Cross-Site Scripting

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Jthemes xSmart xsmart allows Code Injection.This issue affects xSmart: from n/a through <= 1.2.9.4.

Cross-Site Request Forgery (CSRF) vulnerability in Mejar WP Business Hours wp-business-hours allows Stored XSS.This issue affects WP Business Hours: from n/a through <= 1.4.

Cross-Site Request Forgery (CSRF) vulnerability in Prakash Awesome Testimonials awesome-testimonials allows Stored XSS.This issue affects Awesome Testimonials: from n/a through <= 2.2.1.

DOM-based cross-site scripting (XSS) in RomanCode MapSVG WordPress plugin versions up to 8.7.22 allows remote attackers to inject malicious scripts into web pages viewed by other users. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of web sessions. Although the CVSS score is 6.1 (medium), the EPSS exploitation probability is very low at 0.02%, and no public exploit code or active exploitation has been identified; this suggests the practical attack likelihood is minimal despite the moderate CVSS rating.

DOM-based cross-site scripting (XSS) in Marquee Addons for Elementor WordPress plugin versions through 3.8.2 allows remote attackers to inject malicious scripts through improper input neutralization during web page generation. The vulnerability requires user interaction (UI:R) and affects the confidentiality and integrity of affected websites. While CVSS scores 6.1 (medium), the 0.02% EPSS percentile indicates low real-world exploitation probability despite public awareness.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webnique USERCENTRICS CMP usercentrics-consent-management-platform allows Stored XSS.This issue affects USERCENTRICS CMP: from n/a through <= 1.0.9.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jamel.Z Tooltipy bluet-keywords-tooltip-generator allows Stored XSS.This issue affects Tooltipy: from n/a through <= 5.5.9.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpopal Opal Service opal-service allows Stored XSS.This issue affects Opal Service: from n/a through <= 1.9.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rock Content Rock Convert rock-convert allows Stored XSS.This issue affects Rock Convert: from n/a through <= 3.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in deshine Video Gallery by Huzzaz huzzaz-video-gallery allows Stored XSS.This issue affects Video Gallery by Huzzaz: from n/a through <= 10.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in aviplugins.com Custom Post Type Attachment custom-post-type-pdf-attachment allows Stored XSS.This issue affects Custom Post Type Attachment: from n/a through <= 3.4.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Query Posts query-posts allows Stored XSS.This issue affects Query Posts: from n/a through <= 0.3.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ben Huson WP Geo wp-geo allows Stored XSS.This issue affects WP Geo: from n/a through <= 3.5.1.

Stored cross-site scripting (XSS) in WPClever WPC Smart Messages for WooCommerce plugin versions up to 4.2.8 allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity through script injection, with a CVSS score of 5.4 reflecting moderate risk; however, the 0.02% EPSS score indicates minimal real-world exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WeblineIndia Popular Posts by Webline popular-posts-by-webline allows Stored XSS.This issue affects Popular Posts by Webline: from n/a through <= 1.1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in THRIVE - Web Design Gold Coast Photospace Responsive photospace-responsive allows Stored XSS.This issue affects Photospace Responsive: from n/a through <= 2.2.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Maarten Links shortcode links-shortcode allows Stored XSS.This issue affects Links shortcode: from n/a through <= 1.8.3.

Improper neutralization of HTML script tags in WP Recipe Maker through version 10.0.x enables reflected cross-site scripting (XSS) attacks against users. The vulnerability affects the Brecht WP Recipe Maker WordPress plugin and requires user interaction (clicking a malicious link) to exploit. An attacker can inject arbitrary JavaScript into the page context, achieving code execution in the victim's browser with potential to steal session tokens or perform actions on behalf of authenticated users. The vulnerability has low real-world exploitation probability (EPSS 0.02%) and does not appear to be actively exploited in the wild.

Cross-Site Request Forgery (CSRF) vulnerability in digitaldonkey Multilang Contact Form multilang-contact-form allows Stored XSS.This issue affects Multilang Contact Form: from n/a through <= 1.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in magicoders ACF Recent Posts Widget acf-recent-posts-widget allows Stored XSS.This issue affects ACF Recent Posts Widget: from n/a through <= 5.9.3.

DOM-based cross-site scripting (XSS) in King Addons for Elementor plugin versions up to 51.1.61 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (clicking a link) and affects the confidentiality and integrity of website content, with an EPSS score of 0.02% indicating low real-world exploitation probability despite the moderate CVSS rating of 5.4.

