Cross-Site Scripting

Unauthenticated cross-site scripting in Quill Forms WordPress plugin version 5.7.1 and earlier allows remote attackers without any credentials to inject malicious scripts into pages rendered by the plugin. Because the CVSS vector indicates a scope change (S:C), successful exploitation can affect the browser session of authenticated users - including site administrators - who view attacker-controlled content. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Clickjacking in Mozilla Firefox's Widget component enables a remote unauthenticated attacker to trick users into triggering high-impact unintended browser actions through overlaid UI deception. All Firefox desktop releases prior to version 154 - and all ESR releases prior to 153.1 - are affected across platforms per CPE cpe:2.3:a:mozilla:firefox:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the low attack complexity and zero authentication requirement make this a credible risk for any organization deploying Firefox at scale.

Information disclosure via the WebRTC component in Mozilla Firefox allows network-accessible attackers to exfiltrate sensitive browser data due to improper restriction of rendered UI layers (CWE-1021). All Firefox releases prior to version 154 and all Firefox ESR releases prior to version 153.1 are affected across all platforms listed under CPE cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*. The CVSS base score is 7.5 with high confidentiality impact; SSVC confirms automatable exploitation, though no active exploitation has been confirmed in CISA KEV and no public exploit code has been identified at time of analysis.

Persistent XSS in Zabbix Maps is triggered by prototype pollution in the searchParamsToObject() function, which processes URL query parameters without filtering reserved JavaScript properties such as __proto__. An authenticated low-privilege attacker can craft a malicious URL that pollutes Object.prototype; when a victim user views the Maps page, jQuery's unsafe DOM element creation traverses the poisoned prototype chain and executes the attacker-controlled payload in the victim's browser session. No public exploit code and no CISA KEV entry have been identified at time of analysis, but the vulnerability class is well-understood and reproducible by intermediate-level attackers.

Stored cross-site scripting in Grav CMS before 2.0.15 lets authenticated editors smuggle JavaScript event handlers past the detectXss() sanitizer, which fails to flag event handlers (e.g. onerror=) placed in unquoted HTML attribute values containing unpaired quotes. The malicious payload is persisted in page content and executes in the browser of any visitor who later renders that page. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; no public exploit identified at time of analysis and not listed in CISA KEV.

Cross-site scripting escalating to full remote code execution in SiYuan, an Electron-based personal knowledge-management and note-taking application, affects all releases before v3.7.4. The file-upload validation flow inserts unescaped filenames into the DOM via insertAdjacentHTML, so a filename carrying a script payload runs in the privileged renderer and reaches OS command execution when a victim drags, drops, or pastes the file into the editor. Reported by VulnCheck and fixed in v3.7.4; no public exploit identified at time of analysis.

Stored cross-site scripting in SpiderFoot (smicallef) lets attacker-controlled reconnaissance data execute JavaScript in an operator's browser. Because correlation titles are assembled from external scan inputs such as server banners and service metadata without HTML-escaping, an attacker who controls a scanned target can persist an HTML event-handler payload that fires when the operator opens the correlations view, enabling theft of stored API keys and session-context actions. No public exploit identified at time of analysis; the flaw was reported by VulnCheck and is not listed in CISA KEV.

Cross-site scripting in Velociraptor's web GUI arises from unsanitized URL scheme handling in URL-typed table columns, enabling a high-privileged attacker to inject javascript: URIs that execute when a second user clicks the crafted link in the console. The scope change (S:C) in the CVSS vector confirms the XSS crosses the application's security boundary into the victim's browser session, exposing session tokens and permitting authenticated actions on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the C:H/I:H impact scores reflect meaningful credential theft and session hijacking potential within the Velociraptor investigation console.

Stored Cross-Site Scripting in the Quill Forms WordPress plugin (all versions through 5.7.1) enables unauthenticated attackers to permanently inject arbitrary JavaScript into pages rendered by the plugin. The CVSS vector (PR:N, S:C) confirms no authentication is needed to plant the payload, and the scope change indicates injected scripts execute in victims' browser sessions - enabling session hijacking, credential theft, or admin account takeover when privileged users view affected pages. Reported by Wordfence and corroborated by Patchstack; no public exploit code or CISA KEV listing has been identified at time of analysis.

Stored cross-site scripting in Pandora's URL observable rendering allows network-reachable attackers to inject arbitrary JavaScript that executes in the context of an authenticated victim's Pandora session when they interact with the Submit to Lookyloo control. The root cause is a JavaScript string injection context mismatch: attacker-controlled URLs extracted from submitted files were interpolated directly into inline onclick handlers, where the template engine's HTML entity encoding provides no protection. Successful exploitation enables session hijacking or unauthorized actions on behalf of the victim; no public exploit has been identified at time of analysis.

