Cross-Site Scripting

Stored XSS in Adobe Commerce and Magento Open Source enables a low-privileged attacker to inject persistent malicious JavaScript into vulnerable form fields, which executes in a victim's browser upon page visit - with scope change allowing script execution beyond the vulnerable component's security boundary, potentially enabling full account or session takeover. The CVSS 8.7 High score reflects network accessibility, low complexity, changed scope, and high confidentiality and integrity impact. No active exploitation (KEV) or public POC has been identified at time of analysis; Adobe released patched August 2026 builds across all affected product lines per advisory APSB26-92.

Privilege escalation via stored cross-site scripting in Microsoft SharePoint Server allows an authenticated low-privileged attacker to elevate their rights over a network by injecting malicious script that executes in a victim's browser session. Affected products include SharePoint Server 2019 and Subscription Edition with specific unpatched builds. No active exploitation has been confirmed - SSVC rates exploitation as none, EPSS stands at 0.42% (35th percentile), and the CVE is not listed in CISA KEV - though the CVSS-rated technical impact is classified as total due to high confidentiality and integrity compromise enabled by the scope change.

Cross-site scripting in Microsoft Office SharePoint lets a remote, unauthenticated attacker inject script that executes in a victim's browser session to conduct spoofing, provided the victim is lured into interacting with the malicious content. Microsoft rates it 9.3 (Critical) with a scope-changed vector, reflecting that injected script escapes into the victim's authenticated SharePoint context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Cross-site scripting in Microsoft Teams for Android (versions below 1.0.76.202611302) enables an authenticated attacker to inject and render malicious content within a target user's Teams client, achieving spoofing of interface elements or participants over the network. The scope-changed CVSS vector (S:C, C:H) indicates the vulnerability can expose data beyond the Teams application boundary - potentially including session tokens or cross-context information - when a victim views attacker-controlled content. No public exploit code has been identified and SSVC classifies exploitation as none, though the high confidentiality impact warrants prioritized patching for organizations reliant on Teams for sensitive communications.

Privilege elevation via stored/reflected cross-site scripting in Microsoft Azure Storage Explorer (versions prior to 20260730.9) lets a remote attacker inject script that executes in a victim's session when they view attacker-influenced content, enabling scope-changing takeover of the application context. Rated CVSS 9.6 because the scope change (S:C) lets injected code cross the security boundary of the Electron-based client, though exploitation requires the victim to interact with the malicious content (UI:R). No public exploit has been identified at time of analysis; EPSS is a modest 0.81% (54th percentile).

Cross-site scripting in Adobe ColdFusion 2023 and 2025 enables arbitrary code execution in the context of an administrative user when a victim opens a crafted malicious file. The vulnerable component is restricted to the administrative network zone by default (AV:A), limiting exposure to internal or VPN-connected segments, but the scope change (S:C) with full CIA impact confirms that successful exploitation can cascade beyond the immediate ColdFusion application context. No public exploit has been identified at time of analysis; however, Adobe's advisory APSB26-90 confirms the RCE potential and the high severity rating of 8.8.

Broken referrer enforcement in TYPO3 CMS backend and Install Tool allows an attacker with JavaScript execution capability on any of the site's own domains to invoke privileged backend routes and Install Tool endpoints using an authenticated victim's session. The regression was introduced in TYPO3 13.0.0 when both the backend and Install Tool were moved to serve from the site root entry point rather than the dedicated `/typo3/` subdirectory, causing the `ReferrerEnforcer` to accept any same-origin Referer header as legitimate backend traffic. Affected versions are TYPO3 CMS 13.0.0-13.4.33 and 14.0.0-14.3.5; no public exploit code has been identified at time of analysis.

Stored cross-site scripting in Discourse's Chat plugin allows an authenticated user to inject arbitrary HTML and JavaScript into any viewer's browser session by embedding a malicious payload in the username field of a chat-transcript quote block. The Rich Text Editor rendered the username attribute via `innerHTML` without sanitization, meaning any authenticated Discourse member with chat access could craft a quote block that executes attacker-controlled script when a victim - potentially a moderator or administrator - views the transcript. Patch versions 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0 are confirmed released; no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Stored XSS in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to persist malicious JavaScript in the application by uploading an SVG file as a profile avatar. The avatar upload pipeline trusts the client-supplied filename to determine both the stored file extension and the S3 content-type header, so a crafted SVG containing a script element is stored and later served with a permissive content type. Any user who subsequently views the attacker's profile or avatar triggers execution of the injected script in their browser, enabling session theft or further client-side attacks. No public exploit code has been identified at time of analysis.

Stored cross-site scripting in the Autopay WordPress plugin before 5.0.1 permits unauthenticated attackers to permanently inject arbitrary JavaScript into a site's checkout page by exploiting a missing capability check and nonce validation on a styling option endpoint. The injected payload executes in the browser of every visitor - including administrators - who loads the checkout page, enabling session hijacking, credential theft, or unauthorized admin actions. A publicly available exploit exists; EPSS is low at 0.17% (7th percentile), suggesting limited observed mass exploitation despite the public proof-of-concept.

Stored cross-site scripting in lakeFS Web UI allows an authenticated contributor to execute arbitrary JavaScript in any other user's authenticated browser session. The renderer for `.md` objects and `README.md` files in both the open-source edition (< 1.81.1) and Enterprise edition (< 1.84.0) passes Markdown-derived HTML to the DOM without sanitization, making any writable branch a potential injection point. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and automatic rendering of `README.md` on directory browse materially lower the barrier to exploitation for any insider or contributor with write access.

Reflected XSS on the WordPress login page allows remote unauthenticated attackers to inject and execute malicious scripts in a victim's browser via specially crafted URLs, with a conditional escalation path to remote code execution. All WordPress versions are affected; exploitation requires active social engineering and explicit victim interaction, and the RCE escalation pathway depends on conditions outside the attacker's direct control. No public exploit has been identified at time of analysis; WordPress 7.0.3 and backported branch releases resolve the vulnerability.