Cross-site request forgery enables stored XSS injection in WordPress Pricing Table builder plugin versions up to 1.5.3. Remote unauthenticated attackers can trick authenticated WordPress administrators into executing malicious requests that inject persistent JavaScript payloads into pricing table configurations. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability, and no active exploitation has been confirmed via CISA KEV. The changed scope (S:C) in CVSS vector indicates potential for broader site compromise beyond the plugin's security context.

DOM-based cross-site scripting (XSS) in RexTheme WP VR WordPress plugin up to version 8.5.48 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers with site-wide scope. The vulnerability requires user interaction (UI:R) and affects confidentiality, integrity, and availability equally. Exploitation requires valid WordPress account credentials but carries moderate real-world risk given the low EPSS score (0.02%) and authenticated requirement despite the CVSS 6.5 rating.

Reflected cross-site scripting in Mingsoft MCMS v6.0.1 allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by delivering a crafted URL containing a malicious payload. The CVSS scope change (S:C) indicates impact extends beyond the web application itself into the victim's browser trust context, enabling session hijacking or credential theft. No public exploit identified at time of analysis beyond the referenced GitHub gist, and EPSS of 0.22% (13th percentile) signals very low current exploitation interest.

Stored cross-site scripting on the KeeneticOS 'Wireless ISP' page enables a physically proximate attacker to compromise a Keenetic router by injecting a malicious payload-likely via a crafted nearby wireless network name (SSID)-that executes in an authenticated administrator's browser session. Successful exploitation allows the attacker to create additional users with full administrative permissions, resulting in complete device takeover. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS probability stands at 0.03%, indicating limited current exploitation activity.

Reflected cross-site scripting in Proliz Software OBS (Student Affairs Information System) prior to V26.0401 allows remote attackers to execute arbitrary JavaScript in a victim's browser session after luring them to click a crafted link. The high CVSS of 7.6 reflects unauthenticated network exploitation with high confidentiality impact, though no public exploit identified at time of analysis and EPSS data was not provided. The flaw was reported by Turkey's national CERT (USOM), indicating regional relevance for Turkish higher-education institutions that use this Student Affairs platform.

Reflected XSS in AcBakImzala, ArkSigner's document signing application, affects all versions before v5.1.4 and allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser. The attack requires the victim to interact with a crafted URL, limiting automated exploitation, but the low attack complexity and absence of authentication requirements make social-engineering-based delivery straightforward. No public exploit code or CISA KEV listing has been identified; EPSS is very low at 0.03% (9th percentile), consistent with limited observed exploitation interest at this time.

Cross-Site Request Forgery (CSRF) vulnerability in johnh10 Video Blogster Lite video-blogster-lite allows Stored XSS.This issue affects Video Blogster Lite: from n/a through <= 1.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zoefff Werk aan de Muur werk-aan-de-muur allows Stored XSS.This issue affects Werk aan de Muur: from n/a through <= 1.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Colibri Page Builder colibri-page-builder allows Stored XSS.This issue affects Colibri Page Builder: from n/a through < 1.0.334.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in themebon Easy Woocommerce Customizer easy-woocommerce-customizer allows Reflected XSS.This issue affects Easy Woocommerce Customizer: from n/a through <= 1.0.2.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in AmentoTech Doctreat doctreat allows Code Injection.This issue affects Doctreat: from n/a through <= 1.6.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms LITE nex-forms-lite allows Reflected XSS.This issue affects NEX-Forms LITE: from n/a through < 8.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arevico WP Tactical Popup wp-tactical-popup allows Reflected XSS.This issue affects WP Tactical Popup: from n/a through <= 1.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Munzir Author: Munzir myshouts-shoutbox allows Reflected XSS.This issue affects Author: Munzir: from n/a through <= 0.9.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bob Likert Survey Master likert-survey-master allows Reflected XSS.This issue affects Likert Survey Master: from n/a through <= 0.8.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Toast Plugins Toast Mobile Menu toast-responsive-menu allows Stored XSS.This issue affects Toast Mobile Menu: from n/a through <= 1.0.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Globalis MultiSite Clone Duplicator multisite-clone-duplicator allows Reflected XSS.This issue affects MultiSite Clone Duplicator: from n/a through <= 1.5.3.