Stored cross-site scripting in Stirling-PDF prior to version 2.0.0 allows an attacker to embed JavaScript payloads inside PDF metadata fields (Title or Author) that execute in a victim's browser session when the user triggers the 'Get Info' workflow. The vulnerable template at get-info-on-pdf.html injects unsanitized metadata directly into the DOM via innerHTML, enabling session token theft and arbitrary page content manipulation against any user who processes a crafted PDF on a shared instance. No public exploit has been identified at time of analysis, and the vendor has shipped a complete fix in the major v2.0.0 release.

Stored cross-site scripting in JetBrains YouTrack before 2026.2.18068 allows remote attackers to persist malicious script payloads via the language label field of fenced code blocks in issues or comments. When any authenticated user views the affected content, the injected script executes within the YouTrack application origin - a scope change that enables session token theft, credential harvesting, or unauthorized actions on behalf of the victim (CVSS C:H). No public exploit code has been identified at time of analysis, but the low-complexity network vector makes this straightforward to weaponize once a reporter or contributor role is obtained.

Stored/reflected cross-site scripting in Discourse before 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 lets an unauthenticated attacker execute arbitrary JavaScript in a visitor's browser by supplying a crafted color_scheme_id or dark_scheme_id cookie. Because the cookie is rendered into a color-scheme tag without HTML escaping, an attacker can break out of the attribute context and inject markup that defeats Discourse's nonce-based Content Security Policy. A vendor patch exists and the flaw carries a critical CVSS of 9.3, but no public exploit has been identified at time of analysis and it is not listed in CISA KEV.

Cross-site scripting (XSS) in OpenText Directory Services through version 22.2 allows network-based unauthenticated attackers to inject malicious scripts that execute in victims' browsers, yielding high confidentiality and integrity impact against the vulnerable system. A proof-of-concept exploit exists per the CVSS 4.0 E:P modifier, though this CVE does not appear in the CISA KEV catalog and user interaction is required to trigger the flaw. Because directory services platforms manage authentication credentials and identity data, successful exploitation can enable session hijacking or account takeover with downstream access implications across integrated systems.

Roundcube Webmail's built-in CSS proxy failed to validate responses from external CSS sources, enabling XSS or information disclosure via browser MIME sniffing in versions before 1.6.18 and 1.7.x before 1.7.3. The CVSS 3.1 score of 7.2 with Changed scope reflects that successful exploitation compromises the victim's browser session within the webmail origin. No active exploitation has been confirmed by CISA KEV, and no public proof-of-concept exploit has been identified at the time of analysis.

Stored cross-site scripting in SiYuan before v3.7.4 lets an authenticated user upload an HTML file through the asset-serving endpoint, which the server returns without Content-Disposition or X-Content-Type-Options headers, so the browser renders it inline instead of downloading it. When the workspace owner clicks the malicious asset link, the injected script runs in the app's origin with full kernel API access, enabling account and data compromise. Reported by VulnCheck with a vendor patch available; no public exploit has been identified at time of analysis.

Stored cross-site scripting in the Bookly WordPress appointment booking plugin (versions up to and including 27.7) enables unauthenticated remote attackers to inject persistent JavaScript via the bookly_speed_up_update_addons AJAX endpoint, with payloads stored verbatim in the bookly_log.details database column and executing in administrator browser sessions when they navigate to the Diagnostics → Logs page. The injection point is registered under the wp_ajax_nopriv_* hook prefix, making it reachable without any authentication via the standard WordPress AJAX endpoint; the error-logging code path in lib/PluginsUpdater.php writes attacker-controlled input directly to the database when a request is submitted without a valid signature. No public exploit code or CISA KEV listing has been confirmed at time of analysis, though the zero-barrier injection path combined with privileged execution context represents a realistic and impactful threat to any active Bookly installation.

Stored Cross-Site Scripting in the Infility Global WordPress plugin (versions ≤ 2.15.21) allows unauthenticated remote attackers to inject persistent malicious scripts via the /cf7_record log endpoint, which then execute in the browsers of any authenticated WordPress user who accesses the /cf7_records viewer - including those with only Subscriber-level access. Reported by Wordfence with source-code references corroborating the unsanitized input and unescaped output in InfilityGlobalErrorRecord.php; no public exploit code or CISA KEV listing has been confirmed at time of analysis. The CVSS 7.2 rating reflects a changed-scope attack: the unauthenticated submission context crosses into authenticated user sessions, amplifying impact beyond a typical stored XSS.

Stored XSS in the Autopay (Platnosci Online Blue Media) WordPress plugin through version 5.0.0 permits unauthenticated remote attackers to permanently inject arbitrary JavaScript into the WooCommerce checkout page by sending a single crafted POST request targeting the bm_woocommerce_css_editor_content parameter. The plugin's CSS editor save handler is registered on WordPress's 'init' hook with no capability check, no nonce verification, and no input sanitization, causing raw attacker-controlled content to be persisted in the WordPress options table and rendered unescaped inside a style block on every subsequent checkout page load. No public exploit has been identified at time of analysis and this vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities catalog, but the unauthenticated write path combined with persistent execution on a high-value payment page represents a credible payment-skimming threat vector.