Stored XSS in SP Page Builder (Joomla extension by JoomShaper) prior to version 6.7.0 allows unauthenticated remote attackers to persist arbitrary JavaScript in a Joomla site's database via a single HTTP request to the Shapes API endpoint. When any administrator subsequently opens the SP Page Builder editor, the payload executes automatically in their browser session, enabling session hijacking, credential theft, or full backend site compromise. No public exploit or CISA KEV listing has been identified at time of analysis, but the unauthenticated injection vector combined with automatic detonation on routine admin activity makes this a high-priority patch target for any Joomla installation running this extension.

Arbitrary file write in the Webbox component of Tobit Laboratories AG TeamDavid (through Rollout 524) allows unauthenticated remote attackers to create or overwrite server-side files with attacker-controlled content, enabling persistent stored cross-site scripting. Because user input is written directly to disk without content or file-type validation, an attacker can plant .htm files containing malicious JavaScript that execute in any victim's browser upon access. No public exploit has been identified at time of analysis and the vulnerability is not in CISA KEV, but the unauthenticated write primitive combined with stored XSS persistence makes this a high-priority remediation target for TeamDavid operators.

Reflected cross-site scripting in AIL Framework's /tag/add_tags endpoint allows unauthenticated remote attackers to execute arbitrary JavaScript in the browser of any authenticated AIL user who opens a specially crafted link. The flaw originates from the error-handling path in tags_ui.py, which returned raw Python string output via str(res[0]) directly as an HTML response without output encoding, permitting attacker-controlled content to be reflected and rendered by the victim's browser. No public exploit code or CISA KEV listing has been identified at time of analysis; an upstream fix has been committed to the GitHub repository.

Stored cross-site scripting in OpenReception appointment-booking-software prior to version 1.0.2 allows a TENANT_ADMIN to plant malicious `javascript:` URIs in tenant link fields (`website`, `imprint`, `privacyStatement`), which execute in patients' browsers when they click the rendered links on the public landing page. The critical impact is not merely XSS but a complete collapse of the platform's stated end-to-end encryption guarantee: JavaScript executing in the patient origin can intercept and exfiltrate plaintext form data before client-side encryption is applied, meaning a malicious tenant administrator can silently read patient health appointment data the product claims the server can never access. No confirmed active exploitation (no CISA KEV entry) and no public POC have been identified at time of analysis.

Arbitrary JavaScript execution in PDF.js (pdfjs-dist) allows an attacker to run unrestricted script in the context of any web application that renders attacker-controlled PDFs with default settings. The flaw stems from PDF.js's built-in scripting engine, which is enabled by default via the enableScripting flag, executing embedded JavaScript from PDFs without sandbox enforcement when no script-src CSP is present. Applications using pdfjs-dist versions 5.6.83 through 6.2.107 are affected; no public exploit or KEV listing is identified at time of analysis, but the default-on configuration makes real-world exposure broad.

Cross-site scripting in WooCommerce Multilingual & Multicurrency plugin for WordPress (all versions through 5.5.6) allows subscriber-level users to inject and store malicious JavaScript payloads that execute in the context of other users' browsers, including site administrators. The scope-changed CVSS vector (S:C) indicates the script runs outside the plugin's own security context, enabling session hijacking, credential theft, or administrative account takeover. Reported by Patchstack as EUVD-2026-53914; no public exploit code or CISA KEV listing identified at time of analysis.

Unauthenticated cross-site scripting in the Facebook for WooCommerce WordPress plugin version 3.7.5 and earlier allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any prior authentication. The scope change (S:C) in the CVSS vector confirms the script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against WooCommerce store visitors or administrators. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog.

Cross-site scripting in the Facebook for WordPress plugin (versions up to and including 5.2.1) allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by delivering a crafted URL or page. The CVSS vector confirms no authentication is required (PR:N) and that the attack crosses into the victim's browser security context (S:C), enabling session hijacking, credential harvesting, or page defacement against any user who interacts with the malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis, but the plugin's broad commercial deployment on WordPress sites significantly amplifies real-world exposure.

Unauthenticated Cross-Site Scripting in the Rank Math SEO WordPress plugin (versions up to and including 1.0.274.1) allows remote attackers to inject arbitrary scripts into pages rendered in the browsers of site visitors or administrators without holding any authenticated session. The CVSS 3.1 score of 7.1 (AV:N/AC:L/PR:N/UI:R/S:C) reflects changed scope - meaning a successful attack can affect browser contexts beyond the plugin itself, enabling session hijacking against logged-in WordPress administrators. No public exploit code and no CISA KEV listing are confirmed at time of analysis, but the unauthenticated attack surface on one of the most widely deployed WordPress SEO plugins elevates practical urgency.

Unauthenticated cross-site scripting in the Thrive Architect WordPress page builder plugin (versions up to and including 10.9.3.1) allows remote attackers to inject and execute arbitrary JavaScript in victims' browsers without any authentication. The CVSS vector confirms a scope change (S:C), meaning injected scripts run in a browser security context separate from the plugin itself - enabling session hijacking, credential theft, or unauthorized actions on behalf of authenticated users such as administrators. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the source intelligence.

Unauthenticated cross-site scripting in GiveWP WordPress plugin versions 4.16.5 and earlier allows a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser by tricking them into interacting with a crafted request or link. The changed scope (S:C) indicates the injected script executes in the browser context outside the plugin's own origin, enabling session hijacking, credential theft, or malicious redirects targeting authenticated site administrators or donors. No active exploitation has been confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Reflected Cross-Site Scripting in SEO Plugin by Squirrly SEO versions up to and including 14.2.0 allows unauthenticated network attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into visiting a crafted URL. The scope change in the CVSS vector (S:C) indicates the injected script can access resources beyond the plugin's immediate context, enabling session hijacking, credential theft, or malicious redirects against WordPress site visitors and administrators alike. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis, but the unauthenticated attack vector with low complexity makes this straightforward to weaponize once a target is identified.

Unauthenticated reflected cross-site scripting in WP Data Access WordPress plugin (versions up to and including 5.5.79) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into a victim's browser session by tricking them into clicking a crafted URL. The CVSS scope change (S:C) indicates the malicious script executes outside the plugin's direct security context - within the victim's browser - enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code or CISA KEV listing has been identified at time of analysis, though the unauthenticated entry point and low attack complexity make this accessible to low-skilled attackers.

