Calendar, Appointment Booking System WordPress plugin (versions 3.2.18 through 3.2.36) allows unauthenticated remote attackers to plant persistent JavaScript payloads that execute in the browser session of any administrator who reviews submitted bookings. The plugin's SVG sanitization routine strips some script constructs but fails to neutralize all JavaScript execution vectors within SVG markup, making the bypass achievable without authentication. No public exploit has been identified at time of analysis and EPSS is low (0.20%, 10th percentile), but the admin-session-hijacking impact elevates real-world risk for any site relying on this plugin.

Stored cross-site scripting combined with privilege escalation in Confluence Data Center and Server lets an unauthenticated attacker persist malicious HTML/JavaScript that runs in a victim's browser, enabling actions performed as a higher-privileged user and abuse of insecure default configurations. Atlassian rates it Critical (vendor CVSS 4.0 score 9.3; the advisory body text separately cites 8.6), and it affects a long list of 7.x through 10.2.x branches. There is no public exploit identified at time of analysis and it is not on CISA KEV; it was found through Atlassian's bug bounty program.

Stored XSS in Froxlor's DNS TXT record editor enables any low-privilege hosting customer with DNS editor access to inject arbitrary JavaScript that executes automatically in an administrator's browser session upon routine page load. The attack exploits a three-point failure: missing HTML sanitization at input, an unescaped `wordwrap()` callback that introduces raw HTML, and a Twig template using `|raw` that bypasses auto-escaping - compounded by a CSP header that includes `'unsafe-inline'`, rendering it useless. A detailed public proof-of-concept is confirmed in the vendor advisory; no CISA KEV listing at time of analysis. Successful exploitation yields complete admin account takeover and full server compromise.

Stored cross-site scripting in MyBB before 1.8.40 allows any registered forum member to inject persistent JavaScript into checkbox and multiselect profile fields by submitting a scalar string value instead of the expected array shape, bypassing type-specific sanitization in UserDataHandler::verify_profile_fields(). The unsanitized payload is written to the database and rendered verbatim in member.php and inc/functions_post.php when other users view the attacker's profile or posts displaying profile fields. With a Changed scope (S:C) and high confidentiality and integrity impact, successful exploitation against an administrator enables full session hijacking and privileged action takeover; no active exploitation or public POC has been identified at time of analysis.

Stored cross-site scripting in MyBB's Buddy/Ignore component prior to version 1.8.40 allows authenticated attackers to inject arbitrary JavaScript by registering usernames that survive the `htmlspecialchars_uni()` sanitization pass with unescaped single quotes intact. The payload fires in the victim's browser during two specific user interactions: clicking 'Yes' in the removal confirmation dialog within usercp.php, or selecting the crafted username via the onclick handler in the xmlhttp.php Private Messages Select Buddies popup. With a CVSS 8.7 rating reflecting a scope change (C:H, I:H), successful exploitation can yield full session hijacking or unauthorized actions on behalf of the victim. No public exploit has been identified at time of analysis.

Stored cross-site scripting in Kestra's custom Markdown renderer (versions before 1.3.24) allows any authenticated user with Flow create or edit permissions to inject arbitrary JavaScript event-handler attributes via the platform's own [[link]] syntax, executing attacker-controlled code in the browser of any user who views the affected Flow description. The CVSS scope change (S:C) reflects that the payload crosses from the attacker's permission context into the victim's browser session, enabling session hijacking or privilege escalation against higher-privileged reviewers. A working proof-of-concept is publicly confirmed in GHSA-34pm-923j-7wf8; no active exploitation via CISA KEV is listed at time of analysis.

Stored XSS in Trilium Notes via the #iconClass note label escalates to full operating-system code execution due to the Electron runtime's enabled nodeIntegration and disabled contextIsolation. An attacker with note-write access (CVSS PR:H) can set a crafted #iconClass attribute value that auto-executes when any victim opens a new tab or invokes quick search (Ctrl+J), granting arbitrary OS command execution as the victim user. Fixed in v0.103.0; no active exploitation (KEV) or public POC identified at time of analysis.