Cross-site scripting leading to arbitrary code execution in SiYuan (self-hosted note-taking / knowledge-management app) before v3.7.4 lets an attacker embed hex-encoded markup inside a document icon that the vulnerable unicode2Emoji function renders without sanitization; because the Electron renderer runs with Node integration enabled, the injected script escapes the browser context and executes OS commands on the victim's host. Any user who opens or imports a crafted document is affected. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor GitHub security advisory (GHSA-vx5w-qrvp-mmcq) and a VulnCheck advisory document the flaw.

Stored cross-site scripting in SiYuan's desktop note-taking client (versions before 3.7.4) allows an attacker who can rename an attribute-view (database) field to inject HTML that executes when a victim opens the sort menu, and because the Electron desktop client runs with Node integration enabled, that script achieves arbitrary code execution on the victim's machine. The flaw is authenticated/low-privilege and requires the victim to open the affected menu; no public exploit has been identified at time of analysis, though a vendor security advisory (GHSA-g3jx-227v-x2x4) and VulnCheck advisory document the issue.

Stored cross-site scripting in SiYuan before v3.7.4 lets a workspace user with edit rights persist JavaScript by injecting event-handler attributes through the unescaped color field of an attribute-view (database) select option. The payload fires whenever any user renders a database containing the malicious select field, across eight distinct render sites that all fail to escape the value. No public exploit or CISA KEV listing has been identified at time of analysis, but the flaw is trivially triggerable and carries a high CVSS 4.0 base score of 9.4.

Stored cross-site scripting escalating to remote code execution affects SiYuan, an Electron-based personal knowledge-management/note-taking application, in all versions before v3.7.4. Because table column-width values passed to the setAttrViewColWidth API are neither validated nor escaped before being written into HTML style attributes, an attacker can break out of the style attribute and attach event handlers to every table cell; when the victim renders the table, the payload executes in the Electron renderer, which runs with Node integration enabled, turning a web-layer injection into arbitrary code execution on the host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Remote code execution in SiYuan before v3.7.4 lets an authenticated attacker who can author Template calculation operators inject HTML and JavaScript that runs in the Electron desktop renderer with Node integration enabled, turning a stored cross-site scripting flaw into full arbitrary code execution when a victim opens the shared notebook/database. The Go template output is stored verbatim without sanitization, so payloads persist and fire on document render. No public exploit or CISA KEV listing has been identified at time of analysis, though VulnCheck published an advisory and the vendor issued a GitHub security advisory (GHSA-rwh7-gm74-67h6).

Stored cross-site scripting in SiYuan before v3.7.4 escalates to remote code execution because the desktop client renders database menu metadata (group, view, and field-edit menus) through unsafe HTML interpolation. An attacker who can set a database field name or description injects markup that closes the containing element and fires an event handler; when a victim opens the affected menu, the script runs with Node.js built-ins available due to Electron being configured without sandboxing/context isolation. No public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.

Stored cross-site scripting leading to remote code execution in SiYuan (a self-hosted personal knowledge-management notebook) before v3.7.4 lets an attacker with write access poison PDF annotation fields via the setFileAnnotation endpoint; because SiYuan is an Electron application, the injected markup runs as JavaScript in the PDF renderer with full Node.js privileges when a victim opens the annotated PDF, escalating a web injection into host-level code execution. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the CWE-79 root cause combined with Node.js integration makes this a full-compromise primitive rather than a benign script injection.

Stored Cross-Site Scripting in the Invisible Anti-Spam & CAPTCHA WordPress plugin (versions ≤ 5.1) allows unauthenticated remote attackers to inject persistent malicious scripts into WordPress pages via crafted admin-ajax.php requests. The plugin's explicit-actions list - auto-populated with common form builder hooks at activation - has no authentication gate on its write path, meaning any network-reachable attacker can store arbitrary JavaScript that executes in every subsequent visitor's browser context. No public exploit has been identified at time of analysis, and an upstream fix appears available via WordPress plugin repository changeset 3633500, though the exact patched release version has not been independently confirmed.

Stored XSS in the WPLP Cookie Consent WordPress plugin (all versions through 4.3.5) enables attackers to inject persistent JavaScript payloads via the unsanitized 'regionArray' parameter, executing in any visitor's browser on affected pages. The attack surface is compounded by a secondary flaw: the plugin's AJAX handler for Google Consent Mode (GCM) configuration performs no nonce verification and no capability check, permitting even Subscriber-level authenticated users to programmatically enable the GCM feature - the prerequisite for the XSS injection vector. No public exploit code or CISA KEV listing has been identified at time of analysis; a patch appears available in version 4.4.0 based on the WordPress plugin changeset reference.