Unauthenticated cross-site scripting (XSS) in the Events Manager WordPress plugin versions 7.4.1 and earlier enables remote attackers without credentials to inject arbitrary JavaScript into pages rendered for other users. The CVSS 7.1 score is driven by a scope change (S:C), meaning injected scripts execute in victims' browsers outside the plugin's security context - enabling session hijacking, credential theft, or unauthorized actions performed on behalf of authenticated users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated network-accessible attack vector significantly lowers the bar for opportunistic targeting of any WordPress site running this plugin.

Cross-site scripting in WPIDE - File Manager & Code Editor (WordPress plugin by xplodedthemes, versions ≤ 3.5.7) permits unauthenticated remote attackers to inject and execute arbitrary JavaScript in the browsers of users who visit a page containing the malicious payload. The CVSS scope change (S:C) indicates the injected script executes beyond the plugin's own security context, enabling session hijacking, credential theft, or unauthorized actions on behalf of the victim user - particularly damaging if the victim is an authenticated WordPress administrator with access to file management and code editing features. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.

Unauthenticated Cross-Site Scripting in the Survey Maker WordPress plugin (versions <= 5.2.3.3) permits remote attackers without any credentials to inject arbitrary JavaScript that executes in a victim's browser when they interact with an affected survey page. The CVSS Changed scope (S:C) confirms the payload crosses from the plugin context into the victim's browser session, enabling session cookie theft, credential harvesting, or unauthorized actions performed on behalf of the victim. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated stored or reflected Cross-Site Scripting in the Houzez Property Feed WordPress plugin (versions <= 2.5.48) allows remote unauthenticated attackers to inject arbitrary JavaScript into pages served to victims. The CVSS scope change (S:C) confirms the malicious script executes in the victim's browser context beyond the plugin's own trust boundary, enabling session hijacking, credential theft, or administrative account takeover if a privileged user is targeted. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting in the AI Engine WordPress plugin (versions up to and including 3.6.8) allows remote unauthenticated attackers to inject arbitrary JavaScript into a victim's browser session when the victim interacts with a crafted payload. The CVSS scope change (S:C) confirms execution occurs outside the plugin's security context, enabling session hijacking, credential theft, or unauthorized administrative actions against authenticated WordPress users. No public exploit code has been confirmed and this vulnerability does not appear in the CISA KEV catalog at time of analysis.

Unauthenticated XSS in the Super Socializer WordPress plugin (versions 7.14.5 and earlier) allows remote attackers to inject arbitrary JavaScript into pages viewed by other users without any prior authentication. The scope change (S:C in the CVSS vector) confirms the payload executes outside the plugin's own origin, enabling session theft, credential harvesting, or malicious redirects against site visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and zero authentication requirement lower the bar for opportunistic exploitation.

Unauthenticated cross-site scripting in the Easy PayPal Buy Now Button WordPress plugin (versions ≤ 2.0.4) allows remote, unauthenticated attackers to inject arbitrary JavaScript that executes in the browsers of users who load the affected page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) reflects low-complexity network exploitation requiring no credentials, with a scope change that impacts the victim's browser context across confidentiality, integrity, and availability dimensions, yielding a score of 7.1. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.

Unauthenticated XSS in the AffiliateWP WordPress plugin (versions ≤ 2.35.0) allows remote attackers to inject malicious scripts that execute in victims' browsers, with scope change (S:C) indicating the injected code crosses the plugin's security boundary into the broader browser session. Exploitation requires a victim to interact with a crafted link (UI:R), meaning fully automated drive-by attacks are not possible, but a phishing or malicious-link delivery campaign could enable session hijacking or administrative action abuse against authenticated WordPress users. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated stored or reflected cross-site scripting in the Simply Schedule Appointments WordPress plugin (versions up to and including 1.6.12.10) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages viewed by victims. The CVSS scope-changed vector (S:C) indicates the injected script executes in the victim's browser context, enabling session hijacking, credential theft, or malicious redirects against authenticated users - including WordPress administrators. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated attack path lowers the barrier for opportunistic exploitation significantly.

Unauthenticated cross-site scripting in wpDataTables WordPress plugin (versions up to and including 7.5.1) allows remote attackers to inject and execute arbitrary JavaScript in a victim's browser without any authentication. The CVSS vector (PR:N, S:C) confirms the attacker requires no login to submit a malicious payload, while the scope change indicates script execution crosses into the victim's authenticated browser session - enabling session hijacking, credential theft, or admin-level actions on behalf of a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the unauthenticated and low-complexity nature of the attack makes it a practical risk for any site running the affected plugin with public-facing table inputs.

Unauthenticated cross-site scripting in SiteGuard WP Plugin versions up to and including 1.8.6 allows a remote, unauthenticated attacker to inject arbitrary JavaScript that executes in the browser of a user who interacts with the crafted content. The changed scope (S:C in CVSS) indicates the injected script runs in the victim's browser security context rather than the server's, enabling session hijacking, credential theft, or unauthorized administrative actions on the WordPress site. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Unauthenticated cross-site scripting in the Ninja Tables WordPress plugin (versions up to and including 5.2.9) enables remote attackers to inject arbitrary JavaScript into victim browsers without any prior authentication. The CVSS vector (PR:N, UI:R, S:C) confirms the attack crosses scope boundaries into the victim's browser session, making session hijacking, credential theft, or admin-context exploitation realistic outcomes. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the zero-privilege requirement significantly lowers the bar for opportunistic targeting of WordPress installations running this plugin.

Unauthenticated Cross-Site Scripting (XSS) in the Media Library Assistant WordPress plugin affects all versions up to and including 3.38, allowing remote attackers without any authentication to inject malicious scripts into pages viewed by victims. The scope change indicated by the CVSS vector (S:C) suggests the injected script executes in a security context beyond the plugin itself, potentially enabling session hijacking, credential theft, or malicious redirects against authenticated WordPress users including administrators. No public exploit code or active exploitation has been confirmed at time of analysis, but the unauthenticated nature and low attack complexity elevate practical risk on exposed WordPress installations.

