Cross-Site Scripting

Cross-site scripting (XSS) in MaxSite CMS mail_send plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_subject, f_files, or f_from parameters, resulting in stored XSS that can affect other users. The vulnerability stems from missing input sanitization via htmlspecialchars() and is classified by the vendor as self-XSS. Publicly available exploit code exists, and a patch is available in version 109.4.

Cross-site scripting vulnerability in MaxSite CMS Redirect Plugin up to version 109.3 allows authenticated high-privilege users to inject malicious scripts via the f_all or f_all404 parameters due to missing output encoding with htmlspecialchars(). The vulnerability requires high-privilege authentication and user interaction to execute, resulting in low impact (integrity only); however, publicly available exploit code exists and the vendor has classified this as a self-XSS violation of secure coding standards. Upgrade to version 109.4 or later to remediate.

Cross-site scripting (XSS) in MaxSite CMS up to version 109.3 allows authenticated administrators to inject malicious scripts via the f_logging_file parameter in the Antispam Plugin admin interface, leading to stored XSS with user interaction required. The vulnerability affects the /admin/plugin_antispam endpoint and results from insufficient output encoding. Vendor-released patch version 109.4 addresses the issue by implementing htmlspecialchars() filtering; publicly available exploit code exists.

Reflected cross-site scripting (XSS) in Datacom DM4100 version 1.3.6.1.4.1.3709 allows remote attackers with high administrative privileges to inject malicious scripts via the VLAN Name parameter on the VLAN Page, exploitable only with user interaction. Public exploit code is available, and the vendor has not responded to early disclosure notifications.

Cross-site scripting (XSS) in Datacom DM4100 version 1.3.6.1.4.1.3709 allows authenticated remote attackers to inject malicious scripts via manipulation of the Name parameter in the Ethernet Configuration Page. The vulnerability requires high-privilege administrative access and user interaction to trigger, limiting real-world impact despite public exploit availability. Vendor has not responded to disclosure.

Cross-site scripting (XSS) vulnerability in BIVOCOM TR321 version 21.1.1.50 allows authenticated remote attackers with high privileges to inject malicious scripts via manipulation of the Network Name SSID parameter in the Wireless Setting component. The vulnerability requires user interaction to trigger and has limited integrity impact. Exploit code has been publicly published, though the vendor has not responded to disclosure attempts.

Reflected cross-site scripting (XSS) in BDCOM P3310D 0.4.2 Build 86345 via the Owner parameter on the New RMON Statistics Page allows authenticated remote attackers to inject malicious scripts. The vulnerability requires user interaction (clicking a crafted link) and high-privilege access to exploit, limiting real-world risk despite public exploit availability. The vendor has not responded to disclosure attempts.

Reflected cross-site scripting (XSS) in BDCOM P3310D 0.4.2 build 10.1.0F-86345 allows authenticated remote attackers with high privileges to inject malicious scripts via the Owner parameter on the New RMON History Page, requiring user interaction to execute. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.

Stored cross-site scripting (XSS) in BDCOM P3310D 0.4.2 build 86345 allows authenticated remote attackers to inject malicious scripts via the Description parameter in the rmon event Tab component. The vulnerability requires high-privilege authentication and user interaction to trigger, limiting practical exploitation scope. Public exploit code is available; however, the low CVSS score (2.4) reflects the authentication barrier and limited confidentiality/availability impact.

Reflected cross-site scripting (XSS) in BDCOM P3310D 0.4.2 10.1.0F Build 86345 allows high-privileged authenticated users to inject malicious scripts via the User name parameter in the New User Page (/index.asp), affecting only the injecting user's session due to session-scoped impact. Public exploit code is available, but exploitation requires administrative credentials and user interaction (form submission), significantly limiting real-world attack surface despite the remote attack vector.

Stored cross-site scripting (XSS) in projeto-siga SIGA 11.0.3.18 allows authenticated remote attackers to inject malicious scripts via the Nome/Descrição parameter in the /sigawf/app/responsavel/novo endpoint. Successful exploitation requires user interaction (UI:R) and an authenticated session (PR:L), limiting impact to information disclosure (I:L). Public exploit code is available, though exploitation remains constrained by authentication and user interaction requirements.

Stored cross-site scripting in CyberPanel's AI Scanner dashboard chains to unauthenticated remote code execution on versions prior to 2.4.4, exploitable by any network-reachable attacker without credentials. The POST /api/ai-scanner/callback endpoint lacks authentication, permitting arbitrary JavaScript injection into the findings_json field of ScanHistory records; when an administrator visits the AI Scanner dashboard, the script executes in their privileged browser session and issues same-origin API calls to plant OS-level cron jobs. A public proof-of-concept exploit is confirmed; no CISA KEV active exploitation listing is present at time of analysis, though the low skill requirement due to POC availability elevates real-world risk significantly.