Stored Cross-Site Scripting in the Online Booking & Scheduling Calendar for WordPress by vcita (all versions through 4.6.0) allows unauthenticated remote attackers to inject persistent malicious JavaScript via the unsanitized 'business_id' parameter. Injected scripts execute in the browser of any user - including administrators - who subsequently loads an affected page, enabling session hijacking, credential theft, or secondary payload delivery. No active exploitation is confirmed by CISA KEV; no public exploit has been identified at time of analysis, though Wordfence has documented the vulnerable code paths in three specific source files.

Session theft and unauthorized OAuth consent grant in OpenAM Community Edition through 16.0.6 result from the default configuration issuing the iPlanetDirectoryPro SSO cookie with HttpOnly=false and simultaneously reusing that cookie as the CSRF token in OAuth/OIDC consent flows. An authenticated console user who clicks a single attacker-crafted link, when chained with any co-resident same-origin XSS on the OpenAM origin, loses their SSO session and simultaneously completes an attacker-driven OAuth consent grant in one interaction. No public exploit code has been identified at time of analysis and this CVE is not listed in the CISA KEV catalog, but the dual-purpose misuse of the session cookie - as both a bearer token and a CSRF guard - substantially amplifies the impact of any XSS present in the same origin.

Reflected XSS in LimeSurvey Community Edition 7.0.5 allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of an authenticated administrator by delivering a crafted URL targeting the HTML editor popup endpoint. The `text` and `name` query parameters bypass a blacklist-based sanitizer and are rendered unencoded across at least four distinct output contexts - an HTML title element, a JavaScript `window.status` assignment, and multiple `document.getElementById()` calls - confirmed by the patch commit diff. No public exploit has been identified at time of analysis, but an upstream fix is available as a merged GitHub commit and a vendor patch is listed as available.

Stored cross-site scripting in the WP-Stats WordPress plugin (all versions up to and including 2.56) allows unauthenticated remote attackers to inject persistent JavaScript payloads into WordPress pages due to insufficient input sanitization and output escaping. Every subsequent visitor to an injected page - including site administrators - will involuntarily execute the attacker's script in their browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Stored cross-site scripting in W3 Total Cache WordPress plugin (all versions through 2.10.3) allows unauthenticated attackers to inject and persistently execute arbitrary JavaScript in victim browsers by embedding malicious content in the Comment Author Name field. The payload is activated exclusively when the plugin's Lazy Load Images feature is enabled, as the unsafe output occurs within the LazyLoad mutator's img tag rewriting step. No public exploit code or CISA KEV listing is identified at time of analysis, but the network-accessible, unauthenticated attack vector with scope change represents meaningful risk for any WordPress site with both public commenting and lazy load simultaneously active.

Cross-site scripting in JupyterLab 3.3.0 through 4.5.9 and 4.6.0 through 4.6.1 enables arbitrary code execution in a victim's browser session through a crafted overrides.json settings file. The sideBySideLeftMarginOverride and sideBySideRightMarginOverride notebook extension settings are inserted unsanitized into CSS style content, allowing a payload to execute with full JupyterLab API access - enabling notebook reads/writes and arbitrary kernel command execution under the victim's credentials. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the CVSS 4.0 score of 8.6 with high confidentiality and integrity impact reflects meaningful real-world risk, particularly in multi-user JupyterHub deployments.

Cross-site scripting in SVGO's script-removal plugin exposes web applications that process untrusted SVG uploads to stored XSS attacks across all major version lines from 1.0.0 through 4.0.1. The removeScripts plugin (called removeScriptElement in v1-3) silently passes through namespace-prefixed script elements such as `<svg:script>` and performs case-sensitive JavaScript URI matching that attackers trivially bypass with mixed-case variants like `JavaScript:`. Applications serving SVGO-optimized SVGs to end users face cookie and session token theft; patches are available in versions 2.8.3, 3.3.4, and 4.0.2, with a public proof-of-concept included in the GitHub security advisory GHSA-2p49-hgcm-8545.

Reflected cross-site scripting in two snstheme WooCommerce WordPress themes - Samex (through version 2.5) and M.Anh (through version 1.7) - permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a specially crafted URL that the theme reflects back unsanitized into the HTML response. The scope change (S:C) in the CVSS vector indicates that successful exploitation extends impact beyond the WordPress application into the victim's browser origin, enabling session hijacking or administrative account compromise. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis; discovery was reported by Patchstack.

Unauthenticated reflected cross-site scripting (XSS) in Zaytech's Smart Online Order for Clover WordPress plugin, affecting all versions through 1.6.1, allows remote unauthenticated attackers to inject and execute arbitrary JavaScript within a victim's browser session. The scope change (S:C) in the CVSS vector confirms the payload escapes the plugin's component boundary and executes in the authenticated WordPress session context of the targeted user, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.