Address bar spoofing in ArcSearch for iOS prior to 1.48.0 allows attacker-controlled web content to impersonate trusted browser interface elements by triggering a page-initiated scroll that keeps the address bar hidden. The Scope Change in the CVSS vector (S:C) reflects that the vulnerability crosses from web content into the browser chrome itself, enabling phishing and credential harvesting attacks. No public exploit code or active exploitation has been identified at time of analysis, but the low attack complexity and lack of required privileges make this straightforward to weaponize against any user who visits a malicious page.

Unauthenticated cross-site scripting in the Subscribe2 WordPress plugin (versions <= 10.46) allows a remote unauthenticated attacker to inject arbitrary JavaScript into pages rendered by victims who follow a crafted link. The CVSS scope-change metric (S:C) indicates the injected script executes outside the vulnerable component's security boundary, enabling session hijacking, credential theft, or unauthorized administrative actions against any user - including site administrators - who can be socially engineered into triggering the payload. No public exploit code or active exploitation has been confirmed at time of analysis, though the zero-privilege attack entry point lowers the barrier for opportunistic abuse.

Cross-site scripting in the Site Reviews WordPress plugin by Gemini Labs (versions up to and including 8.2.0) allows unauthenticated attackers to inject malicious JavaScript that executes in visitors' browsers when they view affected review pages. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects that no authentication is needed to plant the payload, and the changed scope means the injected script can reach browser-origin resources beyond the plugin itself, enabling session hijacking or credential theft. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated cross-site scripting in Contact Form by Supsystic WordPress plugin (all versions before 1.10.0) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in the browsers of site visitors. The CVSS vector confirms a scope change (S:C), meaning the injected script executes in the victim's browser context rather than the server, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege entry point and WordPress deployment scale make this a meaningful patching priority.

Unauthenticated Cross-Site Scripting in the Ultimate Maps by Supsystic WordPress plugin (all versions prior to 1.5.0) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered in a victim's browser. The CVSS vector confirms a Changed scope (S:C), meaning injected scripts execute within the victim's browser security context rather than the plugin's own origin, enabling session hijacking or malicious redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated, low-complexity attack vector significantly lowers the exploitation barrier.

Unauthenticated Cross-Site Scripting in the URL Shortify WordPress plugin (versions <= 2.5.0) allows remote attackers to inject malicious scripts into pages viewed by authenticated victims, including site administrators. With a Changed scope (S:C), successful exploitation extends the attack surface beyond the plugin itself into the victim's browser session, enabling session hijacking, credential theft, or unauthorized administrative actions within the WordPress dashboard. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated cross-site scripting in Chaty Pro (WordPress plugin by Premio, versions ≤ 3.5.8) enables remote attackers without any credentials to inject malicious JavaScript into pages served to site visitors and administrators, with the CVSS scope change (S:C) indicating the payload can affect security principals beyond the plugin itself - including stealing admin session tokens or performing privileged actions on behalf of logged-in users. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) places this as a low-complexity, network-accessible attack requiring only that a victim load an affected page. No public exploit code and no CISA KEV listing have been identified at time of analysis, per Patchstack's disclosure and ENISA EUVD-2026-60784.

Unauthenticated Cross-Site Scripting in the Affiliates Manager WordPress plugin (versions ≤2.9.53) allows remote attackers without credentials to inject arbitrary JavaScript that executes in the browser context of site visitors or authenticated administrators. The CVSS scope change (S:C) indicates the injected script breaks out of the plugin's trust boundary and operates under the victim's session, enabling session hijacking or unauthorized privileged actions. Reported by Patchstack under ENISA EUVD-2026-60782, no CISA KEV entry or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity attack surface makes this class of flaw a consistent target in mass WordPress scanning campaigns.