Unauthenticated reflected Cross-Site Scripting (XSS) in the EmbedPress WordPress plugin affects all versions up to and including 4.5.6, allowing a remote unauthenticated attacker to inject and execute arbitrary JavaScript in a victim's browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) confirms the attack requires no authentication and succeeds on default configurations, though a victim must be socially engineered into clicking a crafted link. No public exploit code or CISA KEV listing has been identified at time of analysis, but the unauthenticated nature and low attack complexity make this accessible to opportunistic threat actors targeting WordPress-based sites.

Unauthenticated Cross-Site Scripting in the Popup Maker WordPress plugin (versions up to and including 1.23.0) allows any remote, unauthenticated attacker to inject malicious JavaScript that executes in the browser of any user who views the affected popup content. The CVSS vector S:C (scope change) confirms the injected script crosses a security boundary, enabling session hijacking, credential theft, or admin-level actions performed on behalf of the victim. No public exploit has been identified at time of analysis, and no CISA KEV listing is present, but the unauthenticated trigger surface (PR:N) makes this a tangible risk for any WordPress site running the affected plugin.

Cross-site scripting in Forminator WordPress plugin (WPMU DEV) versions up to and including 1.56.0 enables unauthenticated remote attackers to inject arbitrary JavaScript into pages rendered by affected WordPress installations. The CVSS vector (PR:N, S:C) confirms no authentication is required to plant the payload, while victim interaction (UI:R) is necessary for execution - consistent with a stored or reflected XSS pattern where a privileged user (e.g., site administrator) must view attacker-controlled content. No public exploit code or active exploitation has been identified at time of analysis; this is a researcher-reported disclosure via Patchstack.

Unauthenticated cross-site scripting in the NextGEN Gallery WordPress plugin (versions <= 4.2.3) allows a remote, unauthenticated attacker to inject arbitrary JavaScript into pages rendered for other users. The scope change (S:C) in the CVSS vector indicates the malicious script executes in the victim's browser context rather than being contained to the plugin itself, enabling session hijacking, credential theft, or malicious redirects against site visitors or administrators. No public exploit code or CISA KEV listing has been identified at time of analysis.

Unauthenticated Cross-Site Scripting in JetEngine WordPress plugin (versions 3.8.13.1 and below) allows a remote, unauthenticated attacker to inject malicious JavaScript that executes in a victim's browser after social-engineering them into visiting a crafted URL or interacting with attacker-controlled content. The vulnerability carries a CVSS 7.1 score with a changed scope (S:C), meaning successful exploitation can breach the security context of the victim's browsing session - enabling session hijacking, credential theft, or administrative action execution when the victim is a logged-in WordPress user. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WordPress sites running this plugin.

Stored XSS in the TranslatePress WordPress plugin (all versions ≤3.2.6) enables unauthenticated attackers to inject persistent malicious scripts via comment content containing URL-encoded gettext markers. The bypass technique is noteworthy: the payload exclusively uses WordPress-permitted HTML tags and attributes with percent-encoded characters, causing it to pass the platform's built-in wp_kses sanitization untouched before TranslatePress's translation rendering engine processes and outputs it unescaped. The injected script executes in every visitor's browser on any page displaying the poisoned comment. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; vendor-released patch is version 3.3.

Stored XSS in the Forminator Forms WordPress plugin (≤1.56.1) permits unauthenticated attackers to permanently inject arbitrary JavaScript into pages by exploiting two compounding logic flaws: sanitize_array() silently skips all filtering for keys prefixed with 'select-', and set_field_data() treats a user-supplied 'return' member as a trusted internal flag, allowing a forged upload record with a malicious file_url to be persisted in the database. Because the payload is stored rather than reflected, a single unauthenticated HTTP request creates a persistent script that executes in every subsequent visitor's browser on the affected page. No public exploit code or CISA KEV listing is confirmed at time of analysis, though Wordfence's disclosure provides sufficient technical specificity to reconstruct the attack.

Stored XSS in FluentSMTP (WordPress plugin) versions up to and including 2.2.95 allows unauthenticated attackers to persist malicious scripts inside the plugin's Email Log detail view by controlling the recipient display name (to.name) field in any wp_mail() invocation. The payload bypasses the escapeHtml sanitization applied by the log list view and fires exclusively in the detail view when an administrator uses the Prev/Next navigation controls, meaning the attack surface is narrower than the CVSS UI:N vector implies. No public exploit code or CISA KEV listing has been identified; a patched version (2.3.0) is confirmed available via the WordPress plugin repository.

Stored/reflected cross-site scripting in the Query Console of Progress MarkLogic Server (versions before 11.3.6 and 12.0.3) lets a remote, unauthenticated attacker execute arbitrary JavaScript in the browser of an authenticated administrator who is lured to a crafted URL. Because the payload runs with the admin's authenticated session, it can harvest credentials/session tokens and perform privileged database and configuration actions on the admin's behalf. Rated CVSS 9.3 (scope-changed); no public exploit identified at time of analysis and not listed in CISA KEV.

Stored Cross-Site Scripting in the Independent Analytics WordPress plugin (≤2.15.0) permits unauthenticated attackers to plant persistent malicious scripts via the 404 not_found_url tracking mechanism. The flaw exploits a broken sanitization sequence in get_cell_content(): esc_url() encodes special characters as safe URL entities, but a subsequent urldecode() call reconstructs raw HTML before rendering - and wp_kses_post() fails to strip the resulting markup because it explicitly permits img elements and data-* attributes. The attack entry point, the /iawp/search REST endpoint, accepts requests signed with a token that is itself embedded in public-facing page HTML, making injection effectively unauthenticated. No public exploit code has been identified at time of analysis, and this CVE is not listed in CISA KEV.

Stored cross-site scripting in Uptime Kuma's Matomo analytics integration allows an admin or editor-level user to inject arbitrary JavaScript into every public status page by saving a crafted `siteId` value. The escaping pipeline in `server/analytics/matomo-analytics.js` - combining `jsesc` with `isScriptContext:true` and `html-escaper.escape()` - fails to neutralize JavaScript syntax characters (`]`, `)`, `;`, `(`), which are sufficient to break out of the `_paq.push(['setSiteId', ...])` expression context. Every unauthenticated visitor of any `/status/<slug>` page subsequently executes the attacker-controlled JavaScript, enabling session cookie theft and full page takeover. No public exploit has been independently confirmed, though the disclosure includes a functional proof-of-concept payload; no KEV listing exists at time of analysis.