Reflected cross-site scripting (XSS) in the Contact Form by Supsystic WordPress plugin (versions through 1.7.36) allows unauthenticated remote attackers to execute malicious JavaScript in victims' browsers via crafted URLs. The vulnerability enables session hijacking, credential theft, and malicious actions performed in the context of the victim's authenticated session. EPSS probability indicates low exploitation likelihood (0.07%, 22nd percentile) with no public exploit identified at time of analysis.

Reflected Cross-Site Scripting (XSS) in WordPress plugin oik-privacy-policy versions ≤1.4.10 allows remote attackers to execute arbitrary JavaScript in victims' browsers. Exploitation requires user interaction (victim must click malicious link). EPSS probability is low (0.07%, 22nd percentile), and no active exploitation is confirmed. Reported by Patchstack security audit team, indicating professional vulnerability disclosure.

Reflected cross-site scripting in NextMove Lite (WordPress thank-you page plugin) versions ≤2.24.0 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers via crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but achieves scope change per CVSS vector, enabling session hijacking, credential theft, or malicious actions under victim's WordPress session. EPSS score of 0.03% (8th percentile) indicates low probability of mass exploitation, though XSS vulnerabilities are commonly used in targeted social engineering campaigns against WordPress site administrators.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ERA404 CropRefine croprefine allows Reflected XSS.This issue affects CropRefine: from n/a through <= 1.2.1.

Reflected cross-site scripting in bbPress Notify plugin versions up to 2.19.5 allows unauthenticated remote attackers to execute malicious JavaScript in victim browsers through crafted URLs. The vulnerability stems from improper input sanitization during web page generation (CWE-79). With CVSS 7.1 and changed scope (S:C), successful exploitation enables session hijacking, credential theft, and malicious actions in the victim's context. EPSS score of 0.03% (8th percentile) indicates low observed exploitation probability, and no active exploitation is confirmed (not in CISA KEV), though Patchstack has publicly documented the vulnerability.

Reflected cross-site scripting in Robokassa payment gateway for WooCommerce (versions ≤1.8.5) allows remote attackers to execute malicious JavaScript in victim browsers through specially crafted URLs. The scope-change CVSS flag indicates attackers can impact resources beyond the vulnerable plugin itself, potentially compromising WooCommerce admin sessions or customer payment data. EPSS probability is low (0.03%, 8th percentile), and no active exploitation or public POC has been identified at time of analysis.

Reflected cross-site scripting in Email Attachment by Order Status & Products WordPress plugin versions ≤1.0.1 allows remote unauthenticated attackers to execute arbitrary JavaScript in victim browsers through low-complexity attacks requiring user interaction. The vulnerability enables cross-site scope impact (S:C), allowing attackers to compromise confidentiality, integrity, and availability at a low level across security boundaries. No active exploitation or public POC is confirmed at time of analysis, with EPSS data unavailable for this recently published CVE.

Stored cross-site scripting (XSS) in Crocoblock JetElements For Elementor plugin through version 2.7.8 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of site visitors, potentially compromising site integrity and user sessions. The vulnerability requires user interaction (UI:R) and affects authenticated users (PR:L), limiting immediate blast radius but posing persistent risk to WordPress installations using this Elementor extension.

Stored XSS in Crocoblock JetEngine WordPress plugin versions 3.7.3 and earlier allows authenticated users with limited privileges to inject malicious scripts that execute in the browsers of other users, including administrators. The vulnerability requires user interaction (UI:R) to trigger and affects confidentiality, integrity, and availability with limited scope. With EPSS at 0.07% and no KEV status indicating active exploitation, this represents a low-probability but real risk requiring patching in multi-user WordPress environments.

Stored cross-site scripting (XSS) in Crocoblock JetBlocks For Elementor plugin versions up to 1.3.18 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other site visitors. The vulnerability requires user interaction (UI:R) and affects confidentiality and integrity, with an EPSS score of 0.06% indicating very low real-world exploitation likelihood despite the moderate CVSS 5.4 rating.

Reflected cross-site scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4 allows authenticated users to inject malicious scripts that execute in other users' browsers when they interact with crafted links. The vulnerability requires user interaction (UI:R) and authenticated access (PR:L), limiting but not eliminating real-world risk; EPSS score of 0.07% indicates low exploitation probability despite the moderate CVSS 6.5 rating.