Reflected XSS in the miniOrange WordPress Social Login and Register plugin (all versions through 7.8.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browser session of any user who follows a crafted link. The CVSS scope-change designation (S:C) confirms the malicious script escapes the plugin's rendering context and operates within the victim's full browser session, making admin-targeted delivery via phishing a realistic escalation path to full WordPress site compromise. No public exploit code and no CISA KEV listing have been identified at time of analysis; exploitation risk signals are limited to the CVSS vector and the Patchstack disclosure.

Cross-site scripting in WP Multilang WordPress plugin (versions through 2.4.31) allows unauthenticated remote attackers to inject malicious JavaScript into victim browsers when a user interacts with a specially crafted URL, with CVSS scope change (S:C) indicating the payload can escape the plugin's execution context and affect the broader browser environment. Reported by Patchstack and catalogued as ENISA EUVD-2026-60772, the vulnerability carries a CVSS 7.1 High rating driven primarily by the changed scope and zero-privilege requirement for crafting the exploit. No public exploit code or confirmed active exploitation has been identified at time of analysis.

Unauthenticated XSS in the Autopay WordPress plugin (versions ≤ 5.0.0) enables remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication, leveraging the plugin's failure to sanitize user-supplied input before rendering it in HTML output. The CVSS scope change (S:C) indicates the injected script escapes the plugin's own context, enabling session hijacking, credential theft, or malicious redirects against users of affected WordPress sites. No public exploit code or CISA KEV listing has been confirmed at time of analysis; the issue was disclosed by Patchstack.

Cross-site scripting in WPDM - Premium Packages for WordPress allows unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered for victim users, exploiting insufficient output sanitization in plugin versions 7.0.5 and earlier. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity, network-reachable unauthenticated access with a scope change crossing from the vulnerable plugin into the victim's browser context, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated reflected Cross-Site Scripting (XSS) in the Convert Pro WordPress plugin (versions up to and including 1.0.1) allows remote, unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted link. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-reachable exploitation with no authentication required, though victim interaction is needed. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated nature and WordPress ecosystem prevalence elevate practical risk.

Cross-site scripting in the Templately WordPress plugin (versions ≤ 3.7.1) enables unauthenticated remote attackers to inject arbitrary JavaScript that executes in victim browsers upon user interaction, with scope change indicating cross-context impact. The CVSS vector (PR:N, S:C) confirms exploitation requires no authentication and that injected scripts escape the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious content injection. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated cross-site scripting in Fluent Forms Pro Add On Pack (versions below 6.2.12) allows a remote, unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by enticing them to interact with a crafted URL or form input. The vulnerability carries a CVSS 7.1 (High) rating with scope-changed impact, meaning the injected script can affect browser context beyond the plugin itself - enabling session hijacking, credential theft, or UI redirection against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available at version 6.2.12.

Unauthenticated cross-site scripting (XSS) in the Kirki WordPress customizer plugin (all versions up to and including 6.2.3) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when the victim is socially engineered into visiting a crafted URL or page. The CVSS scope change (S:C) indicates injected script execution escapes the plugin's own context, enabling session hijacking, credential theft, or unauthorized admin actions against authenticated WordPress users. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the zero-privilege-required, low-complexity attack path makes this accessible to unsophisticated attackers targeting WordPress sites.

Unauthenticated cross-site scripting in Ultimate Dashboard WordPress plugin versions 3.11.2 and earlier allows network-accessible, privilege-free attackers to inject arbitrary JavaScript that executes in the browser context of any authenticated user who visits the affected page. The CVSS scope change (S:C) confirms the payload breaks out of the plugin's context and operates under the WordPress origin, enabling session hijacking, credential harvesting, or forced privileged actions against administrators. No active exploitation has been confirmed in CISA KEV and no public proof-of-concept exploit code has been identified at time of analysis.