Unauthenticated attackers can inject malicious HTML into user-controlled template placeholders in pretalx prior to 2026.1.0, enabling arbitrary HTML-rendered emails to be sent from the conference organizer's legitimate sender address. By registering an account with a crafted display name containing HTML or markdown link syntax and triggering a password reset, an attacker can deliver convincing phishing emails that pass SPF/DKIM/DMARC validation, with user interaction (victim clicking password-reset link) required. This vulnerability is fixed in version 2026.1.0.

Stored XSS in AdaptiveGRC text-type form fields allows authenticated attackers to inject malicious JavaScript that executes in victims' browsers, potentially leading to theft of administrator authentication tokens and privilege escalation. The vulnerability affects multiple versions released before December 2025 due to improper server-side parameter validation. User interaction is required for exploitation, and the attacker must first authenticate to the application.

Stored XSS in Apache ActiveMQ and Apache ActiveMQ Web allows authenticated attackers to inject malicious HTML into JMS selector fields, which displays when other users browse queues in the web console. Affects ActiveMQ versions before 5.19.6 and 6.0.0 through 6.2.4; ActiveMQ Web before 5.19.6 and 6.0.0 through 6.2.4. The vulnerability requires valid authentication but no user interaction beyond normal queue browsing, and EPSS indicates very low exploitation probability (0.02%) despite the accessible attack vector.

Stored Cross-Site Scripting in ITERAS WordPress plugin version 1.8.2 and earlier allows authenticated attackers with Contributor-level privileges to inject arbitrary JavaScript code via shortcode attributes (iteras-ordering, iteras-signup, iteras-paywall-login, iteras-selfservice) due to insufficient input sanitization in the combine_attributes() function. When a user accesses a page containing the malicious shortcode, the injected script executes in their browser context, enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting in Royal Elementor Addons plugin for WordPress up to version 1.7.1056 allows authenticated attackers with Author-level access to inject arbitrary JavaScript via image alt attributes in the Image Grid/Slider/Carousel widget. The vulnerability results from insufficient output escaping in the render_post_thumbnail() function, where wp_kses_post() is used instead of esc_attr() for HTML attribute context. Malicious scripts execute in the browsers of any user viewing pages containing the compromised image widget, potentially enabling session hijacking, credential theft, or plugin/theme manipulation.

Stored DOM-level XSS in AnythingLLM's chart caption rendering allows authenticated users in shared workspaces to inject malicious markdown via indirect prompt injection, affecting all other users who view the compromised conversation. The vulnerability stems from unsafe markdown-to-HTML conversion in the Chartable component that bypasses the application's standard DOMPurify sanitization defense-in-depth. Versions prior to 1.12.1 are affected; patch available.

Reflected cross-site scripting (XSS) in Frappe Press login page redirect parameter allows unauthenticated attackers to inject arbitrary JavaScript that executes in a victim's browser upon clicking a malicious link, with user interaction required. The vulnerability affects all versions prior to the patch commit 16d1b6ca2559f858a1de77bcb03fd7f1b81671c6, which restricts redirects to internal URLs only. CVSS score of 1.3 reflects very low confidentiality, integrity, and availability impact due to scope limitations, though XSS vulnerabilities carry inherent session hijacking and credential theft risks.

PostCSS versions prior to 8.5.10 fail to escape `</style>` sequences when stringifying CSS Abstract Syntax Trees, allowing cross-site scripting (XSS) attacks when user-submitted CSS is embedded in HTML `<style>` tags. An attacker can inject CSS containing `</style>` sequences in property values to break out of the style context and execute arbitrary JavaScript in the victim's browser. This requires user interaction (UI:R) and affects applications that parse untrusted CSS and re-stringify it for embedding in HTML documents.

Stored cross-site scripting in Xibo CMS versions prior to 4.4.1 allows authenticated users with notification creation privileges to inject arbitrary JavaScript into notification bodies that executes automatically in targeted users' browsers upon login without requiring user interaction. This vulnerability affects the notification interrupt feature and requires the attacker to possess both notification centre access and notification creation permissions, which are restricted to administrative roles by default.

Stored cross-site scripting (XSS) in Mahara before 25.04.2 and 24.04.11 allows unauthenticated remote attackers to inject malicious JavaScript via unsanitized search query parameters in the 'search site' feature when the Elasticsearch7 search plugin is enabled. The vulnerability has a CVSS score of 6.1 (moderate) with network attack vector and user interaction required (clicking a crafted search link), resulting in partial confidentiality and integrity impact. No active exploitation has been confirmed by CISA KEV, and no public exploit code is documented at the time of analysis.