Stored Cross-Site Scripting (XSS) in Crocoblock JetBlog WordPress plugin through version 2.4.4.1 allows authenticated users with low privileges to inject malicious scripts that persist in web pages and execute in the browsers of other site visitors, potentially compromising session tokens, stealing sensitive data, or performing unauthorized actions. EPSS score of 0.07% and lack of public exploit code indicate low real-world exploitation probability despite the moderate CVSS 6.5 score.

Reflected cross-site scripting (XSS) in Crocoblock JetSearch WordPress plugin versions through 3.5.10 allows unauthenticated remote attackers to execute arbitrary JavaScript in victim browsers via maliciously crafted URLs. The vulnerability requires user interaction (clicking a malicious link) but carries a changed scope, meaning successful exploitation can impact resources beyond the vulnerable component. EPSS probability is low (0.07%, 22nd percentile), indicating minimal observed exploitation attempts, and no public exploit code or CISA KEV listing exists at time of analysis.

DOM-based cross-site scripting (XSS) in Crocoblock JetWooBuilder plugin through version 2.1.20 allows authenticated users with low privileges to inject malicious scripts that execute in other users' browsers when they interact with affected pages. The vulnerability requires user interaction (UI:R per CVSS) and affects the plugin's web page generation functions. No public exploit code or active exploitation has been confirmed, though the issue carries a moderate CVSS score of 6.5 and low EPSS probability (0.07%, 22nd percentile) suggesting limited real-world attack incentive despite the authentication requirement being relatively low-barrier for WordPress environments.

Stored XSS vulnerability in Crocoblock JetWooBuilder WordPress plugin versions up to 2.1.20.1 allows authenticated users with low privileges to inject malicious scripts that execute in the browsers of other users viewing affected pages, potentially leading to session hijacking, credential theft, or defacement. The vulnerability requires user interaction (UI:R) from victims and affects the confidentiality, integrity, and availability of website content. No public exploit code or active exploitation has been confirmed at time of analysis.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Craig Hewitt Seriously Simple Podcasting seriously-simple-podcasting allows DOM-Based XSS.This issue affects Seriously Simple Podcasting: from n/a through <= 3.11.1.

Stored cross-site scripting in Cinza Grid WordPress plugin versions up to 1.2.1 allows authenticated contributors and above to inject arbitrary JavaScript into pages via the 'cgrid_skin_content' post meta field, which executes when other users view the affected pages. The vulnerability stems from missing input sanitization and output escaping in backend processing functions. CVSS 6.4 reflects moderate impact with network-accessible attack surface, though exploitation requires valid WordPress contributor-level credentials.

Stored Cross-Site Scripting in WP-Force Images Download WordPress plugin versions up to 1.8 allows authenticated contributors and above to inject arbitrary JavaScript via the 'class' attribute of the 'wpfid' shortcode due to insufficient input sanitization and output escaping. The vulnerability executes malicious scripts in the browser of any user viewing an affected page, potentially enabling account compromise, malware distribution, or defacement with CVSS 6.4 (medium severity). No public exploit code or confirmed active exploitation has been identified at time of analysis.

Reflected XSS in City Guide (giSoft Information Technologies) before version 1.4.45 allows unauthenticated remote attackers to inject and execute arbitrary JavaScript in a victim's browser by tricking them into clicking a crafted URL. The CVSS Changed Scope (S:C) indicates the injected script can affect resources outside the vulnerable application's security domain - such as the user's broader browser session - enabling session theft, credential harvesting, or UI redirection. No public exploit identified at time of analysis, and an EPSS score of 0.03% at the 7th percentile reflects very low observed exploitation probability.

Cross-site scripting (XSS) in LogicalDOC Community Edition up to 9.2.1 allows authenticated attackers with user interaction to inject malicious scripts via contact form fields (First Name, Last Name, Company, Address, Phone, Mobile) on the /frontend.jsp Add Contact Page. Publicly available exploit code exists; EPSS score of 0.03% reflects low real-world exploitation probability despite public POC, likely due to authentication and user interaction requirements.

Stored cross-site scripting (XSS) in AFFiNE up to version 0.24.1 allows authenticated users to inject malicious scripts via the Avatar Upload Image endpoint, which are executed in the browsers of other users viewing the attacker's profile. The vulnerability requires user interaction (victim must view the malicious avatar) and authenticated access, resulting in limited but confirmed integrity impact. Public exploit code exists; vendor contact attempts yielded no response.

