Cross-Site Scripting

Stored XSS in Grav CMS shortcode-core attribute handlers allows authenticated users with admin.pages permission to inject persistent JavaScript payloads that bypass the CMS's XSS detection filter and execute in any visitor's browser. The filter flaw is root-cause critical: it only flags payloads containing literal angle brackets, leaving event-handler and attribute-based injection vectors entirely unblocked. When an administrator views an affected page, the injected script can steal admin session nonces, enabling full account takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, but the impact chain - from low-privilege content editor to admin session hijack - is straightforward.

Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (versions ≤ 6.6.11) allows authenticated contributors to inject persistent JavaScript payloads via the Fancy Text Widget, executing in any visitor's browser upon page load. Source code analysis confirms two distinct sink defects: the bundled Morphext library used unsafe `innerHTML` assignment for both phrase text and animation class names, and the widget's transition-type parameter was passed unsanitized to Morphext as a CSS class token without allowlist validation. No active exploitation is confirmed by CISA KEV, and no public exploit code has been identified at time of analysis; however, the scope-change (S:C) CVSS vector and contributor-accessible attack surface make this a credible risk on multi-author WordPress deployments.

Stored Cross-Site Scripting in WPForms (AI Form Builder for WordPress) through version 2.0.0.1 allows contributor-level authenticated attackers to inject persistent malicious scripts into WordPress pages via an unsanitized data-sitekey attribute in the OptinMonster integration handler. Exploitation is constrained by a high-complexity attack condition: the target site must have OptinMonster installed, configured with an active inline campaign emitting matching #om-{id} markup, since WPForms only processes the vulnerable attribute when OptinMonster fires its 'om.Campaign.load' event. No public exploit code or CISA KEV listing has been identified at time of analysis. The CVSS-assigned scope change (S:C) reflects that injected scripts execute in victims' browser sessions, crossing the security boundary from the server-side WordPress context.

Stored Cross-Site Scripting in the Essential Addons for Elementor WordPress plugin (all versions through 6.6.11) allows authenticated contributors to persist malicious JavaScript via the Reading Progress Global Color Settings feature, executing against any user who subsequently visits an affected page. The vulnerability stems from insufficient sanitization in the plugin's Elements and Core traits, with a scope change (S:C) meaning impact extends beyond the plugin itself to victim browser sessions. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept is referenced in available intelligence.

Cross-site scripting (XSS) in aiflowy 2.1.2 and earlier allows unauthenticated remote attackers to inject malicious scripts via the UploadController.java file upload endpoint, which are then executed in victim users' browsers. The scope change in the CVSS vector (S:C) confirms the attack crosses the application's security boundary into the browser context, enabling session hijacking or credential theft. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite a publicly referenced writeup on GitHub.

XSS via unescaped attribute name interpolation in Astro's renderHTMLElement affects all versions of the npm package 'astro' prior to 7.0.6, representing an incomplete fix for CVE-2026-54298. The renderHTMLElement() function in dom.ts interpolates spread prop keys directly into HTML attribute names without sanitization - escaping only the value - allowing an attacker who controls prop key names on a native HTMLElement-subclass Astro component to inject event-handler attributes or sibling script elements into SSR-rendered output. Exploitation is constrained to SSR runtimes that expose a global HTMLElement (Deno, Bun with a DOM shim, jsdom/happy-dom in Node); standard Node.js SSR is not reachable. A proof of concept is publicly available in the GitHub advisory (GHSA-f48w-9m4c-m7f5). This CVE is not listed in CISA KEV.

Reflected XSS in Astro's view transition directive rendering allows arbitrary JavaScript injection when a developer passes attacker-controlled input into transition:persist, transition:scope, or transition:persist-props directives on client-hydrated islands. Affected versions span astro 3.10.0 through 7.0.4 (exclusive), covering roughly four major version lines. A public proof-of-concept is included in the GHSA-7pw4-f3q4-r2p2 advisory; no CISA KEV listing or confirmed in-the-wild exploitation is recorded at time of analysis, and the real-world attack surface is narrowed significantly by the precondition that the application developer must have written code that reflects untrusted request input directly into one of these directives.

Stored Cross-Site Scripting in the Spectra Legacy - Gutenberg Blocks plugin for WordPress (all versions through 2.19.28) allows low-privileged authenticated attackers to plant persistent malicious scripts via the image block that execute in any visitor's browser. The vulnerability resides in insufficient sanitization and output escaping within the `uagb/image` block renderer, specifically traced by Wordfence to `class-uagb-image.php` and `block.php`. With Contributor-level access - a role available on virtually any multi-author or membership-enabled WordPress site - an attacker can inject payloads that persist until removed, affecting every subsequent visitor. No public exploit code or CISA KEV listing has been identified at time of analysis.

Reflected Cross-Site Scripting in Best Practical RT versions 5.0.4-5.0.9 and 6.0.0-6.0.2 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated RT user by inducing that user to visit a specially crafted URL. The CVSS vector's Changed scope (S:C) indicates the injected script can impact browser security context beyond the vulnerable RT component itself, including potential session hijacking or in-browser data exfiltration. Vendor-released patches are confirmed in versions 5.0.10 and 6.0.3 (released 2026-05-20); no active exploitation has been identified at time of analysis.

Stored XSS in Best Practical RT (versions 5.0.0-5.0.9 and 6.0.0-6.0.2) allows any authenticated user with file upload permissions to embed malicious JavaScript in an uploaded file that executes in the browser session of any RT user who later views or downloads that content. The root cause is RT serving uploaded files inline rather than forcing browser download via Content-Disposition: attachment, enabling browsers to render and execute embedded scripts. Vendor-released patches 5.0.10 and 6.0.3 are available (released 2026-05-20); no public exploit identified at time of analysis.