Unauthenticated cross-site scripting in SureDash (WordPress plugin by Brainstorm Force) through version 1.10.1 enables remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The vulnerability carries a CVSS 3.1 score of 7.1 with a confirmed scope change (S:C), meaning the malicious script runs in the browser's security context, potentially reaching session tokens, credentials, or other sensitive data beyond the plugin itself. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero authentication requirement make this straightforward to exploit once a victim is lured to a crafted URL.

Unauthenticated cross-site scripting in the Colissimo Officiel WooCommerce shipping plugin (versions <= 2.10.0) allows remote, unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted request. The CVSS scope change (S:C) confirms the exploit crosses from the plugin's security context into the broader browser environment, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated, low-complexity nature of the flaw makes it straightforward to weaponize against any WordPress site running the affected plugin.

Reflected Cross-Site Scripting in the MultiParcels Shipping For WooCommerce WordPress plugin (versions ≤ 1.30.36) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into following a crafted URL. The changed-scope vector (S:C) means the injected script runs within the victim's authenticated WordPress origin, enabling session hijacking, credential harvesting, or unauthorized administrative actions if an admin-level user is targeted. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA KEV catalog.

Unauthenticated cross-site scripting in Local Delivery Drivers for WooCommerce 3.0.0 and below allows remote, unauthenticated attackers to inject persistent malicious scripts that execute in the browser context of authenticated site administrators or other privileged users. The changed scope (S:C) in the CVSS vector signals that successful exploitation crosses security boundaries beyond the plugin itself, enabling attacker access to administrator browser sessions. No public exploit code has been identified at time of analysis, and the vulnerability does not appear on the CISA Known Exploited Vulnerabilities catalog.

Unauthenticated cross-site scripting in the Geo Mashup WordPress plugin (versions <= 1.13.18) allows remote attackers to inject arbitrary JavaScript into pages rendered for site visitors without any prior authentication. With a scope-changed CVSS vector (S:C) and a score of 7.1, successful exploitation crosses the browser security boundary, enabling session hijacking, credential theft, or malicious redirects against victims who interact with affected content. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Unauthenticated stored/reflected Cross-Site Scripting in the Visitor Traffic Real Time Statistics Pro WordPress plugin (versions <= 11.10) allows a remote, unauthenticated attacker to inject malicious scripts into traffic data that is later rendered in the WordPress admin dashboard. Because the CVSS vector shows a changed scope (S:C), the payload executes in the context of a privileged user's browser, enabling session hijacking, credential theft, or unauthorized administrative actions. No public exploit code and no CISA KEV listing have been identified at time of analysis, though the unauthenticated nature and low attack complexity make this straightforward to weaponize against any site running an unpatched version.

Unauthenticated reflected XSS in the WP-Stats WordPress plugin (versions 2.56 and below) enables remote attackers to inject arbitrary JavaScript into victim browsers without requiring any authentication to the target site. Because the CVSS vector carries a scope change (S:C), a successful attack can escape the plugin's security boundary and execute within the administrator's browser session, enabling session hijacking, credential harvesting, or backdoor injection into the WordPress installation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege attack vector and low complexity make this straightforward to weaponize via a phishing link once a suitable victim is identified.

Reflected Cross-Site Scripting in the Agrion WordPress theme (versions 1.0.0 and below) enables unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The CVSS S:C (Scope Changed) metric confirms the exploit crosses the application's security boundary into the browser context, enabling session hijacking, credential theft, and DOM manipulation. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-privilege requirement substantially lowers the attacker barrier.

Unauthenticated stored or reflected Cross-Site Scripting in the Mang Board WP WordPress plugin (versions 2.3.4 and earlier) allows network-accessible attackers to inject malicious JavaScript without any credentials, executing arbitrary script in victims' browser sessions upon page interaction. The CVSS scope change (S:C) confirms the attack crosses into the victim browser's security context, enabling session hijacking, credential theft, or unauthorized actions performed as the victim. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, zero-authentication attack path represents a meaningful risk for any WordPress site running the affected plugin.

Unauthenticated XSS in the GeekyBot WordPress plugin (versions 1.2.6 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who visits an affected page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms low-complexity network exploitation requiring no credentials, with the scope change indicating the injected script crosses into the victim's browser security context. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated stored or reflected Cross-Site Scripting in the WP Full Stripe Free WordPress plugin version 8.5.0 and below allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by other users, including administrators. Because the vulnerability carries a Changed scope (S:C in the CVSS vector), successful exploitation can affect browser sessions beyond the vulnerable plugin's own context, enabling session hijacking, credential theft, or malicious redirects. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack surface makes this a meaningful risk for any WordPress site running the affected plugin.

Unauthenticated cross-site scripting in the Echo Knowledge Base WordPress plugin (versions <= 17.211.0) allows a remote attacker to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability requires no authentication to exploit but does require a victim to interact with the affected content, as reflected in the CVSS UI:R metric and scope change (S:C). No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, but the low attack complexity and zero-privilege requirement make this accessible to unsophisticated attackers targeting WordPress deployments running this plugin.