Cross-site scripting (XSS) vulnerability in Hostbill versions 2025-11-24 and 2025-12-01 allows high-privilege remote attackers to execute arbitrary code in admin and client interface contexts without user interaction. The CVSS score of 4.9 reflects the requirement for authenticated high-privilege access, but the presence of publicly available exploit code and the vulnerability's presence in both admin and client interfaces increase real-world risk beyond the base score. The discrepancy between the CWE-79 classification (XSS) and tags indicating RCE capability suggests stored XSS enabling indirect code execution or privilege escalation within the application.

Stored cross-site scripting (XSS) in Rescue Shortcodes WordPress plugin versions through 3.3 allows authenticated users with limited privileges to inject malicious scripts that execute in the context of other users' browsers, potentially compromising site administrators and other high-privilege accounts. Attack requires user interaction (UI:R) but affects the entire scope of the application (S:C), enabling privilege escalation and data theft with moderate impact.

Stored cross-site scripting (XSS) in Magepeople's Taxi Booking Manager for WooCommerce plugin (versions up to 2.0.0) allows authenticated users with low privileges to inject malicious scripts that execute in the context of other users' browsers, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) and affects the confidentiality, integrity, and availability of the application. No public exploit code or active exploitation has been confirmed at this time.

reCaptcha by WebDesignBy WordPress plugin before version 2.0 fails to sanitize the Site Key setting before injecting it into JavaScript context via the grecaptcha_js() function, enabling site administrators without unfiltered_html capability on multisite installations to inject arbitrary JavaScript that executes for all login page visitors. Publicly available exploit code exists; patch released by vendor.

Stored Cross-Site Scripting in WP Store Locator plugin for WordPress up to version 2.2.261 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsl_address' post meta field, executing in browsers of any user who views an affected map marker info window. The vulnerability requires contributor-level access or higher and does not require user interaction beyond normal page browsing, resulting in session hijacking, credential theft, or malware distribution with CVSS 6.4 impact spanning confidentiality and integrity across security boundaries.

Stored cross-site scripting (XSS) in Koollab LMS courselet feature allows authenticated users to inject arbitrary JavaScript that executes in the browsers of other users with courselet access, potentially compromising account security and enabling credential theft or malicious actions on behalf of affected users. CVSS 5.4 reflects network delivery, low complexity, and limited confidentiality/integrity impact constrained by required user interaction and authenticated access.

Stored Cross-Site Scripting in Gutentor plugin for WordPress up to version 3.5.5 allows authenticated contributors and above to inject malicious scripts into pages via insufficient input sanitization, executing arbitrary JavaScript in the browsers of users who view the compromised pages. The vulnerability requires contributor-level WordPress account access and user interaction (page view), resulting in limited but real risk to website content integrity and user session compromise.

Stored Cross-Site Scripting in Social Rocket - Social Sharing Plugin for WordPress up to version 1.3.4.2 allows authenticated Subscriber-level users to inject arbitrary JavaScript via the 'id' parameter, which executes in the browsers of all users viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping, and exploitation requires only subscriber-level WordPress authentication with no user interaction needed beyond the initial injection.

Stored cross-site scripting in IBM Guardium Data Protection 12.1 allows high-privileged administrative users to inject malicious JavaScript into the Web UI, enabling credential theft and session hijacking within trusted administrative sessions. The vulnerability requires administrative privileges and does not trigger user interaction, allowing attackers with admin access to persistently compromise the confidentiality and integrity of the system. A patch is available from IBM.

Stored cross-site scripting (XSS) in IBM Guardium Data Protection 12.1 through 26.0.0.4 allows authenticated administrative users to inject arbitrary JavaScript into the Web UI, enabling credential theft and session hijacking of other administrators within a trusted session. The vulnerability requires administrative privileges and user interaction (clicking a malicious link or visiting a crafted page), limiting its scope but maintaining high impact for multi-admin environments. EPSS context and active exploitation status are not publicly confirmed at this time.

fast-xml-parser XMLBuilder fails to escape comment and CDATA delimiters when building XML from JavaScript objects, allowing XML injection via unescaped `-->` and `]]>` sequences in user-controlled content. Attackers can inject malicious XML elements into comments or CDATA sections, enabling XSS attacks in browser contexts, SOAP message manipulation, RSS feed poisoning, or XML structure breakage. The vulnerability requires user interaction (UI:R) and affects only XMLBuilder output that includes user-controlled comments or CDATA; no public exploit code identified at time of analysis.

Cross-site scripting in Marko template engine allows authenticated attackers to break out of script and style tags using mixed-case closing tags (e.g., </SCRIPT>, </Style>) and inject arbitrary HTML/JavaScript. The vulnerability affects any Marko template that interpolates untrusted user data inside <script> or <style> blocks, enabling stored XSS attacks against victim browsers with CVSS 6.4 (network-accessible, low complexity, requires low privileges). Vendor-released patch available.