Stored cross-site scripting in Quix Page Builder Pro, a Joomla CMS extension by ThemeXpert, allows authenticated builder-role users to inject persistent malicious scripts by breaking out of id/class HTML attribute fields rendered in public-facing pages. The payload executes in the browsers of any visitor loading the affected page, enabling session hijacking, phishing redirects, or malware delivery at scale across the site's audience. No public exploit code or active exploitation has been identified at time of analysis, and no confirmed patched version is available from the provided references.

Stored Cross-Site Scripting in Best Practical RT versions 6.0.0 through 6.0.2 allows an authenticated attacker with write access to inject persistent JavaScript payloads into ticket or configuration data, which then executes in the browsers of other RT users who view the affected pages. The CVSS scope change (S:C) reflects cross-user browser context impact - injected scripts operate in the victim's session, enabling session hijacking or unauthorized actions. No public exploit is identified at time of analysis; vendor-released patch is confirmed in RT 6.0.3, published 2026-05-20.

Reflected Cross-Site Scripting in RT (Request Tracker) 6.0.0 through 6.0.2 allows an unauthenticated network attacker to execute arbitrary JavaScript in an authenticated user's browser session by inducing that user to visit a crafted URL. The CVSS:3.1 scope-change flag (S:C) confirms the payload crosses from the RT application context into the victim's browser, enabling session token theft or unauthorized RT actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis; the vendor-released fix is RT 6.0.3, published 2026-05-20.

Hidden field injection in HeyForm's form submission API allows anonymous submitters to bypass server-side schema validation and store arbitrary key/value pairs - including XSS payloads and forged authorization metadata - directly into submission records. All HeyForm deployments prior to version 3.0.0-rc.9 are affected. The injected data is subsequently forwarded verbatim to every registered webhook integration, enabling downstream system poisoning and stored XSS against any admin interface that renders submission data. SSVC rates this as automatable with a POC exploit available; no KEV listing at time of analysis.

Stored cross-site scripting in HeyForm's unauthenticated file upload endpoint allows remote attackers to execute arbitrary JavaScript in victims' browsers by uploading SVG files containing embedded scripts. The `/api/upload` endpoint accepted SVG uploads without authentication, stored them in the static assets directory, and Express's serve-static served them with `Content-Type: image/svg+xml`, enabling script execution in the HeyForm domain context when a victim views the file URL. No active exploitation is confirmed (not in CISA KEV); vendor-released patch 3.0.0-rc.7 is available.

Reflected DOM XSS in dataCycle-CORE versions up to and including 25.07.3 allows unauthenticated remote attackers to inject arbitrary HTML into flash notification toast components via crafted links to public routes such as `/docs`. The frontend toast component renders attacker-supplied content directly via `innerHTML` without sanitization, enabling script execution in the victim's browser across the normal application layout - not limited to isolated or admin-only views. No active exploitation or public exploit code has been identified at time of analysis, though the unauthenticated, low-complexity network vector substantially lowers the bar for opportunistic abuse.

Stored cross-site scripting in Bifra Engineering Consulting Ltd. Q-smart NexT Poll (all versions before 1.8.7) allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into poll content that executes in the browsers of any user who subsequently views the affected page. The scope change (S:C in CVSS) indicates impact extends beyond the submitting user to other authenticated or unauthenticated viewers, enabling session hijacking, credential theft, or unauthorized actions performed in the victim's browser context. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Stored cross-site scripting in Frogman's chat-console markdown formatter allows a FreePBX admin with write access to entity fields (extension names, ring-group descriptions, IVR names, queue descriptions) to inject JavaScript payloads that execute in a second, higher-privileged admin's browser session when those fields are reflected through Frogman chat tool responses. All versions prior to 1.6.6 are affected; version 1.6.6, released following an internal audit on 2026-05-13, is the patching release. No public exploit code exists and no active exploitation has been confirmed (no CISA KEV listing); real-world risk is bounded by the product's experimental status and PR:H requirement.

Stored cross-site scripting in maalfer Pentestify before 1.1.0 allows an authenticated attacker to inject arbitrary JavaScript that executes in the browser of every user who views an affected report. The payload is stored in a finding's images array or a report's client_logo array and interpolated directly into HTML img src attributes by the client-side rendering functions renderPreview, renderEditor, and renderAuditData in js/app.js without HTML escaping. No public exploit has been identified and this vulnerability is not listed in CISA KEV; however, the stored nature means a single injection persists and fires for all future viewers of the affected report until the application is patched.

Reflected cross-site scripting in a WSO2 product allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by crafting a malicious URL containing an unsanitized parameter. When a victim user clicks the attacker-controlled link, the injected script executes in the victim's browser under the application's origin, enabling UI manipulation, phishing redirects, and extraction of non-cookie browser data. Session hijacking impact is partially mitigated because session cookies are protected by the httpOnly flag, though other sensitive browser-accessible data remains at risk. No public exploit or KEV listing has been identified at time of analysis.

Cross-site scripting in fuint Member Marketing System v1.0 and earlier allows remote unauthenticated attackers to inject malicious JavaScript through the ClientMessageController component, executing within authenticated users' browser sessions when they view the compromised content. The CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms network-accessible, low-complexity injection requiring no authentication, with scope change indicating browser-context impact beyond the originating request. No public exploit has been confirmed at time of analysis, and this CVE is not listed in the CISA KEV catalog.

Stored cross-site scripting in Mettle SendPortal 3.0.1 and earlier enables persistent JavaScript injection through the content parameter of the /templates endpoint, with payloads executing in every browser that subsequently renders the poisoned template. A public proof-of-concept is hosted on GitHub Gist, providing low-effort reproduction for threat actors. Despite CISA SSVC assessing current exploitation as none, the scoped impact (S:C) means a single injected template can cascade across all users who view it, making this a meaningful session-hijacking or credential-harvesting vector for organizations relying on SendPortal for email campaign management.