Unauthenticated cross-site scripting in the WordPress plugin Visitors Traffic Real Time Statistics (versions 8.11 and below, by vendor wp-buy) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages served to authenticated WordPress users. The CVSS vector (S:C) confirms the scope crosses from the plugin's execution context into the victim's browser session, enabling session hijacking, credential theft, or admin takeover. No public exploit code has been identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though the unauthenticated, low-complexity attack surface warrants prompt patching given the wide WordPress ecosystem.

Unauthenticated reflected or stored XSS in the Blog Floating Button WordPress plugin (versions 1.4.20 and earlier) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. The vulnerability carries a CVSS 3.1 score of 7.1 with scope change (S:C), meaning malicious script executes in the victim browser's context outside the plugin's own scope, enabling session hijacking, credential theft, or admin account takeover. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated attack vector lowers the bar for opportunistic exploitation across the large WordPress ecosystem.

Unauthenticated XSS in the Do Lasso WordPress plugin (versions <= 358) allows remote attackers to inject malicious scripts that execute in the browsers of visiting users, including site administrators, upon interaction with a crafted link or page. The scope change in the CVSS vector (S:C) indicates the injected script can escape the plugin's immediate context and affect the broader WordPress environment, including the admin panel. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated XSS in the Business Directory WordPress plugin (versions ≤ 6.4.25, by Strategy11 Team) permits remote attackers to inject and execute arbitrary JavaScript in a victim's browser by luring them to visit a crafted URL - no account or privilege on the target site is required from the attacker. The CVSS scope-change indicator (S:C) confirms that successfully executed scripts operate beyond the plugin's own boundary, giving an attacker access to the broader WordPress session context, enabling session hijacking, credential harvesting, or administrative account takeover. No public exploit code has been identified at time of analysis, and this CVE does not appear in the CISA Known Exploited Vulnerabilities catalog.

Cross-site scripting in Maspik - Spam Blacklist WordPress plugin (versions ≤ 2.9.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser when they interact with a crafted URL or page. The plugin, designed to intercept spam submissions in contact forms, fails to adequately sanitize or escape user-supplied input before rendering it in HTML output. No public exploit code has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV.

Unauthenticated cross-site scripting in the Welcart e-Commerce WordPress plugin (versions up to and including 2.11.31) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking an admin or authenticated customer into interacting with a crafted URL. The changed scope in the CVSS vector (S:C) confirms the payload executes outside the application's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim. No public exploit code or active exploitation has been identified at time of analysis, but the zero-authentication, low-complexity attack surface makes this accessible to broad attacker populations.

Unauthenticated reflected or stored Cross-Site Scripting in the MailChimp Subscribe Forms WordPress plugin (versions 4.3.3 and below) allows remote, unauthenticated attackers to inject arbitrary JavaScript into pages viewed by authenticated users. Exploitation requires victim interaction (UI:R) but no attacker authentication, and carries a scope change (S:C), meaning the injected script executes in the victim's browser context outside the plugin's own sandbox. No public exploit code or CISA KEV listing has been identified at time of analysis, though the Patchstack advisory confirms the vulnerability.

Stored Cross-Site Scripting in the Fluent Forms WordPress plugin (all versions through 6.2.11) allows unauthenticated attackers to inject arbitrary JavaScript via form submission fields that are referenced by administrator-configured Notification Smartcodes, with payload execution occurring in the WordPress admin dashboard when Submission Logs are viewed. The root cause is insufficient sanitization and output escaping in ShortCodeParser.php and the EmailNotification component, confirmed by Wordfence and traceable to specific source-level references. A patch was released in version 6.2.12; no public exploit code or CISA KEV listing has been identified at time of analysis.

JupyterLab's ImageViewer component escalates a blob URL lifecycle bug into server-side remote code execution - a specially crafted SVG opened in the ImageViewer retains an executable same-origin context after its blob URL is prematurely revoked, and when the victim opens that image in a new browser tab, embedded JavaScript executes within the JupyterLab server's origin. That same-origin privilege grants direct access to JupyterLab's kernel execution API, turning a browser-side XSS into full RCE on the JupyterLab server. All versions prior to 4.5.10 and 4.6.2 are affected; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the two-step user interaction required is realistic in data-science workflows where images are routinely inspected.

Missing authorization in CamaleonCMS exposes four plugin-administration endpoints - attack, front_cache, cama_meta_tag, and cama_contact_form - to any authenticated low-privileged user, entirely bypassing administrator-level access controls. An attacker holding a standard account can modify live plugin configurations, including injecting arbitrary HTML into the contact form's before_html field to plant a persistent XSS payload. When chained, this broken access control enables full account takeover by stealing an administrator session token; a vendor patch is available and no public exploit has been identified at time of analysis.