Stored XSS in OpenBK7231T firmware allows an adjacent-network attacker with MQTT broker access - commonly unauthenticated in real IoT deployments - to inject persistent JavaScript payloads into device channel labels via the SetChannelLabel MQTT command. The malicious label survives device reboots in memory and executes in the browser of every user who subsequently views the device's built-in web management panel, with high confidentiality and integrity impact in a changed scope. No public exploit has been identified at time of analysis, but the unauthenticated MQTT broker pattern common in home automation environments effectively lowers the practical exploitation barrier below what the AV:A vector alone implies.

Stored XSS in Grocy's API layer allows authenticated users to permanently inject arbitrary script tags into shared application data, executing in the browsers of any user who views affected records. The vulnerability spans all API-writable resource types - products, recipes, stock entries, user records, and chores - making it broadly exploitable across the application. The CVSS score of 8.7 with Scope:Changed reflects the cross-user impact characteristic of stored XSS: a single low-privileged write yields high confidentiality and integrity impact against other users' sessions. No public exploit code or CISA KEV listing is identified at time of analysis.

Stored XSS in InvoiceNinja v5-stable allows an authenticated user with invoice creation access to inject arbitrary JavaScript into the invoice terms field, which executes in a business client's browser when they view the invoice in the client portal. The attack leverages Laravel Blade's raw unescaped output directive in `resources/views/portal/ninja2020/invoices/includes/terms.blade.php`, with no HTML sanitization performed in `StoreInvoiceRequest.php`, enabling session cookie theft and full client account takeover. This is a distinct code path from the previously published CVE-2026-33628 (line-item description XSS), and no public exploit has been identified at time of analysis.

Cross-site request forgery in Pluck CMS's admin panel lets a remote attacker force a logged-in administrator's browser to execute forged admin.php actions, escalating to stored XSS (via raw-HTML page creation) and remote code execution (via malicious PHP module/theme installation). The admin area protects every action solely with a Referer-header check and ships no anti-CSRF tokens; because an attacker page can suppress the Referer header, the check's fallback branch treats headerless requests as same-origin and is bypassed. No public exploit or CISA KEV listing exists yet, but the CVSS 9.6 rating and trivial bypass make this a high-priority issue for exposed installs.

Stored Cross-Site Scripting in the Bit Form WordPress plugin before 3.2.0 enables unauthenticated attackers to upload crafted SVG files containing embedded JavaScript as signature images, which execute in a victim's browser upon viewing the submission. Any authenticated user - most critically a WordPress administrator - who reviews form submissions containing the malicious SVG is at risk of session hijacking or unauthorized administrative action. A public proof-of-concept is available per WPScan; however, EPSS stands at 0.18% (8th percentile) and CISA KEV does not list active exploitation, indicating real-world opportunistic exploitation has not been widely observed.

Stored Cross-Site Scripting in VikRentItems - Flexible Rental Management System (WordPress plugin, versions up to and including 1.2.1) allows unauthenticated attackers to inject persistent JavaScript via the customer email field of the public booking checkout form. The payload is stored in the database through the saveorder() function and executes in the browser of any authenticated user - including administrators - who subsequently views the affected order record in the WordPress admin panel. No public exploit or CISA KEV listing has been identified at the time of analysis, but the unauthenticated injection vector and admin-context execution make this a meaningful privilege escalation path on affected sites.

Stored cross-site scripting in Open WebUI 0.10.0-0.10.2 allows any authenticated user to craft a math block that causes a KaTeX RangeError (stack overflow from deeply nested braces), forcing the KatexRenderer.svelte error fallback to inject unescaped HTML directly into the DOM via Svelte's `{@html}` directive. Any user who subsequently views the message - including administrators - executes attacker-controlled JavaScript on the Open WebUI origin, enabling session token theft from localStorage and full account takeover. A detailed, weaponizable proof-of-concept is publicly documented in the vendor GHSA advisory, including demonstrated administrator session exfiltration; no CISA KEV listing has been identified at time of analysis.

Stored XSS in CVAT annotation guide asset handling (versions 2.5.0-2.66.0) allows an authenticated attacker to upload a file with an attacker-controlled Content-Type header; CVAT then serves the asset with that header intact, causing a victim's browser to render the file as an HTML page and execute any embedded JavaScript. The attack targets collaborative annotation workflows where guides are shared across users or teams, enabling session hijacking, credential theft, or unauthorized actions within the victim's browser context. No public exploit has been identified at time of analysis, and this CVE is not listed in CISA KEV. The vendor-released fix is version 2.67.0.

The terminal file-preview feature in Open WebUI 0.9.0 through 0.10.2 allows an authenticated attacker with access to a configured terminal server to execute arbitrary scripts in the application's own browser origin by exploiting a hardcoded iframe sandbox misconfiguration, enabling full session token theft and account takeover. The `serveUrl` iframe branch unconditionally combined `allow-same-origin` with `allow-scripts` for HTML files served from the application's own domain, completely negating iframe sandbox isolation regardless of user settings. In the highest-impact scenario, if the victim holds admin privileges or `workspace.functions`, the account takeover extends to server-side code execution on the Open WebUI host. No public exploit has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; a vendor patch is available in version 0.11.0.

Cross-site scripting in the Angular compiler's i18n pipeline allows arbitrary JavaScript injection into localized application builds when event-handler attributes such as `onerror` or `onclick` are marked for translation using `i18n-on*` template directives. Angular's standard `validateAttribute()` and `validateProperty()` guards block binding to event-handler attributes at runtime, but the `I18nMetaVisitor` code path in `packages/compiler/src/render3/view/i18n/meta.ts` contained no equivalent restriction, enabling a lower-trust translation file to replace a benign handler with executable JavaScript at compile time. Patched versions 22.0.1, 21.2.19, and 20.3.27 are available; no public exploit has been identified at time of analysis.

Cross-site scripting in @angular/platform-server's domino DOM emulation library allows attackers to inject executable script blocks into SSR-rendered HTML by supplying closing-tag sequences inside user-controlled data bound to <iframe>, <noembed>, <noframes>, or <noscript> Angular template elements. Angular 20.x through 22.x applications using Server-Side Rendering that reflect user input into these specific fallback raw-content elements are affected; Angular 19.x and earlier receive no backport patch. No public exploit has been identified at time of analysis, though the mechanism is straightforward once the vulnerable application pattern is present, and patches are available across three supported Angular branches.