Cross-site scripting in itsourcecode Courier Management System 1.0 allows remote, unauthenticated attackers to inject arbitrary client-side scripts via the `page` parameter of /index.php, requiring only that a victim user follow a crafted link. A publicly available proof-of-concept exploit exists, lowering the bar for abuse. No patch has been identified at time of analysis; no CISA KEV listing, but the public PoC and low attack complexity make this actionable for defenders protecting user sessions.

Cross-site scripting in code-projects Online Examination System 1.0 allows remote attackers to inject arbitrary JavaScript by manipulating the eid, n, or t parameters in the /account.php?q=quiz endpoint. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms unauthenticated remote exploitation requiring only passive victim interaction, consistent with a reflected XSS delivery via crafted link. A proof-of-concept exploit is publicly available on GitHub; this CVE is not listed in the CISA KEV catalog, so no confirmed active exploitation has been identified at time of analysis.

Stored cross-site scripting in Pluck CMS 4.7.21 and earlier allows an authenticated administrator to inject persistent malicious scripts via the Info argument of the Albums module, which subsequently execute in the browsers of users who view the affected content. The flaw originates from misuse of htmlspecialchars_decode in albums.admin.php, which reverses HTML entity encoding on attacker-controlled input rather than sanitizing it, allowing script payloads to survive into rendered HTML. A public proof-of-concept exploit exists on GitHub and no vendor patch has been released; the maintainer has not responded to the disclosure.

Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged remote attacker to inject arbitrary JavaScript via the `course` parameter of `/forCYS.php`, executing malicious code in the browser of any user who views the manipulated output. A public proof-of-concept exploit is available on GitHub (referenced via VulDB entry 380019), raising the practical risk above theoretical for any exposed instance. No active exploitation has been confirmed by CISA KEV, and the CVSS 4.0 score of 5.1 (Medium) reflects the authenticated and user-interaction requirements that limit widespread opportunistic abuse.

Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `course` argument in `/CYS.php`, which executes in the context of a victim user's browser upon interaction. A publicly available exploit exists, disclosed via a GitHub issue, confirming the vulnerability is reproducible. No active exploitation has been confirmed by CISA KEV, but the low attack complexity and available proof-of-concept increase opportunistic risk.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows a low-privileged authenticated attacker to inject malicious JavaScript via the `day` parameter of `/forexam.php`, which executes in a victim user's browser upon viewing the affected page. A public exploit proof-of-concept is available on GitHub, lowering the bar for exploitation. No patch has been identified at time of analysis; no public exploit identified at time of analysis in terms of KEV listing, though exploit code exists publicly.

Cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript into the browsers of other users by manipulating the `sy` parameter in `/schoolyr.php`. The vulnerability is a stored or reflected XSS (CWE-79) in a PHP-based academic scheduling application. A publicly available exploit exists on GitHub, though no active exploitation has been confirmed by CISA KEV, and the low CVSS 4.0 score of 2.0 reflects the limited real-world impact constrained by authentication requirements and required user interaction.

Stored cross-site scripting in parisneo/lollms (latest) lets any authenticated user weaponize the POST /api/prompts/share endpoint to plant JavaScript in another user's direct-message inbox. The unsanitized prompt_content is persisted to DBDirectMessage.content and later rendered via v-html by MessageContentRenderer, so when the victim opens the DM thread the payload executes in their browser context, enabling actions-as-victim, same-origin data theft, and potential account takeover. No public exploit identified at time of analysis and no EPSS/KEV signal is provided, but the reproduction path is well-documented in the huntr bounty report.

Reflected XSS in the Flow Payment WordPress plugin version 3.0.8 allows unauthenticated attackers to execute arbitrary JavaScript in a victim's browser by embedding a payload in the error_message GET parameter of the WooCommerce order cancellation URL. The plugin's cancellation handler in flowpayment-fl.php passes this parameter directly to wc_add_notice() without sanitization or output escaping, rendering attacker-controlled content as HTML in the checkout page. No public exploit code has been identified at time of analysis, but the attack is trivially constructable from the fully disclosed parameter name and code path published in the VulnCheck advisory.

Mutation XSS (mXSS) in AngleSharp versions before 1.5.0 allows sanitizer bypass through two compounding parser flaws: the MathML annotation-xml element never receives the HtmlTip flag, causing the parser to diverge from browser behavior, and the HTML serializer emits unescaped angle brackets in attribute values. Applications using AngleSharp as an HTML sanitizer before browser rendering are vulnerable - the sanitizer inspects a benign DOM while the serialized output re-parses in browsers with live XSS payloads active. A detailed public proof-of-concept is included in the upstream advisory (GHSA-pgww-w46g-26qg); no confirmed active exploitation (CISA KEV) has been identified at time of analysis.

Cross-site scripting in AstrBotDevs AstrBot up to version 4.25.2 allows authenticated remote attackers to inject and execute malicious scripts via the Text-to-Image (T2I) feature, specifically through the `Star.text_to_image` and `NetworkRenderStrategy.render` functions in `astrbot/core/star/base.py`. A public proof-of-concept exploit is available on GitHub, and the vendor did not respond to responsible disclosure, meaning no official patch exists at time of analysis. No public exploit identified at time of analysis as actively exploited (not in CISA KEV), but the public POC materially lowers the exploitation bar.

HCL DevOps Loop omits critical HTTP security response headers, degrading browser-enforced protections against clickjacking, MIME-type sniffing, and cross-site scripting for all users of the application. The absence of headers such as Content-Security-Policy, X-Frame-Options, and X-Content-Type-Options does not introduce a standalone exploit path but removes a layer of defense-in-depth that browsers rely on to block client-side attack chains. CVSS assigns a low score of 3.7 with high attack complexity, reflecting that meaningful impact requires chaining this weakness with a secondary technique; no public exploit has been identified and the vulnerability is not listed in CISA KEV.