Stored cross-site scripting in CamaleonCMS's cama_contact_form plugin lets a low-privileged authenticated user persist arbitrary HTML/JavaScript via the unsanitized before_html field on the contact-form edit endpoint, which lacks proper authorization checks. The payload executes in the browser of anyone who loads the contact form - including administrators - enabling cookie theft, forged authenticated requests, and session takeover. Reported by VulnCheck with a public technical writeup; no public working exploit code and no active exploitation are confirmed at time of analysis.

Stored cross-site scripting in GitLab CE/EE's analytics dashboard component allows an authenticated low-privilege user to inject malicious JavaScript into table cell content that executes in the browsers of other users who view the affected dashboard. The scope change (S:C in CVSS) confirms the impact crosses security boundaries, enabling session hijacking, credential theft, or unauthorized API actions on behalf of victims including administrators. A publicly available proof-of-concept exploit exists via HackerOne report #3830478; no confirmed active exploitation in CISA KEV at time of analysis.

Stored or reflected cross-site scripting in GitLab CE/EE's analytics dashboard allows an authenticated attacker with low privileges to inject malicious scripts into pagination controls, executing in the browser context of any user who views the affected page. Affected versions span 18.2 through 19.2.1 across all three supported release trains. A publicly available proof-of-concept exists via HackerOne report 3830061; the Changed scope (S:C) and High C/I impacts elevate real-world risk significantly beyond a typical low-privilege XSS.

Stored cross-site scripting in CamaleonCMS (owen2345/camaleon-cms) lets an authenticated low-privileged user persist a malicious HTML/JavaScript payload as a draft post title, which executes in an administrator's browser when the admin views the drafts listing. Because the payload runs in the admin's authenticated session, it enables session/cookie theft and forged administrative requests, effectively escalating a low-privileged account to admin-level control. Reported by VulnCheck with a public technical write-up; no public exploit identified at time of analysis and not listed in CISA KEV.

Stored cross-site scripting in GitLab CE/EE 19.2 before 19.2.2 lets an authenticated user holding only developer-role permissions inject unsanitized HTML that executes in the browser of a higher-privileged user who opens a CI job modal, enabling privilege escalation. Publicly available exploit code exists (HackerOne report #3880796), though EPSS is modest at 0.30% (22nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 9.0 is driven by a scope change and total confidentiality/integrity/availability impact once the payload runs in a victim's session.

Persistent cross-site scripting in Progress Software's WhatsUp Gold network monitoring platform (all versions before 2026.0.2) allows an authenticated attacker on an adjacent network to bypass frontend input sanitization controls and inject stored malicious script content into the application. When a victim user - likely an administrator - views the poisoned page, the injected script executes in their browser context, enabling session hijacking, credential theft, or unauthorized actions with the victim's privilege level. No public exploit identified at time of analysis, and the adjacent-network attack vector limits internet-scale exposure, but the high C/I/A impact scores reflect the sensitivity of network monitoring credentials.

Stored cross-site scripting in Winter CMS's backend editor settings allows an authenticated backend user holding the `backend.manage_editor` permission to inject arbitrary JavaScript that executes in the browsers of all other backend users who load any backend page. The attack exploits LESS CSS's escape syntax (`~"..."`) to break out of the CSS context and embed script tags in compiled output served by `renderCss()`, which was previously returned unsanitized. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, the class of vulnerability is well understood and the specific payload pattern is documented in the patch's test suite.

Stored XSS in Winter CMS backend allows a high-privileged user with the `backend.manage_branding` permission to inject malicious HTML/JavaScript via the LESS CSS compiler's output in Settings → Customize Backend → Styles, which is rendered unsanitized on every backend page. The same rendering flaw is present in the Editor Settings → Markup Styles panel (`backend.manage_editor` permission), addressed in the same patch. An attacker exploiting this could steal session tokens or perform actions as any other authenticated backend user who visits a backend page. No public exploit or KEV listing exists, but the issue is confirmed by the vendor and an identical CVE (CVE-2025-61676) affects the sister project October CMS.

Stored cross-site scripting in the self-hosted Cal.com (Cal.diy) scheduling platform, versions 2.1.1 through 6.2.0, lets an authenticated event owner break out of an inline analytics script string literal in the BookingPageTagManager component by supplying an unsanitized tracking ID, causing attacker-controlled JavaScript to run for every visitor of the public booking page. The flaw enables session-cookie theft, forging of authenticated actions, and self-propagating (wormable) spread by chaining to CSRF-able endpoints. No public exploit identified at time of analysis, though a third-party technical write-up exists.