Multiple authentication bypass vulnerabilities in @better-auth/sso before version 1.6.21 enable low-privileged attackers to take over arbitrary user accounts via four distinct attack paths: domain verification parsing mismatches, orphaned SSO provider accounts, unbound SAML assertions, and reflected XSS on logout endpoints. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) with VC:H/VI:H confirms high confidentiality and integrity impact with no availability loss. No public exploit has been identified at time of analysis and no CISA KEV listing exists, but the multiplicity of bypass vectors significantly raises the probability that any given deployment is exploitable through at least one path.

Stored Cross-Site Scripting in the MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder WordPress plugin (all versions through 4.3.3) allows unauthenticated network attackers to plant arbitrary JavaScript via form field values submitted to the plugin's form endpoints. The payload is persisted to the database and fires in any authenticated or unauthenticated user's browser upon visiting the injected page, with scope change confirmed by CVSS S:C. No active exploitation has been confirmed by CISA KEV, but Wordfence's disclosure includes direct references to the vulnerable source lines, effectively providing a functional roadmap to exploitation. The EPSS probability is not provided in the source data.

Reflected XSS in the Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin (all versions before 5.0.0) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by exploiting an AJAX endpoint that lacks both nonce validation and capability checks. A publicly available exploit exists per WPScan, lowering the bar for abuse, though EPSS sits at just 0.17% (7th percentile) and CISA has not added this to KEV - suggesting opportunistic rather than widespread active exploitation. The scope-changed CVSS vector (S:C) reflects that a successful attack breaks out of the plugin context into the victim's browser session, enabling session hijacking or credential theft against authenticated WordPress users.

Stored cross-site scripting in the Frontend Admin by DynamiApps WordPress plugin (all versions before 3.29.9) allows unauthenticated visitors to permanently inject executable script content into site storage by exploiting a double-encoding sanitization bypass. The flaw arises because the plugin re-decodes HTML entities after sanitization, resurrecting neutralized tags; the live payload is then rendered without escaping on front-end display surfaces and fires in the browser of any authenticated user — including site administrators — who later views the affected page. A publicly available proof-of-concept exists; while no active exploitation is confirmed in CISA KEV, the unauthenticated attack surface and admin-session-hijacking potential make this a meaningful priority for WordPress operators running this plugin.

Stored cross-site scripting in ComfyUI (Comfy-Org) before 0.28.0 lets an attacker upload HTML or SVG to the per-user userdata store via POST /userdata and have it served with an executable content type by GET /userdata/{file}, so a script runs in the ComfyUI origin the moment a victim opens the file URL. Because it executes same-origin, the payload can read browser-stored API tokens, settings, and workflows and issue authenticated-equivalent API calls. Rated CVSS 8.2 (High); no public exploit identified at time of analysis and it is not in CISA KEV.

Stored cross-site scripting in ComfyUI before 0.28.0 lets an attacker upload a malicious SVG that the /view endpoint serves inline in the application origin, executing arbitrary JavaScript in the browser of any user who opens it. Because image/svg+xml and related XML content types were missing from the dangerous-content-type list, uploaded markup rendered instead of downloading; a victim viewing the file triggers script that runs with full access to the ComfyUI session. No public exploit was identified at time of analysis and it is not listed in CISA KEV, but the fix commit and released version 0.28.0 are confirmed by the vendor advisory.

Stored cross-site scripting in OpenClaw Dashboard 1.1.0 lets unauthenticated remote attackers plant JavaScript in agent transcript messages that later executes in the administrator's authenticated browser session. Because the malicious message is submitted through the unauthenticated sessions API and rendered unsanitized via innerHTML on the default landing page, an attacker can steal admin session tokens and invoke privileged endpoints, including modifying agent instruction files. Publicly available exploit details exist in a dedicated advisory writeup; there is no evidence of active exploitation (not in CISA KEV), and the CVSS 4.0 base score is 8.8.

Stored cross-site scripting in OpenClaw Dashboard v3.0.0 lets an unauthenticated remote attacker seed a malicious payload simply by submitting a crafted username in a failed login attempt, which the audit log stores verbatim. When an administrator later opens the notification panel, the log entry is rendered through innerHTML under a permissive CSP that permits inline event handlers, executing the payload in the admin's authenticated session and enabling full account takeover. No public exploit was identified at time of analysis, though a dedicated write-up advisory exists; the CVSS 4.0 base score is 9.3 (Critical), reflecting the account-takeover impact.

Reflected cross-site scripting in the administrative console login page of IBM Tivoli System Automation Application Manager 4.1 (a component that also involves IBM WebSphere Application Server) allows a remote attacker to inject and execute arbitrary script in an administrator's browser session. The CVSS 3.1 vector (AV:N/PR:N/UI:R, scope-changed) yields a high 9.3 base score, but exploitation requires tricking an authenticated console user into loading a crafted URL. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; a vendor patch is available.

Stored cross-site scripting in DFIR-IRIS (iris-web) version 2.4.26 and possibly earlier lets an authenticated, low-privileged user inject persistent JavaScript through the datastore upload function that executes in the browser of any other user who later views the affected datastore content. Because the injected script runs in the security context of victims - including higher-privileged analysts and administrators of the incident-response platform - an attacker can hijack sessions, exfiltrate case data, or perform actions on the victim's behalf. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the CVSS 3.1 base score is 7.6 (scope-changed, high confidentiality impact).

Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user inject persistent JavaScript through the custom attributes function, which then executes in the browser of any analyst or administrator who later views the affected record. Because IRIS is a collaborative DFIR case-management tool, a successful payload can hijack higher-privileged sessions and exfiltrate sensitive investigation data. No public exploit identified at time of analysis; the issue was reported by SBA Research (SBA-ADV-20260126-01) and carries a CVSS 3.1 base score of 7.6.