Stored cross-site scripting (XSS) in Frappe 16.10.0 allows authenticated attackers with high privileges to inject malicious scripts into document fields, which execute in the browser of any user who subsequently opens the affected document in Desk. The vulnerability stems from unsafe HTML interpolation in multiple formatter implementations that fail to escape user-supplied values, enabling persistent client-side code execution with limited scope (low integrity/availability impact). CVSS 4.6 reflects the requirement for authenticated high-privilege access and user interaction, but the XSS vector represents a significant persistence and social engineering risk in collaborative document environments.

Stored cross-site scripting (XSS) in Frappe 16.10.10 allows authenticated attackers with high privileges to inject malicious JavaScript via crafted tag values in the _user_tags field, which execute when victims open list or report views. The vulnerability stems from unescaped interpolation of tag content into HTML attributes and element content. Exploitation requires user interaction (victim must open affected view) and high-level authentication, but results in session hijacking or data theft with partial technical impact; CISA SSVC framework rates this as exploitable via proof-of-concept with partial technical impact.

Cross-site scripting (XSS) in DOMPurify occurs when function-based ADD_TAGS configuration is used with FORBID_TAGS, allowing attackers to bypass tag filtering and inject dangerous elements such as iframe, form, object, and embed with their attributes intact. The vulnerability stems from inconsistent handling of FORBID_TAGS compared to the separately-fixed FORBID_ATTR logic, where the forbidden tag check is short-circuited by a function-based ADD_TAGS predicate. Publicly available proof-of-concept demonstrates iframe and form injection with external URLs surviving sanitization; patch is available in version 3.4.0.

Cross-site scripting (XSS) in DOMPurify when using SAFE_FOR_TEMPLATES with RETURN_DOM or RETURN_DOM_FRAGMENT modes allows remote attackers to execute arbitrary JavaScript by crafting malformed HTML that reassembles into template expressions after DOM normalization. The vulnerability affects DOMPurify from v1.0.10 through at least v3.3.3, exploitable when sanitized output is mounted into template-evaluating frameworks like Vue 2. A proof-of-concept demonstrates reliable exploitation with alert(1) execution.

DOMPurify versions 3.0.1 through 3.3.3 fail to prevent prototype pollution-based XSS attacks when using default configurations. An attacker who can exploit a prototype pollution gadget elsewhere in the application can pollute Object.prototype with permissive regex values, causing DOMPurify to bypass sanitization and allow arbitrary custom elements with event handler attributes. The vulnerability affects the standard DOMPurify.sanitize(userInput) call without requiring special configuration.

Cross-site scripting (XSS) in GitLab CE/EE 18.11 before 18.11.1 allows authenticated users to inject unauthorized content into other users' browsers through improper input validation in the Mermaid diagram sandbox. An attacker must have valid GitLab credentials and the victim must view a malicious diagram, limiting real-world impact despite the publicly available exploit code. SSVC analysis rates this as non-automatable with partial technical impact, consistent with the low CVSS 3.5 score.

Carbon Forum 5.9.0 contains a persistent cross-site scripting vulnerability that allows authenticated administrators to inject malicious JavaScript code through the Forum Name field in dashboard. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

ICEWARP 11.0.0.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious HTML elements into emails by embedding base64-encoded payloads in object and embed tags. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Stored Cross-Site Scripting (XSS) in the Gallagher Website Design WordPress plugin through version 2.6.4 allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript into pages via the 'prefix' attribute of the login_link shortcode, bypassing input sanitization and output escaping controls. The injected scripts execute in the context of any user viewing the affected page, potentially enabling session hijacking, credential theft, or malicious redirection. Wordfence has documented the vulnerability with proof-of-concept references to the vulnerable code in the WordPress plugin repository.

Stored Cross-Site Scripting in the Gutentools WordPress plugin (versions up to 1.1.3) allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages via the Post Slider block's block_id attribute. The vulnerability exploits insufficient input sanitization combined with a custom unescaping routine that reintroduces dangerous characters, enabling persistent payload execution whenever users access injected pages. This affects all installations using the plugin at or below version 1.1.3 and requires only low-privileged WordPress authentication.

Stored cross-site scripting in CI HUB Connector plugin for WordPress up to version 1.2.106 allows authenticated attackers with Contributor-level access or above to inject arbitrary JavaScript through the 'id' attribute of the cihub_metadata shortcode, which executes in the context of any user visiting the injected page. The vulnerability stems from insufficient input sanitization and output escaping in the shortcode handler, enabling persistent XSS attacks that can compromise site visitors and administrative accounts.