Stored Cross-Site Scripting in the NEX-Forms WordPress plugin before version 9.2.3 allows unauthenticated remote attackers to inject persistent malicious scripts into the admin dashboard by submitting crafted form data that is stored without sanitization and rendered without output escaping. When an administrator views the submitted entries panel, the stored payload executes in their browser, enabling session hijacking or secondary site takeover actions. A public proof-of-concept is available via WPScan, though EPSS data (0.24%, 14th percentile) and the SSVC Automatable:no classification indicate targeted rather than mass-automated exploitation at this time.

Reflected Cross-Site Scripting in the WP Hotel Booking WordPress plugin (ThimPress) through version 2.3.2 enables unauthenticated network attackers to inject arbitrary JavaScript into hotel booking archive pages via the unsanitized `check_in_date` parameter. When a victim clicks a crafted URL, the payload executes in their browser under the WordPress site's origin — enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim, including against administrator accounts. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV; however, the CVSS scope-change metric (S:C) elevates the base score to 6.1 by reflecting cross-context browser impact.

Stored Cross-Site Scripting in the Ninja Forms Excel Export WordPress plugin (versions ≤ 3.3.6) allows authenticated attackers with subscriber-level access to inject persistent malicious scripts into the admin Excel Export screen. The dual root cause is a missing capability check and nonce verification in the save_filter() AJAX handler - enabling any authenticated user to write arbitrary filter data to WordPress options - combined with unescaped concatenation of that data into HTML attributes in get_filter_row(). When administrative users subsequently visit the Excel Export admin page, the stored payload executes in their browser, enabling session hijack, credential theft, or further privilege escalation. No public exploit code or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the ChatHelp plugin for WordPress (versions through 3.5.1) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'number' and 'group' shortcode attributes, which execute in victims' browsers on page load. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode rendering layer, identified across multiple source files in CustomButtonsTemplates.php and CustomShortcode.php. No public exploit code has been identified at time of analysis, and the plugin is not listed in CISA KEV; however, Wordfence has published a threat intelligence entry and a patch changeset exists in the WordPress plugin repository.

Reflected Cross-Site Scripting in the WooCommerce PlacetoPay Gateway family of plugins (all regional Evertec variants) allows unauthenticated network-based attackers to inject and execute arbitrary JavaScript in victims' browsers by abusing the unsanitized 'redirect-url' parameter - confirmed in versions up to and including 3.2.2 across at least six regional plugin variants (Colombia, Ecuador, Honduras, Uruguay, Belice, and base). Exploitation requires the attacker to socially engineer a victim into clicking a crafted link; no patch version has been identified in the available data, as the most recent release (3.2.2, dated 2026-04-22) addresses only a tax-validation issue and not this XSS. No public exploit code or CISA KEV listing identified at time of analysis.

Stored cross-site scripting in the Smart Custom Fields WordPress plugin (versions up to and including 5.0.7) enables authenticated attackers holding at minimum Author-level access to persist malicious JavaScript payloads by supplying unsanitized content in uploaded image attachment titles. Any site visitor who subsequently loads an affected page triggers execution of the injected script within their browser, enabling session hijacking, credential harvesting, or unauthorized actions on behalf of that user. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis; however, the vulnerability is partially unresolved even in the stated boundary version 5.0.7, making the precise remediation target unclear without consulting the referenced patch changesets.

Cross-site scripting in Proxmox Virtual Environment (PVE) 8.x and 9.x allows an unauthenticated remote attacker to inject and execute arbitrary JavaScript in the browser of an authenticated PVE user who interacts with a crafted payload. The CVSS scope change (S:C) confirms the injected script executes outside the originating component's security context, enabling session hijacking, credential theft, or unauthorized management actions against the hypervisor web UI. SSVC classifies exploitation status as none with no automation possible, and no active exploitation or public exploit code has been identified at time of analysis.

Stored or reflected cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to inject malicious script content that executes in a victim's browser, enabling spoofing attacks over a network. Affected deployments span SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition. No public exploit code or active CISA KEV listing has been identified; the CVSS 4.6 Medium rating reflects the dual prerequisites of authentication and victim interaction, which materially constrain real-world exploitability.

Cross-site scripting in Microsoft Windows Admin Center enables network-based spoofing attacks against users who interact with attacker-controlled content. The CVSS vector (AV:N/PR:N/UI:R/S:C) confirms that an unauthenticated remote attacker can deliver a crafted payload that executes in the victim's browser context once user interaction occurs, enabling session hijacking or administrative action spoofing within the management interface. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available via the Microsoft Security Response Center.

Stored cross-site scripting in Perfect Support Ticketing & Document Management System through version 1.7 allows authenticated Agent-level users to inject persistent malicious scripts into ticket Notes fields. Any user who subsequently views the compromised ticket notes - including Superadmin users - executes the attacker's payload in their browser context, enabling session token theft and unauthorized actions performed on the victim's behalf. No public exploit identified at time of analysis for KEV listing, though a publicly available proof-of-concept exists per VulnCheck and the researcher's GitHub repository.

Stored Cross-Site Scripting in the SysBasics Customize My Account for WooCommerce plugin (all versions through 4.4.14) allows authenticated shop managers to persist malicious scripts via the unsanitized 'row_type' parameter, executing in any user's browser upon visiting the compromised My Account page. The CVSS scope change (S:C) confirms cross-user impact - injected scripts run in victim sessions, enabling session hijacking or credential theft beyond the attacker's own context. No public exploit code or CISA KEV listing is confirmed at time of analysis; risk is substantially gated by the shop manager privilege requirement.