Stored cross-site scripting in the DFIR-IRIS incident-response platform (iris-web 2.4.26 and possibly earlier) lets an authenticated low-privileged user persist malicious JavaScript through the assets function, which then executes in the browser of any other analyst who views the affected case data. Because IRIS holds sensitive investigation material and the CVSS scope is changed (S:C), a successful payload can hijack higher-privileged analyst or administrator sessions. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; disclosure comes from an SBA Research advisory (SBA-ADV-20260126-01).

Stored cross-site scripting via CSRF in the tourmaster WordPress plugin (all versions before 5.4.8) allows an unauthenticated remote attacker to permanently inject arbitrary JavaScript into the WordPress admin area by tricking a logged-in administrator into triggering a request that stores a malicious custom-filter label. A publicly available proof-of-concept exists per WPScan, though EPSS (0.12%, 3rd percentile) and SSVC (exploitation: none, non-automatable) collectively indicate no confirmed widespread active exploitation at time of analysis. No KEV listing was identified.

Stored cross-site scripting in the Fluent Forms plugin for WordPress (all versions through 6.2.7) lets unauthenticated attackers persist malicious JavaScript via a nested 'password' member submitted through the form's Name field, because the input is neither sanitized on save nor escaped on output. The script executes in the browser of anyone - including administrators - who later views a page rendering the injected submission. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the unauthenticated, network-reachable nature makes it broadly abusable against exposed forms.

Stored cross-site scripting in the GTM4WP (Google Tag Manager for WordPress) plugin, versions up to and including 1.22.3, lets unauthenticated attackers persist arbitrary JavaScript through WooCommerce billing fields (e.g. billing first name) during a guest checkout. The script executes in the browser of any user who later loads a page rendering that order data, enabling session/cookie theft and admin-context actions. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; exploitation is gated on the plugin's WooCommerce order-data integration option being enabled.

Stored cross-site scripting in the Database for CF7 WordPress plugin (all versions through 1.2.6) lets unauthenticated attackers persist arbitrary JavaScript that executes in the browser of any user who later views an affected page. The flaw is reachable through Contact Form 7's public REST feedback endpoint, which accepts array-structured field input that the plugin writes directly to its custom table without sanitization. No public exploit identified at time of analysis; issue reported by Wordfence and rated CVSS 7.2 with a scope change.

Stored Cross-Site Scripting in the WOLF WordPress plugin before 1.1.0 lets an unauthenticated attacker persist malicious script into a post by exploiting a CSRF-exposed AJAX action lacking nonce and capability checks. Because a logged-in administrator must be tricked into triggering the request (UI:R), exploitation is CSRF-driven rather than direct, but a successful attack injects attacker-controlled JavaScript that executes in the context of anyone viewing the affected post. Publicly available exploit code exists (reported by WPScan), though the EPSS score is very low (0.12%, 2nd percentile) and it is not on the CISA KEV list.

We need to produce a JSON object according to the detailed instructions. The CVE is CVE-2026-18084, BlackBerry UEM Management Console, XSS, CVSS 4.0 given, CVSS 3.1 not provided, we need to independently assess CVSS 3.1 and 4.0 vectors, prevalence, etc. First, extract from input: - product_name: "BlackBerry UEM" (precisely "UEM" or "BlackBerry UEM Management Console" but description says "BlackBerry UEM Management Console of BlackBerry UEM" so product is BlackBerry UEM, specific component Management Console). We need 1-3 words, so "BlackBerry UEM" is fine. - summary: must synthesize from multiple sources. Description: Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console allows Cross-Site Scripting (XSS). Affects UEM: 12.23.0 QF8 or earlier. CVSS 4.0: 8.6, vector AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N. CWE-79. Tags: XSS, Uem. Reported by blackberry. CPE: cpe:2.3:a:blackberry:uem:*:*:*:*:*:*:*:* References: https://support.blackberry.com/pkb/s/article/141208. No KEV, POC status unknown. So we need to write summary: start with specific impact and product. "Cross-site scripting in BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier) allows..." Actually, XSS impact: an attacker can inject malicious scripts into the web console that execute in users' browsers. Potential impact: stealing session cookies, performing actions as victim, etc. But the CVSS 4.0 VC:H/VI:H/VA:H suggests high impact to vulnerable system (confidentiality, integrity, availability), and SC:L/SI:L suggests low subsequent impact. So it's a stored or reflected XSS with high impact on management console itself. So summary: "Cross-site scripting in BlackBerry UEM Management Console (versions 12.23.0 QF8 and earlier) allows an unauthenticated attacker to inject malicious scripts via crafted input, potentially leading to unauthorized actions, data theft, or system compromise on the UEM server." Need to mention 'activel

We are instructed to synthesize data from multiple intelligence sources into a comprehensive analysis, returning a JSON object with specific fields. We must use all provided data, cross-reference, and produce original synthesis. Every field must be a plain text string, not arrays or objects. Let's extract the relevant information: - CVE ID: CVE-2026-67174 - Description: DOM-based XSS in Pivotick's generic UI element resolution and icon-rendering utilities. The `tryResolveHTMLElement` function treated resolved strings as HTML markup via `innerHTML`, allowing untrusted data to inject arbitrary HTML/SVG. Used by headers, property panels, extra panels, tooltips. `createIcon` inserted unsanitized `svgIcon` markup. Attack vector: unauthenticated attacker can provide crafted graph, property value, rendering result, or SVG icon to execute JS in another user's browser when content is displayed/interacted with. Impact: access victim's info, manipulate graph data/state, perform actions with victim's privileges. - CVSS Score: 9.2 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:H/SI:N/SA:N). Note: It says UI:N but description involves user interaction (displayed/interacted with). CVSS 4.0 has UI:N meaning no user interaction? Actually in CVSS 4.0, UI (User Interaction) measures whether the vulnerability can be exploited solely at the initiative of the attacker, or whether a separate user must perform some action. Here UI:N suggests exploitation requires no user interaction beyond the attacker sending a malicious payload and the victim simply viewing the page. However, the description says "when the affected content is displayed or interacted with" — this could be interpreted as the victim viewing the page, which is passive and counts as UI:N in CVSS 3.1 (R) but in CVSS 4.0 UI:N is for no user interaction at all? I need to check: In CVSS 4.0, UI:N means the vulnerability can be exploited without any action from any user other than the attacker. If the victim just views a p

Cross-site scripting in Pivotick via the per-node style.svgIcon property allows an attacker who can influence graph data to execute arbitrary JavaScript in the context of the embedding application. Affects Pivotick versions up to 1.4.0. No active exploitation or public exploit reported at time of analysis, but the CVSS 4.0 base score is 8.2.