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation MediaWiki WebAuthn extension allows Stored XSS.This issue affects MediaWiki WebAuthn extension: 1.39, 1.43, 1.44.

Stored Cross-Site Scripting in CobbleStone Enterprise Contract Management Portal v22.4.0 allows a low-privileged, authenticated remote attacker to inject persistent malicious scripts into the application's chat box component. When a victim user views the chat, the injected script executes in their browser session, enabling session hijacking, credential theft, or in-application action forgery scoped to the vulnerable system. Notably, the vendor has disclosed that v22.4.0 is an obsolete, unsupported version no longer in active distribution, which substantially narrows the real-world attack surface. No public exploit identified at time of analysis, though a researcher writeup on Medium constitutes partial technical disclosure.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jason C. Memberlite Shortcodes memberlite-shortcodes allows Stored XSS.This issue affects Memberlite Shortcodes: from n/a through <= 1.4.1.

Reflected XSS in Ilevia EVE X1 Server firmware (all versions through 4.7.18.0.eden) exposes unauthenticated network attackers to client-side code execution by injecting malicious payloads via the index.php endpoint on port 8080. A publicly available proof-of-concept exploit exists (ZSL-2025-5961), raising the practical risk above the 5.1 CVSS score alone would suggest. Critically, Ilevia has formally declined to issue a patch, leaving all deployed devices permanently unmitigated at the firmware level - the only vendor-sanctioned control is network segmentation.

Cross-site scripting (XSS) in Apeman ID71 EN75.8.53.20 allows authenticated remote attackers to inject malicious scripts via the alias parameter in /set_alias.cgi, requiring user interaction for payload execution. Publicly available exploit code exists, but EPSS score of 0.03% and vendor non-responsiveness suggest limited real-world exploitation despite confirmed POC availability.

Stored Cross-Site Scripting (XSS) in the Digiseller WordPress plugin up to version 1.3 allows authenticated contributors and above to inject arbitrary JavaScript via the 'ds' shortcode attributes due to insufficient input sanitization and output escaping. The injected scripts execute in the context of all users viewing the affected page, enabling session hijacking, credential theft, or malware distribution. CVSS 6.4 reflects network accessibility and lower-privileged attacker requirements; no public exploit code or active exploitation has been identified at time of analysis.

Stored Cross-Site Scripting in WP BookWidgets plugin for WordPress allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts via the 'bw_link' shortcode due to insufficient input sanitization and output escaping. When a user visits a page containing the injected shortcode, the malicious script executes in their browser context. This vulnerability affects all versions up to and including 0.9. No public exploit code or active exploitation in the wild has been confirmed at the time of analysis.

DOM-based Cross-Site Scripting in Adobe Connect 12.9 and earlier enables session hijacking when high-privileged administrators interact with attacker-crafted pages. Scope change to 'C' indicates the attacker can pivot beyond the vulnerable component's security boundary, allowing privileged session takeover that impacts both confidentiality and integrity at high levels. No active exploitation confirmed per CISA KEV at time of analysis. Adobe has released security advisory APSB25-70 addressing this vulnerability.

Reflected cross-site scripting (XSS) in FortiOS, FortiProxy, and FortiSASE allows unauthenticated remote attackers to inject and execute malicious scripts in a victim's browser by tricking them into clicking a crafted HTTP request link. The vulnerability spans a wide range of FortiOS versions from 6.4 through 7.6.3 and all FortiProxy 7.x branches, meaning a large installed base of Fortinet network security appliances is affected. A Siemens CERT advisory (SSA-864900) indicates this vulnerability also affects Siemens products that embed Fortinet components, broadening organizational impact. No public exploit or CISA KEV listing has been identified at time of analysis.

Firefox and Thunderbird allow cross-site scripting (XSS) attacks when a malicious page uses the type attribute of an OBJECT tag to override default browser behavior for resources served without a content-type header. An attacker can craft a malicious webpage that exploits this flaw to execute arbitrary JavaScript in the context of a vulnerable site that unsafely omits content-type headers, affecting Firefox versions before 144, Firefox ESR before 140.4, Thunderbird before 144, and Thunderbird ESR before 140.4. No public exploit code or active exploitation has been identified at time of analysis.