Stored Cross-Site Scripting in Posts Map plugin for WordPress up to version 0.1.3 allows authenticated contributors to inject arbitrary JavaScript via the 'name' shortcode attribute. When any user accesses a page containing the malicious shortcode, the injected script executes in their browser with the privileges of their WordPress session, potentially enabling account compromise, admin impersonation, or malware distribution. The vulnerability requires contributor-level or higher access and affects all versions through 0.1.3.

Stored cross-site scripting in Private WP Suite plugin for WordPress through version 0.4.1 allows authenticated administrators to inject arbitrary JavaScript via the Exceptions setting, which executes in the browsers of any user accessing affected pages. The vulnerability requires high-privilege authenticated access and only manifests in multi-site installations or those with unfiltered_html disabled, limiting real-world exposure despite network-accessible attack vector.

Stored cross-site scripting (XSS) in the Text Snippets plugin for WordPress up to version 0.0.1 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript into pages via unsanitized shortcode attributes, which executes whenever any user visits the affected page. The vulnerability stems from insufficient input sanitization and output escaping on the `ts` shortcode, enabling persistent payload injection. No public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in the Quran Live Multilanguage WordPress plugin versions up to 1.0.3 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes ('cheikh' and 'lang'). The vulnerability exploits insufficient input validation in the quran_live_render() function and direct output of user-supplied values into inline <script> blocks without escaping, enabling injection of arbitrary web scripts that execute whenever a user accesses the compromised page.

Stored cross-site scripting (XSS) in Easy Social Photos Gallery - MIF plugin for WordPress (versions up to 3.1.2) allows authenticated attackers with contributor-level access to inject arbitrary HTML and JavaScript via the 'wrapper_class' shortcode attribute of the 'my-instagram-feed' shortcode. The vulnerability exists because the plugin uses sanitize_text_field() instead of esc_attr() when outputting the attribute inside HTML class tags, allowing attackers to break out of the attribute context and inject event handlers that execute in users' browsers when they visit affected pages.

Simple Random Posts Shortcode plugin for WordPress versions up to 0.3 contains stored cross-site scripting (XSS) via insufficient sanitization of the 'container_right_width' shortcode attribute, allowing authenticated contributors and above to inject arbitrary JavaScript that executes in browsers of all users accessing affected pages. No active exploitation has been confirmed, but the vulnerability requires only contributor-level access and carries network-based attack vector with low complexity.

Stored cross-site scripting in the Sentence To SEO WordPress plugin (versions up to 1.0) allows authenticated administrators to inject arbitrary JavaScript into the plugin settings page via the 'Permanent keywords' field. The vulnerability stems from insufficient input sanitization and output escaping, enabling attackers to break out of a textarea element and inject malicious scripts that execute when other users access the settings page. This requires administrator-level privileges and does not affect unauthenticated users.

Stored Cross-Site Scripting in WPMK Block plugin for WordPress up to version 1.0.1 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via the 'class' shortcode attribute, which is directly concatenated into HTML without proper escaping. The vulnerability affects all versions through 1.0.1 due to insufficient input sanitization in the wpmk_block_shortcode() function, enabling persistent XSS attacks that execute whenever users access compromised pages.

Stored cross-site scripting (XSS) in SlideShowPro SC plugin for WordPress versions up to 1.0.2 allows authenticated attackers with contributor-level access to inject arbitrary JavaScript through the `slideShowProSC` shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of any user viewing the affected page, potentially compromising session tokens, stealing credentials, or performing unauthorized actions on behalf of site visitors. No public exploit code or active exploitation has been confirmed at the time of analysis.

Stored cross-site scripting in Twittee Text Tweet WordPress plugin versions up to 1.0.8 allows authenticated users with Contributor-level access to inject arbitrary JavaScript via unsanitized shortcode attributes. The ttt_twittee_tweeter() function uses extract() to process shortcode parameters and concatenates them directly into HTML and inline JavaScript contexts without escaping, enabling attackers to break out of attribute contexts and inject event handlers that execute against site visitors. The vulnerability affects the 'id', 'tweet', 'content', 'balloon', and 'theme' parameters.

Stored Cross-Site Scripting in Short Comment Filter WordPress plugin up to version 2.2 allows authenticated administrators to inject arbitrary JavaScript through the 'Minimum Count' settings field due to missing input sanitization and output escaping. The vulnerability affects all versions through 2.2 and has particular impact in WordPress multisite environments or when DISALLOW_UNFILTERED_HTML is configured, where administrators lack unfiltered_html capabilities. No public exploit code or active exploitation has been identified at the time of analysis.

Stored cross-site scripting in Slider Bootstrap Carousel WordPress plugin up to version 1.0.7 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via unsanitized 'category' and 'template' shortcode attributes, executing malicious scripts in pages viewed by any user. The vulnerability stems from improper use of extract() on shortcode attributes combined with missing output escaping (esc_attr()) on multiple HTML attributes, enabling persistent XSS injection that affects site security and user data.