Stored Cross-Site Scripting in the wpForo Forum WordPress plugin (all versions through 3.1.1) allows authenticated attackers with subscriber-level access to permanently inject malicious JavaScript via the 'location' profile field. The root failure is WordPress's native sanitize_text_field() function, which strips tags but leaves double quotes unencoded, enabling attribute breakout from an href context into injected event-handler attributes. With a CVSS scope change (S:C), successful exploitation can impact sessions of any user - including administrators - who views a poisoned profile page, enabling session hijacking or privilege escalation. No public exploit or CISA KEV listing has been identified at time of analysis.

Stored Cross-Site Scripting in the Tickera - Sell Tickets & Manage Events WordPress plugin (all versions through 3.6.0.0) allows authenticated contributors to inject persistent malicious scripts via the price_wrapper shortcode attribute, due to missing sanitization and output escaping in class.shortcodes.php. A compromised or malicious contributor account can plant the payload in any page or post, where it executes against visiting victims - but only those who carry the referenced ticket ID in their cart cookie, materially narrowing the realistic victim pool. No active exploitation has been confirmed in CISA KEV, and no EPSS data was provided in the intelligence feed.

Stored cross-site scripting in the WP Delicious (formerly Delicious Recipes) WordPress plugin versions up to and including 1.10.2 allows authenticated Contributor-level users to inject arbitrary JavaScript via unsanitized `javascript:` URIs embedded in recipe step link attributes. The `wrap_direction_text()` function interpolates attacker-controlled `href` values directly into anchor tags using `sprintf()` without invoking WordPress's `esc_url()`, enabling payload execution in the browser of any privileged user who clicks the poisoned link while previewing or viewing the affected recipe post. No CISA KEV listing or public exploit code has been identified at time of analysis, though Wordfence's source-level disclosure provides sufficient detail for independent reproduction.

Stored cross-site scripting in the Header Footer Builder for Elementor WordPress plugin before 1.2.1 permits any Contributor-level user to inject persistent JavaScript into every page of the affected site by importing a crafted template through the plugin's dashboard action, which incorrectly requires only edit_posts capability rather than administrator access. Once the malicious Elementor HTML widget is imported with site-wide display scope, the payload executes in the browser of every visitor and administrator who loads the site - enabling session hijacking, credential theft, or admin account takeover. A publicly available exploit exists per WPScan (EUVD-2026-44878); no CISA KEV listing at time of analysis.

Stored cross-site scripting via prompt injection in the BetterDocs WordPress plugin (versions 4.0.0 through 4.5.5) allows unauthenticated attackers to permanently implant malicious JavaScript into documentation pages by manipulating the plugin's AI-generated summary feature. Because the AI output is stored unsanitized and the generation endpoint requires no authentication, an attacker can craft adversarial prompts that cause the AI to produce and persist executable script payloads - payloads that then fire in the browser of every subsequent visitor, including WordPress administrators. A publicly available exploit exists via WPScan; no active exploitation confirmed in CISA KEV at time of analysis.

Reflected Cross-Site Scripting in the Product Feed Manager For WooCommerce WordPress plugin (all versions through 7.6.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unescaped 's' search parameter, which executes in a victim's browser upon interaction with a crafted link. The vulnerability is rooted in insufficient sanitization and output escaping within the plugin's admin-facing PHP classes, as confirmed by Wordfence with direct source code references to class-rex-product-feed-actions.php and class-rex-product-feed.php. No public exploit code has been identified at time of analysis, and this CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog.

Stored Cross-Site Scripting in the Easy Accordion - AI-Powered FAQ & Accordion Blocks, Product FAQ plugin (all versions ≤ 3.1.6) enables authenticated attackers holding contributor-level WordPress roles to inject persistent JavaScript payloads via the unsanitized 'align' block attribute. The injected script executes in the browser of any user - including administrators - who views the affected page, making session hijacking and privilege escalation realistic follow-on impacts. No public exploit code or CISA KEV listing has been identified at time of analysis, but Wordfence source code references pinpoint the exact vulnerable lines, substantially lowering the barrier to exploitation.

Stored XSS in GiveWP's Sequoia donation template allows authenticated attackers with give worker-level access to inject persistent JavaScript payloads via the 'twitter_message' template setting, affecting all WordPress installations running plugin versions through 4.16.3. The injected payload is not sanitized before being embedded inside a JavaScript template literal in the Sequoia confirmation view's social-sharing component, and executes in the donor's browser specifically when they click the 'Share on Twitter' button after completing a donation. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog; however, the Wordfence disclosure includes direct source code references confirming the unsanitized evaluation path.

Stored Cross-Site Scripting in the MxChat AI Chatbot & Content Generation WordPress plugin (versions up to and including 3.2.10) enables authenticated administrators to persist malicious scripts through admin settings panels. Exploitation is constrained to WordPress multi-site environments or single-site installs where the unfiltered_html capability has been explicitly disabled, narrowing the realistic attack surface significantly. No public exploit code or active exploitation (CISA KEV) has been identified; CVSS 4.4 Medium reflects the restricted conditions and high privilege requirement.

Frameable content on the Absolute Secure Access server login page (versions prior to 14.55) enables clickjacking attacks that can result in administrator credential theft. An attacker who controls a malicious website can embed the login page in a hidden iframe, luring an unwitting administrator to unknowingly submit their credentials into the framed interface. No public exploit has been identified at time of analysis, and the CVSS 4.0 vector indicates active user interaction is required, limiting opportunistic exploitation.