Stored cross-site scripting in StoreGrowth Sales Booster for WooCommerce allows unauthenticated attackers to inject web scripts via the 'message_popup' AJAX parameter. The vulnerability arises because the required nonce is exposed to all frontend visitors, completely bypassing the intended access control. Exploitation leads to arbitrary script execution in the browsers of any user who views an injected popup page, compromising session data and site integrity.

We need to generate a JSON object with the specified fields, synthesizing all provided data about CVE-2026-14870. First, parse the input: CVE ID: CVE-2026-14870 Description: The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. CVSS Score: 7.1 CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L CWE: CWE-79 EPSS: 0.15% (percentile 5%) POC/Exploit: Publicly available Patch: Available from vendor Reported by: WPScan CPE: cpe:2.3:a:unknown:database_for_contact_form_7,_wpforms,_elementor_forms:*:*:*:*:*:*:*:* Tags: XSS, WordPress, Database For Contact Form 7 Wpforms Elementor Forms SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial ENISA EUVD ID: EUVD-2026-49701 Affected versions (EUVD): ["Database for Contact Form 7, WPforms, Elementor forms 0 <1.5.3"] References: [cveorg] (exploit) https://wpscan.com/vulnerability/d574b78c-df04-4dab-bd33-e3a22ff51918/ [euvd] (advisory) https://nvd.nist.gov/vuln/detail/CVE-2026-14870 Now, construct each field as a paragraph string. product_name: The plugin name is "Database for Contact Form 7, WPforms, Elementor forms". So product_name: "Database for Contact Form 7, WPforms, Elementor forms" – but that's long, but permissible as a product name. The task says "1-3 words ONLY." That's problematic because the product name is longer. I need to pick a short name. The plugin's main purpose: it's a database plugin for those form plugins. Maybe "WordPress Forms Database" or "Database for CF7, WPforms, Elementor Forms"? But I must keep it 1-3 words. The plugin name as per WPScan: "Database for Contact Form 7, WPforms, Elementor forms". I could shorten to "Database for Contact Form 7, WPforms, Elementor forms plugin"? No, that's too long. The instruction says: "product_name": "1-3 wor

Reflected cross-site scripting in Contest Gallery WordPress plugin up to version 30.0.6 permits unauthenticated attackers to inject arbitrary web scripts via crafted requests, potentially leading to session hijacking or phishing. User interaction, such as clicking a malicious link, is required for exploitation. No public exploit code or active exploitation has been reported.

Cross-site scripting vulnerability in the Kali Forms WordPress plugin allows unauthenticated attackers to inject arbitrary web scripts. Successful exploitation could lead to session hijacking or malicious actions performed on behalf of an administrator who clicks a crafted link. All plugin versions up to and including 2.4.18 are affected; no public exploit code or active exploitation has been identified at the time of analysis.

Cross-site scripting in the BackWPup WordPress plugin (version 5

Reflected cross-site scripting in the GiveWP WordPress donation plugin through version 4.16.3 allows unauthenticated attackers to execute arbitrary script in a victim's browser, potentially stealing session cookies or performing actions as the victim. Exploitation requires user interaction, such as clicking a crafted link. No public exploit code or active exploitation has been confirmed.

Unauthenticated cross-site scripting (XSS) in the GetGenie WordPress plugin versions up to 4.4.3 allows remote attackers to inject arbitrary JavaScript via a crafted request, executing in the browser of any user who visits a malicious link. The vulnerability requires no authentication but does rely on user interaction (clicking a link). No public exploit code or active exploitation has been reported at the time of

We need to produce a JSON object with all required fields. The input: CVE-2026-65439, description, CVSS, CWE, source: patchstack, tags: XSS. No EPSS, no KEV, no POC mention. So we must synthesize. Product is "Ultimate Addons for Contact Form 7" (a WordPress plugin). Affected <=3.5.45. CVSS: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. So unauthenticated, UI required, scope changed, low impact all. CWE-79 Cross Site Scripting. We need to fill all fields with plain text strings. Now step by step: - product_name: "Ultimate Addons for Contact Form 7" but 1-3 words ONLY. The specific product. The name is "Ultimate Addons for Contact Form 7". It's a plugin for Contact Form 7. The primary product is the addon. So product_name: "Ultimate Addons for Contact Form 7" - that's 4 words (Ultimate, Addons, for, Contact, Form, 7). Wait, 1-3 words? The rule says "1-3 words ONLY." So we need to condense it. "Ultimate Addons Contact Form 7" is 4. Maybe "Ultimate CF7 Addons"? Or just "Contact Form 7 Addons"? The actual plugin name: "Ultimate Addons for Contact Form 7". I'll try to keep it short: "Ultimate Addons for CF7"? CF7 is abbreviation for Contact Form 7, but it's not in the original. Could be "Ultimate Addons CF7" (3 words). Or "Ultimate Addons for Contact Form 7" is the full plugin name. The instruction says 1-3 words only. So I'll use "Ultimate CF7 Addons" as a 3-word name, but that might not be the exact product. Better to stick to a succinct but recognizable form. Since it's a plugin, many references might use "Ultimate Addons for Contact Form 7". However for the product_name field, we can use "Ultimate Addons Contact Form 7" (4 words). The rule is strict: 1-3 words. I'll truncate: "Ultimate Addons CF7" (3 words). Or perhaps "Ultimate Addons" is enough but ambiguous. Ask: "The specific product or service name affected." Could be just "Ultimate Addons for Contact Form 7" but then that's a phrase. I'll go with "Ultimate Addons for CF7" (4 words). No, that's still 4. "Ultimate Addo

Reflected cross-site scripting in the Message Filter for Contact Form 7 WordPress plugin ≤1.6.3.9 allows unauthenticated attackers to inject arbitrary web scripts via a crafted link. A victim clicking the link executes the script in the context of the vulnerable site, potentially leading to cookie theft, defacement, or other client-side attacks. No public exploit or active exploitation is confirmed, though a vendor advisory addresses the issue.