Stored Cross-Site Scripting in Institute Management plugin for WordPress up to version 5.5 allows authenticated administrators to inject arbitrary JavaScript via the 'Enquiry Form Title' setting, which executes when users access affected pages. The vulnerability is limited to multi-site WordPress installations or sites with unfiltered_html disabled. CVSS 4.4 reflects high privilege requirements (PR:H) and conditional scope (multi-site only), but the stored XSS nature and administrator access requirement make this a targeted insider threat rather than a broad attack surface.

Stored Cross-Site Scripting in Switch CTA Box WordPress plugin up to version 1.1 allows authenticated contributors and above to inject arbitrary JavaScript through unsanitized post meta fields including button link, button ID, button text, and description. The vulnerability arises from direct output of user-supplied data into HTML without escaping functions, enabling attackers to execute malicious scripts whenever pages containing injected shortcodes are accessed by any visitor.

Stored Cross-Site Scripting in Real Estate Pro plugin for WordPress up to version 1.0.9 allows authenticated administrators to inject arbitrary JavaScript into admin settings that executes for all users viewing affected pages. The vulnerability is limited to multi-site installations or single-site instances with the unfiltered_html capability disabled. Attack requires administrator-level privileges and no user interaction, but scope is changed (cross-site impact), resulting in a moderate CVSS score of 5.5.

Stored cross-site scripting in the Buzz Comments WordPress plugin (all versions up to 0.9.4) allows authenticated administrators to inject arbitrary JavaScript via the 'Custom Buzz Avatar' setting, with the malicious script executing whenever any user accesses the plugin settings page. The vulnerability requires high-privilege administrative access and manual interaction with the settings interface, limiting its practical exploitability to insider threats or compromised administrator accounts.

Stored cross-site scripting in the ER Swiffy Insert WordPress plugin through version 1.0.0 allows authenticated users with Contributor access or higher to inject arbitrary JavaScript via unsanitized shortcode attributes that are directly interpolated into page output. The vulnerability affects all versions of the plugin and requires only contributor-level privileges to exploit, making it a persistence and privilege-escalation vector on WordPress sites with multiple user accounts.

Stored cross-site scripting in Bread & Butter plugin for WordPress up to version 8.2.0.25 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript via the 'event' attribute of the 'breadbutter-customevent-button' shortcode. The vulnerability arises from missing output escaping in the customEventShortCodeButton() function, which directly interpolates unsanitized user input into an onclick HTML attribute. Scripts execute in the context of any user viewing the affected page, enabling session hijacking, credential theft, or malicious content injection.

Stored cross-site scripting in HTTP Headers plugin for WordPress up to version 1.19.2 allows authenticated administrators to inject arbitrary scripts into admin settings that execute when users access affected pages. This vulnerability is limited to multi-site installations or sites where the unfiltered_html capability has been disabled, significantly reducing real-world exposure. No active exploitation has been publicly reported, and the high privilege requirement (administrator role) narrows the practical attack surface.

Stored cross-site scripting in Zypento Blocks plugin for WordPress up to version 1.0.6 allows authenticated attackers with Author-level privileges to inject arbitrary JavaScript into page content via the Table of Contents block. The vulnerability exists because the front-end rendering script reads heading text using innerText and renders it via innerHTML without sanitization, causing injected scripts to execute whenever users access the compromised page. No public exploit code or active exploitation has been reported at time of analysis.

Cross-site scripting (XSS) vulnerability in DeepL Chrome browser extension versions 1.22.0 through 1.23.0 allows remote attackers to execute arbitrary JavaScript and inject malicious HTML into web pages viewed by users. The vulnerability requires user interaction with a malicious web page but can compromise the security context of all visited websites.

Unauthenticated remote attackers can upload arbitrary files to any path in a+HCM developed by aEnrich, including executable HTML documents, enabling cross-site scripting and potential server-side impacts. The vulnerability requires user interaction (UI:A) but allows unrestricted file placement with low scope and integrity impact. No patch version or active exploitation data is currently available.

Reflected cross-site scripting (XSS) in Silverpeas Core before version 6.4.6 allows unauthenticated remote attackers to execute arbitrary JavaScript in users' browsers via malicious input to the AdvancedSearch functionality. The vulnerability requires user interaction (clicking a crafted link) and affects confidentiality and integrity with partial technical impact. Publicly available exploit code exists, and CISA SSVC assessment confirms proof-of-concept availability, though this vulnerability is not yet confirmed in active widespread exploitation.