Stored cross-site scripting in DataEase's template static resource pipeline allows authenticated users to persist malicious JavaScript inside SVG files served at the application's same origin, executing in victims' browsers upon resource access. Versions prior to 2.10.23 are affected; the root cause is that StaticResourceServer.saveFilesToServe and saveSingleFileToServe decoded attacker-supplied Base64 content and wrote it directly to disk without validating extension, MIME type, decoded bytes, or SVG scriptability. No public exploit code or CISA KEV listing exists at time of analysis, but the stored, same-origin nature of the XSS and the low bar for triggering it (any authenticated user) make this a meaningful risk in shared or multi-tenant DataEase deployments.

Stored XSS via unsanitized `javascript:` URI injection in the Dashy RSS Feed widget (src/components/Widgets/RssFeed.vue) affects all releases from 1.9.4 through 3.1.x, allowing an attacker who controls an RSS feed source configured in the dashboard to deliver a malicious anchor href that executes arbitrary JavaScript in the Dashy origin when a user clicks it. The attack requires both feed-source control and user interaction, and is confined to the Dashy application origin - meaning session tokens, cookies, or dashboard credentials are the primary targets. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; a vendor-released patch is available in version 3.2.0.

Reflected cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged attacker holding a developer role to inject malicious scripts into a user interface component, which execute in a victim's browser upon interaction. The CVSS 4.0 score of 4.8 (Medium) reflects meaningful constraints: exploitation requires both developer-level authentication and a victim's active interaction with a crafted link or payload. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Stored cross-site scripting in Pega Platform (Pega Infinity) versions 8.1.0 through 25.1.2 allows a high-privileged developer-role user to inject persistent malicious scripts into a UI component, which execute in the browser context of other users who interact with the affected interface. The CVSS 4.0 score of 4.6 (Medium) reflects the constrained impact - limited confidentiality and integrity exposure with no availability impact - consistent with the PR:H and UI:A prerequisites that substantially reduce real-world risk. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Reflected cross-site scripting in HCL Notes 12.0.2FP5HF8 enables unauthenticated network attackers to inject and execute arbitrary JavaScript in the browser sessions of targeted users who interact with malicious links. The CVSS 4.0 vector (SC:H/SI:H/SA:H) signals high downstream impact on victim sessions - including potential session hijacking, credential theft, and unauthorized action execution within the Notes web environment. No public exploit code has been identified and this vulnerability is not listed in CISA KEV at time of analysis.

Stored cross-site scripting in Stirling-PDF's /get-info-on-pdf endpoint allows attacker-controlled JavaScript to execute in any user's browser when they view metadata of a crafted PDF file. All versions prior to 2.0.0 are affected; the CVSS scope change (S:C) indicates injected scripts operate within the application's browser origin, enabling session hijacking or unauthorized actions. No public exploit code has been identified at time of analysis and this vulnerability has not been listed in CISA KEV.

Stored or reflected cross-site scripting in Fortinet FortiSIEM's web interface enables a high-privileged authenticated attacker to inject malicious script tags that execute in the browsers of other users who view the affected page. The vulnerability spans a wide version range from FortiSIEM 6.4 through 7.4.0, affecting all deployments of this enterprise SIEM platform. No active exploitation has been confirmed by CISA KEV, and no public exploit code is identified at time of analysis; the PR:H requirement meaningfully constrains real-world attacker opportunity despite the scope change to the victim's browser context.

Stored cross-site scripting (XSS) in Grav CMS 2.0.0 allows authenticated attackers with page-write API permission to inject JavaScript payloads that execute in visitors' browsers. The vulnerability arises when Twig content processing is enabled, leveraging Twig's string concatenation operator to bypass the XSS validator. Patched in version 2.0.1; proof-of-concept code is available but no known active exploitation.

Reflected Cross-Site Scripting in xxl-job-admin v.3.0.0 allows a remote unauthenticated attacker to execute arbitrary JavaScript in a victim's browser by tricking an authenticated user into clicking a crafted HTTP GET request containing an unsanitized malicious script payload. The vulnerability carries a CVSS 3.1 score of 6.1 with Scope Changed, indicating the injected script can affect browser-level resources beyond the immediate application context, enabling session hijacking, credential theft, or redirection against admin-level users. No public exploit identified at time of analysis in CISA KEV, though a public PoC repository exists and the EPSS score sits at the 31st percentile, indicating modest but non-trivial exploitation interest.

HTML injection in jadx-gui prior to version 1.5.6 enables a malicious APK to force arbitrary HTML rendering inside the Summary tab, allowing out-of-band network requests that disclose the analyst's IP address or interact with locally exposed services. The injection point is SummaryNode.java, which inserts attacker-controlled .so file path components from APK ZIP entries directly into an HTML panel without escaping. Publicly available exploit code exists per SSVC assessment, though the attack is non-automatable and constrained to interactive local use, consistent with the low CVSS score of 3.6 and an EPSS probability of just 0.14%.

Stored Cross-Site Scripting in Adobe Commerce, Adobe Commerce B2B, Magento Open Source, and the Adobe Commerce Webhooks Plugin allows a high-privileged attacker to inject persistent malicious JavaScript into vulnerable admin form fields, which then executes in any victim's browser that navigates to the affected page. Scope change (S:C) is confirmed in the CVSS vector, meaning the injected payload crosses from the Commerce application security boundary into the victim's browser session, enabling session hijacking or credential harvesting. Despite no current KEV listing, the EPSS score sits at the 96th percentile (11.52%), warranting close monitoring even though CISA SSVC currently rates exploitation as none and the attack is not assessed as automatable.

Stored XSS in Adobe Commerce, Magento Open Source, Adobe Commerce B2B, and the Commerce Webhooks Plugin enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, executing in victims' browsers upon page load. Affected versions span Adobe Commerce through 2.4.9/p-series, Magento Open Source through 2.4.9, B2B through 1.5.3, and Webhooks Plugin through 1.20.0. The CVSS scope change (S:C) indicates the injected script can operate beyond the originating application's security context, raising the practical impact when higher-privileged users such as store administrators visit the compromised page. No public exploit has been identified at time of analysis and CISA has not listed this in KEV.