Stored cross-site scripting (XSS) in Stock History & Reports Manager for WooCommerce plugin versions up to 2.2.2 allows authenticated contributors and above to inject arbitrary JavaScript through the 'alg_wc_stock_snapshot_restocked' shortcode attributes due to insufficient input sanitization and output escaping. When an injected page is accessed, the malicious script executes in the context of all visitors' browsers, potentially compromising site users and enabling credential theft, malware distribution, or account takeover. No public exploit code or active exploitation has been confirmed at the time of analysis.

Stored Cross-Site Scripting in code-projects Simple Online Hotel Reservation System 1.0 allows a low-privileged attacker to inject persistent malicious JavaScript into the Add Room Description field, which executes in the administrator's browser session when room information is viewed, resulting in session cookie theft. The CVSS vector (PR:L/UI:R/S:C) confirms the attack requires authenticated access to add rooms and administrator interaction to trigger, but scope change to C:L reflects the realistic impact of session hijacking. A publicly available proof-of-concept exploit exists on GitHub, though no public exploitation has been confirmed and EPSS sits at a low 0.24th-percentile probability.

Stored HTML/script injection in RISE Ultimate Project Manager & CRM (vendor fairsketch) lets authenticated low-privilege users embed attacker-controlled markup into invoices and messages that later renders in outbound emails, generated PDFs, and the in-app messaging/chat modules delivered to clients and staff. Because injected content is stored server-side and redistributed-amplified by automated recurring invoices-it functions as a persistent phishing and credential-harvesting vector rather than a memory-corruption bug. Publicly available exploit code exists (GitHub PoC), but there is no public exploit identified as actively used in the wild, and the EPSS probability is modest at 1.06% (61st percentile).

A vulnerability  Bypass of the script allowlist configuration in HCL AION.  An incorrectly configured Content-Security-Policy header may allow unauthorized scripts to execute, increasing the risk of cross-site scripting and other injection-based attacks.This issue affects AION: 2.0.

Cross-site scripting (XSS) in drupal-pattern-lab/unified-twig-extensions (all versions from 0.0.0) allows authenticated users to inject malicious scripts through insufficient output filtering, but only when the code is executed outside of Drupal environments such as Pattern Lab. The package is unmaintained; the vulnerability is fixed in the successor drupal/unified_twig_ext version 1.1.1. EPSS exploitation probability is extremely low at 0.02%, and no public exploit code has been identified.

Stored Cross-Site Scripting in code-projects Simple Scheduling System 1.0 allows an attacker to inject arbitrary JavaScript via the Subject Description field, which executes in victims' browsers when they view the affected page. The scope change in the CVSS vector (S:C) confirms the script runs in a different security context than where the payload is injected, enabling session hijacking, credential theft, or malicious redirects against users of the application. A publicly available proof-of-concept exploit exists, though exploitation probability remains low (EPSS 0.22%) and no confirmed active exploitation is recorded.

Stored cross-site scripting in code-projects Client Details System 1.0 allows an attacker who can submit customer records to persist malicious JavaScript in the username field, which then executes in the browser of any user who subsequently views that record. The CVSS scope change (S:C) indicates the payload crosses from the application's trust boundary into a victim's browser session, enabling session hijacking or credential theft against administrative users. A publicly available proof-of-concept exists, though no CISA KEV listing has been issued and the EPSS score of 0.22% (12th percentile) reflects low observed exploitation activity.

Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows remote attackers to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/voters_add.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.1) due to UI requirement, but publicly available exploit code exists and the attack requires no authentication or special configuration.

Stored cross-site scripting (XSS) in SourceCodester Student Grades Management System 1.0 allows authenticated administrators with high privileges to inject malicious scripts via the first_name or last_name parameters in the Manage Users Page (/admin.php), which are then executed when viewed by other users. The vulnerability requires administrator authentication and user interaction (page view), limiting real-world impact despite public exploit availability. EPSS exploitation probability is extremely low (0.03%, 9th percentile), reflecting the restrictive access controls (PR:H) and user interaction requirement (UI:P) despite network-accessible delivery.

OpnForm up to version 1.9.3 contains a cross-site request forgery vulnerability in an undisclosed API endpoint, though the practical exploitability is severely constrained by the vendor's mandatory use of JWT Bearer token authentication. The vulnerability requires an attacker to first obtain a valid JWT token through a separate XSS attack, which the vendor states has been mitigated in the product, making the CSRF itself a secondary concern rather than an independent attack vector. Publicly available exploit code exists, but real-world impact is minimal given the authentication and XSS mitigation barriers.