Stored XSS in WWBN AVideo 29.0 and below allows authenticated attackers to inject arbitrary JavaScript via markdown comment links using `javascript:` URI schemes that bypass the platform's custom `ParsedownSafeWithLinks` sanitization. The incomplete fix for CVE-2026-27568 patched raw HTML `<a>` tag processing through `inlineMarkup()` but left Parsedown's `inlineLink()` and `inlineUrlTag()` methods unguarded, while simultaneously disabling Parsedown's built-in `safeMode` filtering - creating a clear bypass path. No public exploitation has been confirmed (not in CISA KEV), though SSVC designates a proof-of-concept as existing; EPSS is very low at 0.03% (9th percentile), indicating no widespread active exploitation at time of analysis.

Stored XSS in WWBN AVideo 29.0 and below allows authenticated uploaders to inject persistent JavaScript payloads via a malformed video duration field that bypasses input validation due to a missing regex end anchor. The crafted payload is stored in the database and rendered unescaped across trending, playlist, and gallery thumbnail pages, enabling session hijacking or credential theft against any visiting user including administrators. A proof-of-concept is documented in the GitHub Security Advisory; however, EPSS probability is very low (0.03%, 8th percentile) and no CISA KEV listing confirms active exploitation.

Stored cross-site scripting in Docmost's comment system allows authenticated users to plant javascript: URI hyperlinks that execute arbitrary JavaScript when victims click them. All Docmost instances prior to version 0.80.0 are affected (CPE: cpe:2.3:a:docmost:docmost:*). No active exploitation has been confirmed - SSVC exploitation status is 'none' and the vulnerability is absent from CISA KEV - and EPSS at 0.03% (8th percentile) indicates minimal real-world exploitation probability. Vendor-released patch is available in version 0.80.0.

Reflected XSS in Astro's SSR pipeline allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in victims' browsers by bypassing the incomplete `</script>` tag sanitization in the `defineScriptVars` function. All Astro versions prior to 6.1.6 running in SSR mode are affected when user-controlled input reaches a `define:vars` script block - a documented and common usage pattern. A detailed public proof-of-concept is available via GHSA-j687-52p2-xcff; EPSS is low (0.03%, 8th percentile) consistent with the required victim interaction, and no CISA KEV listing indicates no confirmed mass exploitation at time of analysis.

Reflected XSS in mailcow-dockerized's login page (all versions prior to 2026-03b) allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL. The flaw stems from two compounding issues: the raw `REQUEST_URI` server variable is rendered inside a JavaScript string literal in `base.twig` using HTML-only escaping instead of JS-context escaping, and the `query_string()` helper propagates all `$_GET` parameters into language-switching links, preserving injected payloads across page navigation. A publicly available Nuclei detection template confirms the attack surface is known; however, SSVC lists exploitation as 'none' and EPSS at 0.05% indicates no observed widespread abuse at time of analysis.

Stored cross-site scripting (XSS) in Bagisto up to version 2.3.15 allows authenticated attackers to inject malicious scripts via the Custom Scripts Handler component, which are then executed in the browsers of other users with user-interaction. The vulnerability has publicly available exploit code and affects the integrity of user sessions. Vendor has acknowledged the issue and committed to fixes in upcoming releases but no patched version has been released at time of analysis.

Reflected cross-site scripting in Bludit CMS search plugin allows unauthenticated attackers to inject arbitrary JavaScript through malicious search queries. When users visit attacker-crafted URLs containing the XSS payload, malicious scripts execute in their browsers, enabling session cookie theft and actions performed on behalf of victims. Publicly available exploit code exists; patch available via commit 6732dde.

Cross-site scripting (XSS) in WebSystems WebTOTUM 2026 Calendar component allows authenticated remote attackers to inject malicious scripts via an unknown function, requiring user interaction for exploitation. Publicly available exploit code exists, and vendor has released a patched version following responsible disclosure.

Stored cross-site scripting in Twenty CRM versions prior to 1.20.6 allows authenticated attackers to inject malicious JavaScript URIs into file block attachments via the BlockNote editor, executing arbitrary code in the browsers of users who click the malicious link. The vulnerability bypasses protocol validation in the FileBlock component and lacks server-side sanitization of block content; exploitation requires user interaction (clicking the attachment) but persistence is stored on the server, affecting all subsequent users who view the compromised document.

Reflected cross-site scripting (XSS) in October CMS backend DataTable widget allows unauthenticated remote attackers to inject arbitrary JavaScript via a query parameter, requiring user interaction to execute malicious code. The vulnerability affects versions prior to 3.7.16 and 4.1.16, with a low severity CVSS score of 3.1 reflecting the requirement for high attack complexity and user clicking a malicious link.