Stored XSS in telegram-search (versions ≤ 1.2.8) allows any group member to execute arbitrary JavaScript in co-members' browsers by sending crafted messages to a shared Telegram group. The highlightKeyword function in MessageList.vue returned attacker-controlled message text directly to Vue's v-html directive without HTML escaping, creating a persistent, cross-user sink that fires when victims browse or search the message archive - zero clicks required on the victim's side beyond opening the interface. No public exploit has been confirmed as actively exploited and no CISA KEV listing exists, but the public fix commit (PR #654) fully documents the vulnerable code path, making payload construction trivial for any XSS-proficient attacker with group access.

Stored Cross-Site Scripting in Adobe Commerce and Magento Open Source allows a low-privileged authenticated attacker to persistently inject malicious JavaScript into vulnerable form fields, which then executes in the browser of any privileged user who views the affected page. The changed scope (S:C) is the defining risk amplifier: a successful exploitation targets an administrator or session-holding user whose browser context becomes fully compromised, enabling session hijacking or unauthorized actions without ever requiring admin credentials. No public exploit code has been identified and this CVE is not listed in CISA KEV at the time of analysis.

Stored XSS in Adobe Commerce and Magento Open Source enables a low-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon page visit - with scope change allowing script execution beyond the vulnerable component's security boundary, potentially enabling full account or session takeover. The CVSS 8.7 High score reflects network accessibility, low complexity, changed scope, and high confidentiality and integrity impact. No active exploitation (KEV) or public POC has been identified at time of analysis; Adobe released patched August 2026 builds across all affected product lines per advisory APSB26-92.

Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.

Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker to inject and render malicious content within a target user's Teams client, achieving spoofing of interface elements or participants over the network. The scope-changed CVSS vector (S:C, C:H) indicates the vulnerability can expose data beyond the Teams application boundary - potentially including session tokens or cross-context information - when a victim views attacker-controlled content. No public exploit code has been identified and SSVC classifies exploitation as none, though the high confidentiality impact warrants prioritized patching for organizations reliant on Teams for sensitive communications.

Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).

Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.

Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capability on any of the site's own domains to invoke privileged backend routes and Install Tool endpoints using an authenticated victim's session. The regression was introduced in TYPO3 13.0.0 when both the backend and Install Tool were moved to serve from the site root entry point rather than the dedicated `/typo3/` subdirectory, causing the `ReferrerEnforcer` to accept any same-origin Referer header as legitimate backend traffic. Affected versions are TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5; no public exploit code has been identified at time of analysis.

Stored cross-site scripting in Discourse's Chat plugin allows an authenticated user to inject arbitrary HTML and JavaScript into any viewer's browser session by embedding a malicious payload in the username field of a chat-transcript quote block. The Rich Text Editor rendered the username attribute via `innerHTML` without sanitization, meaning any authenticated Discourse member with chat access could craft a quote block that executes attacker-controlled script when a victim - potentially a moderator or administrator - views the transcript. Patch versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are confirmed released; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.

Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.

Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.

Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.

Stored XSS in SP Page Builder (Joomla extension by JoomShaper) prior to version 6.7.0 allows unauthenticated remote attackers to persist arbitrary JavaScript in a Joomla site's database via a single HTTP request to the Shapes API endpoint. When any administrator subsequently opens the SP Page Builder editor, the payload executes automatically in their browser session, enabling session hijacking, credential theft, or full backend site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection vector combined with automatic detonation on routine admin activity makes this a high-priority patch target for any Joomla installation running this extension.

Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.

Reflected cross-site scripting in AIL Framework's /tag/add_tags endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of any authenticated AIL user who opens a specially crafted link. The flaw originates from the error-handling path in tags_ui.py, which returned raw Python string output via str(res[0]) directly as an HTML response without output encoding, permitting attacker-controlled content to be reflected and rendered by the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix has been committed to the GitHub repository.

Stored cross-site scripting in OpenReception appointment-booking-software prior to version 1.0.2 allows a TENANT_ADMIN to plant malicious `javascript:` URIs in tenant link fields (`website`, `imprint`, `privacyStatement`), which execute in patients' browsers when they click the rendered links on the public landing page. The critical impact is not merely XSS but a complete collapse of the platform's stated end-to-end encryption guarantee: JavaScript executing in the patient origin can intercept and exfiltrate plaintext form data before client-side encryption is applied, meaning a malicious tenant administrator can silently read patient health appointment data the product claims the server can never access. No confirmed active exploitation (no CISA KEV entry) and no public POC have been identified at time of analysis.

Arbitrary JavaScript execution in PDF.js (pdfjs-dist) allows an attacker to run unrestricted script in the context of any web application that renders attacker-controlled PDFs with default settings. The flaw stems from PDF.js's built-in scripting engine, which is enabled by default via the enableScripting flag, executing embedded JavaScript from PDFs without sandbox enforcement when no script-src CSP is present. Applications using pdfjs-dist versions 5.6.83 through 6.2.107 are affected; no public exploit or KEV listing is identified at time of analysis, but the default-on configuration makes real-world exposure broad.

Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.

Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.