Cross-site scripting vulnerability in JhumanJ OpnForm up to version 1.9.3 allows authenticated remote attackers with high privileges to inject malicious scripts via the Form Editor component at /api/open/forms/. The vulnerability requires user interaction to trigger and is mitigated by default when users configure their own domain. Publicly available exploit code exists, though real-world risk is severely constrained by the high privilege requirement, user interaction dependency, and vendor's default mitigation posture (CVSS 1.9, EPSS 0.03%).

Stored cross-site scripting (XSS) in JhumanJ OpnForm up to version 1.9.3 allows remote attackers to inject malicious scripts via the /show/submissions endpoint, affecting all users who view affected submissions. The vulnerability requires user interaction (UI:P) to trigger but carries low integrity impact (VI:L). Public exploit code exists, and a patch has been released; however, the CVSS 2.1 score and 0.05% EPSS percentile indicate limited real-world exploitation despite public disclosure.

Reflected cross-site scripting (XSS) in itsourcecode Leave Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the ID query parameter in /module/employee/controller.php?action=reset, requiring user interaction to execute. Public exploit code is available, though the vulnerability carries low real-world risk (EPSS 0.03%, CVSS 2.0) due to authentication and user-interaction requirements limiting broad exploitation.

Stored cross-site scripting in projectworlds Advanced Library Management System 1.0 allows authenticated users with high privileges to inject malicious scripts via the firstname parameter in /edit_admin.php, affecting other users who view admin profiles. Exploitation requires high-privilege authentication and user interaction (UI:P), limiting real-world impact despite network accessibility. Public exploit code exists and EPSS exploitation probability is minimal at 0.03%, suggesting this remains a low-priority vulnerability despite CVE assignment.

Stored cross-site scripting (XSS) in code-projects Voting System 1.0 allows authenticated users with low privileges to inject malicious scripts via the Firstname, Lastname, or Platform parameters in /admin/candidates_edit.php, which execute in the context of other users' browsers when the edited candidate record is viewed. The vulnerability requires user interaction (UI:P) but affects integrity of data displayed to administrators. Exploit code is publicly available on GitHub, though EPSS score of 0.03% indicates limited real-world exploitation despite published POC.

A client-side path traversal vulnerability was discovered in the web management interface front-end due to missing validation of an input parameter. An authenticated user with limited privileges can craft a malicious URL which, if visited by an authenticated victim, leads to a Cross-Site Scripting (XSS) attack.

Stored cross-site scripting (XSS) in PHPGurukul Cyber Cafe Management System 1.0 allows remote attackers to inject malicious scripts via the searchdata POST parameter in /search.php, requiring user interaction to execute. The vulnerability has a low CVSS score (2.1) due to limited impact scope, but publicly available exploit code exists and the EPSS score (0.05%, 14th percentile) suggests minimal real-world exploitation likelihood despite public availability.

Cross-site scripting in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0076-000, version 4.00) lets an attacker inject script into the appliance's web management interface, executing in the browser of an authenticated operator who views the malicious content and enabling theft of session data and sensitive configuration information. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R) indicates a remote, low-complexity attack that requires low-privilege access to inject and victim interaction to trigger. No public exploit identified at time of analysis, though a third-party research advisory (xdiv-sec) documents the finding; EPSS is low at 0.28% (20th percentile).

Cross-site scripting in EndRun Technologies Sonoma D12 GPS Network Time Server firmware 6010-0071-000 Ver 4.00 allows a remote unauthenticated attacker to inject and execute malicious scripts in the context of an authenticated user's browser session against the device's web management interface. Exploitation requires the attacker to trick an administrator into interacting with a crafted URL or page, after which the scope crosses into the victim's browser context, enabling session theft or credential harvesting. No public exploit confirmed at time of analysis, and EPSS of 0.22% (13th percentile) signals low automated exploitation activity.

Cross-site scripting in the EndRun Technologies Sonoma D12 GPS Network Time Server (firmware 6010-0071-000 Ver 4.00) lets an attacker inject script into the device's web management interface to steal sensitive information such as session data or configuration from an authenticated operator. Exploitation requires a low-privileged authenticated context and victim interaction (a user must load the malicious content), and there is no public exploit identified at time of analysis, though a third-party advisory (xdiv-sec) documenting the flaw is publicly available. EPSS is low at 0.28% (20th percentile), and the issue is not listed in CISA KEV.