Stored cross-site scripting (XSS) in FreeScout prior to version 1.8.213 allows remote attackers to inject arbitrary HTML attributes into email message bodies by embedding unescaped double-quote characters in URLs. When the linkify() function converts plain-text URLs to anchor tags without proper escaping, attackers can break out of the href attribute and inject malicious JavaScript or event handlers. This requires user interaction (UI:R) to view a crafted email, but once viewed, the injected script executes in the context of the victim's session with potential for account compromise or data theft.

HTML injection vulnerability in PHP Point of Sale v19.4 allows unauthenticated remote attackers to render arbitrary HTML in victims' browsers via the '/reports/generate/specific_customer' endpoint, affecting the 'start_date_formatted' and 'end_date_formatted' parameters. User interaction is required (victim must visit a crafted link), limiting impact to stored/reflected XSS scenarios. No public exploit code or active exploitation has been confirmed at the time of analysis.

Reflected cross-site scripting (XSS) in Semantic MediaWiki 5.0.2 allows unauthenticated remote attackers to inject malicious JavaScript via the '/index.php/Speciaal:GefacetteerdZoeken' endpoint parameter. A victim visiting an attacker-crafted URL executes arbitrary JavaScript in their browser, enabling session cookie theft or unauthorized actions on behalf of the user. User interaction (clicking the link) is required. No public exploit code or active exploitation has been identified at time of analysis.

Reflected cross-site scripting in Navigate CMS allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers via unsanitized query parameters in the /blog endpoint. The vulnerability affects Navigate CMS versions 0 through 2.9.5 and requires user interaction (clicking a malicious link). CVSS 5.1 reflects the limited scope (only session/cookie theft) and mandatory user interaction, though exploitation is straightforward for phishing campaigns.

Reflected cross-site scripting (XSS) in the Website LLMs.txt WordPress plugin versions up to 8.2.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'tab' parameter due to improper use of filter_input() without sanitization and insufficient output escaping. Exploitation requires social engineering an administrator to click a malicious link, but once successful grants the attacker ability to execute scripts in the admin's browser session with access to sensitive WordPress functions and data.

Stored cross-site scripting in Website LLMs.txt plugin for WordPress versions up to 8.2.6 allows authenticated administrators to inject arbitrary JavaScript into plugin settings that executes when any user visits affected pages. The vulnerability requires high privilege level (PR:H) and occurs only in multi-site installations or where unfiltered_html capability is disabled. No public exploit code or active exploitation has been identified.

Reflected cross-site scripting (XSS) in Dovestones ADPhonebook versions below 4.0.1.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser via the search parameter of the /ADPhonebook?Department=HR endpoint. User input is reflected without proper encoding. Publicly available exploit code exists, though CISA KEV status is not confirmed, and CVSS 6.1 with UI:R indicates user interaction is required for successful exploitation.

Stored Cross-Site Scripting in wpDataTables WordPress plugin (all versions up to 6.5.0.4) allows unauthenticated attackers to inject malicious scripts into data tables via insufficient input sanitization in LinkWDTColumn, ImageWDTColumn, and EmailWDTColumn classes. Exploitation requires an Administrator to import attacker-controlled data with affected column types configured, but once injected, the malicious script executes for all users viewing the infected page. No public exploit code or active exploitation confirmed at time of analysis.

Stored XSS in Image Source Control Lite WordPress plugin versions up to 3.9.1 allows authenticated attackers with Author-level permissions or higher to inject malicious scripts via the 'Image Source' attachment field, executing arbitrary JavaScript in the browsers of any user viewing affected pages. The vulnerability stems from insufficient input sanitization and output escaping in the attachment metadata handler. No public exploit code or active exploitation has been confirmed at the time of analysis, but the low attack complexity and network accessibility make this a practical risk for multi-author WordPress installations.

GFI HelpDesk before version 4.99.9 contains a stored cross-site scripting vulnerability in language management where the charset POST parameter is not HTML-sanitized before being rendered by the View_Language.RenderGrid() function. An authenticated administrator can inject arbitrary JavaScript through the charset field when creating or editing a language, with the payload executing in the browsers of other administrators viewing the Languages page. This is a medium-risk vulnerability limited to authenticated administrators but affecting any admin viewer.

GFI HelpDesk before version 4.99.9 allows authenticated administrators to inject stored cross-site scripting (XSS) payloads via the companyname parameter in template group creation and editing, with malicious scripts executing in the browsers of other administrators viewing the Templates > Groups page. The attack requires administrative credentials and user interaction (victim viewing the affected page), but succeeds against all administrator accounts with access to that interface.

Stored cross-site scripting in GFI HelpDesk before version 4.99.9 allows authenticated staff members to inject arbitrary JavaScript via the Troubleshooter step subject field, with execution occurring when any user views the affected step. The vulnerability stems from unsanitized POST parameter handling in Controller_Step.InsertSubmit() and EditSubmit() methods, enabling persistent payload storage and broad user impact within the application.