Stored Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browser of any user who visits the affected page. All three deployment variants are affected - AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - with patches released under Adobe advisory APSB26-74. No public exploit code or active exploitation has been identified; EPSS sits at 0.29% (21st percentile) and SSVC confirms exploitation status as none, placing this in a patch-on-schedule rather than emergency-response posture.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to inject and execute malicious JavaScript within a victim's browser by manipulating DOM-writable sinks in the AEM interface. Affected deployments span AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 (≤6.5.24). No active exploitation has been identified - EPSS sits at 0.27% (19th percentile), CISA SSVC assigns exploitation status of 'none' and automatable 'no', and the vulnerability is absent from the CISA KEV catalog, collectively indicating low current threat momentum despite the scope-change component.

Stored Cross-Site Scripting in Adobe Experience Manager enables a low-privileged authenticated attacker to inject persistent malicious JavaScript into vulnerable form fields, which then executes in the browsers of any users who view the affected content - including administrators. Affected deployments span AEM as a Cloud Service through 2026.5.0, AEM 6.5 through 6.5.24, and AEM 6.5 LTS through SP1. No public exploit identified at time of analysis; EPSS stands at 0.29% (21st percentile) and SSVC confirms no active exploitation, placing this in the medium-priority tier despite the scope-changed CVSS scoring.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to manipulate client-side DOM sources and execute arbitrary JavaScript within an authenticated victim's browser session. All three supported deployment tracks are affected: AEM as a Cloud Service (≤2026.5.0), AEM 6.5 LTS (≤SP1), and AEM 6.5 on-premises (≤6.5.24). No public exploit has been identified and SSVC classifies exploitation status as none, but patches are available across all affected tracks per Adobe advisory APSB26-74.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows authenticated network-accessible attackers to inject and execute arbitrary JavaScript within an authenticated victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. All three AEM product tracks are affected: Cloud Service through 2026.5.0, the classic 6.5 series through 6.5.24, and 6.5 LTS through SP1. The CVSS scope change (S:C) reflects that execution escapes the vulnerable component into the victim's broader browser session, enabling session token theft or unauthorized AEM actions on the victim's behalf; however, no public exploit code has been identified at time of analysis and SSVC confirms no in-the-wild exploitation.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated remote attacker to execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates client-side DOM sources, contingent on the victim clicking the link. All three AEM product lines are affected - AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through the 2026.5.0 release - with vendor-confirmed patches now available per advisory APSB26-74. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), consistent with SSVC's assessment of no current exploitation and non-automatable attack delivery.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged authenticated attacker to inject and execute arbitrary JavaScript within a victim's browser by delivering a crafted URL that manipulates the client-side DOM environment. Affected deployments span AEM 6.5 (≤6.5.24), AEM 6.5 LTS (≤SP1), and AEM as a Cloud Service (≤2026.5.0) - three distinct product lines with broad enterprise reach. No active exploitation is confirmed (absent from CISA KEV), and the EPSS score of 0.27% at the 19th percentile alongside an SSVC exploitation status of 'none' indicate low near-term threat activity, though patching remains warranted given the changed-scope impact.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows an authenticated attacker to inject and execute malicious JavaScript within an authenticated victim's browser session by manipulating client-side DOM data flows. Three product lines are confirmed affected: AEM 6.5 (through 6.5.24), AEM 6.5 LTS (through SP1), and AEM as a Cloud Service (through 2026.5.0), with patched releases available per Adobe APSB26-74. No public exploit has been identified at time of analysis; EPSS at 0.27% (19th percentile) and SSVC 'Exploitation: none' collectively indicate low current exploitation pressure, though the confirmed scope change (S:C) elevates potential browser-level impact beyond the AEM application boundary.

DOM-based Cross-Site Scripting in Adobe Experience Manager allows a low-privileged network attacker to execute malicious JavaScript in a victim's authenticated browser session, affecting AEM 6.5 through 6.5.24, AEM 6.5 LTS through SP1, and AEM as a Cloud Service through 2026.5.0. The changed-scope designation (S:C) in the CVSS 3.1 vector indicates that a successful exploit can affect resources beyond the originating AEM page context, enabling session hijacking or unauthorized content manipulation. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is 0.27% (19th percentile), consistent with the SSVC assessment of no active exploitation and a non-automatable attack path.

Reflected cross-site scripting in SourceCodester Class and Exam Timetabling System 1.0 allows remote unauthenticated attackers to inject arbitrary JavaScript into the browsers of users who interact with a crafted URL targeting the `day` parameter of /exam.php. A publicly available proof-of-concept exploit exists on GitHub (AlbaDove/cve issue #7), confirming exploitability, though no active exploitation has been confirmed in CISA KEV. The CVSS 4.0 base score of 2.1 and EPSS of 0.36% (28th percentile) together indicate low real-world exploitation probability, consistent with SSVC's finding that the attack is not automatable and technical impact is only partial.

Stored XSS in FacturaScripts (<= 2026.1) allows an authenticated attacker to execute arbitrary JavaScript in any victim's browser via the variant-picker or subaccount-picker modals. The flaw exists in `WidgetVariante::renderVariantList` and `WidgetSubcuenta::renderSubaccountList`, which embed `Tools::noHtml`-encoded field values directly into JavaScript string literals inside HTML `onclick` attributes - a pattern the browser defeats by HTML-decoding attribute values before the script engine parses them, converting `&#39;` back to a literal apostrophe. A publicly confirmed proof-of-concept was verified on 2026-05-01; no patch has been released. This is a missed instance of the same anti-pattern corrected in three sister classes by commits `40bc701` and `8586b97`.