Unauthenticated Cross-Site Scripting (XSS) in the BP Better Messages WordPress plugin versions up to and including 2.15.22 allows remote unauthenticated attackers to inject malicious scripts that execute in the browser of any user who views attacker-controlled content. The scope-changed CVSS vector (S:C) indicates the injected script can operate beyond the plugin's context, enabling session hijacking, credential theft, or admin account takeover when a privileged user views the payload. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated attack vector and low complexity lower the barrier significantly for opportunistic exploitation.

Reflected Cross-Site Scripting in the Mayosis Core WordPress plugin (versions 5.4.7 and earlier) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking authenticated WordPress users into clicking a crafted URL. The CVSS Scope Change (S:C) indicator confirms the injected script escapes the plugin's context, enabling session hijacking, credential theft, or malicious redirects targeting site administrators or editors. No public exploit code or CISA KEV listing has been identified at time of analysis; the vulnerability was disclosed by Patchstack.

Reflected Cross-Site Scripting in the SSL Zen WordPress plugin (versions 4.7.43 and earlier) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of authenticated WordPress users who interact with a crafted URL. The Scope:Changed CVSS metric confirms the injected script executes outside the plugin's own trust boundary, making admin session hijacking and site takeover realistic outcomes. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.

Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.

Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.

Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.

Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.

Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is not listed in CISA KEV.

Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.

Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in Pandora's URL observable rendering allows network-reachable attackers to inject arbitrary JavaScript that executes in the context of an authenticated victim's Pandora session when they interact with the Submit to Lookyloo control. The root cause is a JavaScript string injection context mismatch: attacker-controlled URLs extracted from submitted files were interpolated directly into inline onclick handlers, where the template engine's HTML entity encoding provides no protection. Successful exploitation enables session hijacking or unauthorized actions on behalf of the victim; no public exploit has been identified at time of analysis.

Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads inside PDF metadata fields (Title or Author) that execute in a victim's browser session when the user triggers the 'Get Info' workflow. The vulnerable template at get-info-on-pdf.html injects unsanitized metadata directly into the DOM via innerHTML, enabling session token theft and arbitrary page content manipulation against any user who processes a crafted PDF on a shared instance. No public exploit has been identified at time of analysis, and the vendor has shipped a complete fix in the major v2.0.0 release.

Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.

Stored/reflected cross-site scripting in Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 lets an unauthenticated attacker execute arbitrary JavaScript in a visitor's browser by supplying a crafted color_scheme_id or dark_scheme_id cookie. Because the cookie is rendered into a color-scheme tag without HTML escaping, an attacker can break out of the attribute context and inject markup that defeats Discourse's nonce-based Content Security Policy. A vendor patch exists and the flaw carries a critical CVSS of 9.3, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Cross-site scripting (XSS) in OpenText Directory Services through version 22.2 allows network-based unauthenticated attackers to inject malicious scripts that execute in victims' browsers, yielding high confidentiality and integrity impact against the vulnerable system. A proof-of-concept exploit exists per the CVSS 4.0 E:P modifier, though this CVE does not appear in the CISA KEV catalog and user interaction is required to trigger the flaw. Because directory services platforms manage authentication credentials and identity data, successful exploitation can enable session hijacking or account takeover with downstream access implications across integrated systems.

Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.

Stored cross-site scripting in SiYuan before v3.7.4 lets an authenticated user upload an HTML file through the asset-serving endpoint, which the server returns without Content-Disposition or X-Content-Type-Options headers, so the browser renders it inline instead of downloading it. When the workspace owner clicks the malicious asset link, the injected script runs in the app's origin with full kernel API access, enabling account and data compromise. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis.

Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.

Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.

Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.

Cross-site scripting leading to arbitrary code execution in SiYuan (self-hosted note-taking / knowledge-management app) before v3.7.4 lets an attacker embed hex-encoded markup inside a document icon that the vulnerable unicode2Emoji function renders without sanitization; because the Electron renderer runs with Node integration enabled, the injected script escapes the browser context and executes OS commands on the victim's host. Any user who opens or imports a crafted document is affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor GitHub security advisory (GHSA-vx5w-qrvp-mmcq) and a VulnCheck advisory document the flaw.