Cross-site scripting in Microsoft Visual Studio Code lets an attacker who tricks a local user into opening crafted content bypass a built-in security feature and gain high-impact code execution within the editor context. The flaw (CWE-79) carries a CVSS 3.1 base score of 7.1 with a local attack vector requiring user interaction, and Microsoft has published an advisory with a fix. There is no public exploit identified at time of analysis and the CVE is not listed in CISA KEV.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables authenticated network attackers to inject malicious scripts that execute in victims' browsers, enabling spoofing, session hijacking, or unauthorized actions on behalf of targeted users. The CWE-79 flaw requires victim interaction (UI:R) and low-privilege attacker credentials (PR:L), but the changed scope (S:C) means impact extends beyond the SharePoint server into the victim's browser session. No public exploit identified at time of analysis; EPSS of 0.28% (20th percentile) and SSVC exploitation rating of 'none' indicate low immediate threat despite broad enterprise deployment.

Stored/reflected cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an authenticated attacker inject script that executes in another user's browser session to spoof content over the network. Although Microsoft classifies the impact as 'spoofing,' the CVSS 3.1 vector rates confidentiality and integrity as High (C:H/I:H), indicating the injected script can access or alter sensitive session data. There is no public exploit identified at time of analysis, and a vendor patch is available.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated network attacker to inject malicious scripts into SharePoint pages, causing spoofing against users who view the affected content. The vulnerability carries a CVSS 5.4 (Medium) score with an EPSS of 0.38% (30th percentile), indicating low current exploitation probability. No public exploit code has been identified and the vulnerability is absent from the CISA KEV catalog; a vendor-released patch is available via the Microsoft Security Response Center.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, SharePoint Server 2019, and SharePoint Server Subscription Edition enables an authenticated attacker with low-privilege network access to inject malicious scripts into SharePoint pages, resulting in spoofing impacts when a victim user interacts with the crafted content. The CVSS vector (PR:L/UI:R) confirms exploitation requires both an existing authenticated account and victim interaction, constraining real-world risk relative to unauthenticated XSS variants. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog. Vendor patch is available via the Microsoft Security Response Center.

Cross-site scripting in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to inject malicious JavaScript into SharePoint-rendered pages, which then executes in the browsers of other users who view the content, enabling spoofing and session-context abuse. The CVSS PR:L requirement confirms unauthenticated exploitation is not possible, and the UI:R requirement means the attack depends on victim interaction. No public exploit code has been identified, SSVC rates exploitation as none with partial technical impact, and the EPSS score of 0.38% (30th percentile) indicates low near-term exploitation probability.

Cross-site scripting in Microsoft SharePoint Enterprise Server 2016, Server 2019, and Server Subscription Edition enables an authenticated attacker to inject malicious scripts into SharePoint-generated web pages viewed by other users, producing a spoofing effect. The scope-changed CVSS vector (S:C) confirms that impact escapes the server component and reaches victim browsers. No active exploitation is confirmed - EPSS sits at 0.28% (20th percentile) and CISA has not added this to KEV - placing real-world urgency below the raw CVSS 5.4 might suggest.

Cross-site scripting in Active Directory Federation Services (AD FS) on Windows Server 2012 through 2025 enables an authorized, high-privileged attacker to inject malicious scripts into AD FS web pages, producing spoofing effects against users who interact with the affected portal. The CVSS vector (PR:H, UI:R, S:C) confirms this is a post-compromise capability requiring admin-level access and victim interaction, not an unauthenticated initial access vector. No active exploitation is confirmed - SSVC rates exploitation as 'none', EPSS sits at 0.38% (30th percentile), and the vulnerability is absent from CISA KEV - placing this firmly in the low-urgency category despite network reachability of the AD FS web interface.

Cross-site scripting (CWE-79) in Microsoft Power BI Report Server lets an authenticated, low-privileged attacker inject script that executes in another user's browser session, enabling spoofing of report content and hijacking of the victim's authenticated context over the network. Exploitation requires a victim to interact with attacker-controlled report content (UI:R). There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; a vendor patch is available per the MSRC advisory.

Stored cross-site scripting in Hi.Events through v1.10.0-beta allows authenticated event organizers to inject arbitrary JavaScript into public event pages by embedding the raw </script> sequence in an event title, which the application's JSON.stringify() serialization fails to encode safely when placed in inline script contexts. The payload executes in the browser of every visitor to the affected event page - including unauthenticated attendees and authenticated administrators - enabling session hijacking and privilege escalation from a low-privileged creator account. No public exploit has been identified at time of analysis; a vendor-released patch is available in v1.11.0-beta.

Reflected or stored cross-site scripting in Fortinet FortiOS, FortiPAM, and FortiProxy web interfaces allows a remote unauthenticated attacker to execute JavaScript in the browser session of an authenticated administrator via crafted HTTP requests. The CVSS temporal metric E:P confirms publicly available proof-of-concept exploit code exists, and the RL:O metric confirms Fortinet has released an official fix. No active exploitation has been confirmed by CISA KEV at time of analysis, but the combination of a POC and the high-value targets (network security appliances and privileged access management systems) elevates real-world risk beyond what the base CVSS score of 6.1 suggests.

Stored XSS in Easy!Appointments versions prior to 1.6.0 allows an authenticated administrator to inject arbitrary HTML or JavaScript into the 'booking disabled' message field via the booking settings rich-text editor. The unsanitized value is rendered directly to every unauthenticated visitor who opens the public booking page while booking is disabled, crossing a scope boundary from admin context to anonymous public users. No public exploit has been identified at time of analysis; CVSS rates this 2.6 (Low) driven by the administrator-level privilege requirement, though the persistent cross-scope impact on all public visitors is a meaningful secondary risk factor.