Cross-Site Scripting

A vulnerability was found in 495300897 wx-shop up to de1b66331368695779cfc6e4d11a64caddf8716e and classified as problematic. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

A vulnerability classified as problematic has been found in code-projects Human Resource Integrated System 1.0. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title upon calendar import. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Mocca Calendar application before 2.15 for XWiki allows XSS via a title to the view event page. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Mocca Calendar application before 2.15 for XWiki allows XSS via the background or text color field. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Ocean Social Sharing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via social icon titles in all versions up to, and including, 2.2.1 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Mmm Unity Loader plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘attributes’ parameter in all versions up to, and including, 1.0 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Magic Edge - Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘height’ parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The All in One Time Clock Lite - Tracking Employee Time Has Never Been Easier plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Custom Word Cloud plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘angle’ parameter in all versions up to, and including, 0.3 due to insufficient input sanitization and. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Medical Addon for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Typewriter widget in all versions up to, and including, 1.6.3 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The ShortPixel Adaptive Images - WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including,. Rated medium severity (CVSS 4.4), this vulnerability is remotely exploitable. No vendor patch available.

The 360 Photo Spheres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'sphere' shortcode in all versions up to, and including, 1.3 due to insufficient input. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Qi Addons For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's TypeOut Text widget in all versions up to, and including, 1.9.2 due to insufficient. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Partner Software's Partner Software application and Partner Web application allows an authenticated user to add notes on the 'Notes' page when viewing a job but does not completely sanitize input,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Files is a module for managing files inside spaces and user profiles. Rated medium severity (CVSS 5.1), this vulnerability is remotely exploitable, low attack complexity.

A stored Cross-Site Scripting (XSS) vulnerability exists in the qureydetails.php page of Institute-of-Current-Students 1.0, where the input fields for Query and Answer do not properly sanitize user. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Microweber CMS 2.0 is vulnerable to Cross Site Scripting (XSS)in the /projects/profile, homepage endpoint via the last name field. Rated high severity (CVSS 7.6), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Reflected Cross-Site Scripting (XSS) in Microweber CMS 2.0 via the layout parameter on the /admin/page/create page allows arbitrary JavaScript execution in the context of authenticated admin users. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Reflected Cross-Site Scripting (XSS) in the id parameter of the live_edit.module_settings API endpoint in Microweber CMS2.0 allows execution of arbitrary JavaScript. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

A stored cross-site scripting (XSS) vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

The Sina Extension for Elementor (Header Builder, Footer Builter, Theme Builder, Slider, Gallery, Form, Modal, Data Table Free Elementor Widgets & Elementor Templates) plugin for WordPress is. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The BlockSpare: Gutenberg Blocks & Patterns for Blogs, Magazines, Business Sites - Post Grids, Sliders, Carousels, Counters, Page Builder & Starter Site Imports, No Coding Needed plugin for WordPress. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The The Plus Addons for Elementor - Elementor Addons, Page Templates, Widgets, Mega Menu, WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the custom script parameter. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The SureForms WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against. Rated medium severity (CVSS 5.8), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.

The Stratum - Elementor Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Advanced Google Maps and Image Hotspot widgets in all versions up to, and including,. Rated medium severity (CVSS 6.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

The Photos, Files, YouTube, Twitter, Instagram, TikTok, Ecommerce Contest Gallery - Upload, Vote, Sell via PayPal or Stripe, Social Share Buttons, OpenAI plugin for WordPress is vulnerable to Stored. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Unrestricted HTML file upload in CS-Cart 4.18.3 enables stored cross-site scripting and phishing attacks against users of affected storefronts. An attacker who can upload files to the platform may submit a crafted HTML document subsequently served from the trusted store domain, allowing arbitrary JavaScript execution in victims' browsers or presentation of convincing fake login pages for credential harvesting. Publicly available exploit code exists on GitHub; the EPSS score of 0.22% (13th percentile) reflects low observed exploitation pressure and the vulnerability is not listed in the CISA KEV catalog.

Cross-site scripting (XSS) in Campcodes Online Hotel Reservation System 1.0 allows authenticated users to inject malicious scripts via the Name parameter in /admin/add_query_account.php, affecting the integrity of admin-level functionality. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting direct remote exploitation to attackers with valid credentials; however, publicly available exploit code exists, and the CVSS 2.0 score with VI:L (integrity impact) reflects limited but confirmed damage potential in a stored XSS context.

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote attackers to inject malicious scripts via the descricao parameter in /intranet/educar_escolaridade_lst.php, requiring user interaction to execute. The vulnerability has a low CVSS score of 2.1 and EPSS exploitation probability of 0.11%, but publicly available exploit code exists and the vendor did not respond to early disclosure.

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote attackers to inject malicious scripts via the titulo_avaliacao parameter in /intranet/educar_avaliacao_desempenho_lst.php. The vulnerability requires user interaction (clicking a malicious link) but has a low CVSS score of 2.1 and a minimal EPSS exploitation probability of 0.11%, placing it in the 29th percentile. Publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Reflected cross-site scripting in Portabilis i-Educar 2.9 allows remote attackers to inject arbitrary JavaScript via the campo_busca and cpf parameters in /intranet/pesquisa_pessoa_lst.php. The vulnerability requires user interaction (clicking a malicious link) but enables session hijacking, credential theft, or defacement of educational records. Publicly available exploit code exists; the vendor did not respond to disclosure.

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote attackers to inject malicious scripts via the 'nome' parameter in /intranet/funcionario_vinculo_lst.php. The vulnerability requires user interaction (clicking a malicious link) but enables session hijacking, credential theft, and unauthorized administrative actions. Public exploit code is available, though EPSS probability remains low at 0.11% percentile, suggesting limited real-world exploitation despite disclosure.

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.9 allows remote unauthenticated attackers to inject arbitrary JavaScript via the nome or matricula_servidor parameters in /intranet/educar_servidor_lst.php. The vulnerability requires user interaction (clicking a malicious link) and has low confidentiality impact but can lead to session hijacking or credential theft. Publicly available exploit code exists, though exploitation likelihood remains low (EPSS 0.11%) due to user interaction requirement and limited real-world impact surface.

Stored cross-site scripting (XSS) in Portabilis i-Educar 2.10 via the atendidos_cad.php file allows authenticated remote attackers with user interaction to inject malicious scripts through the nome, nome_social, or email parameters, resulting in minor integrity impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure notification.

Reflected cross-site scripting (XSS) in Portabilis i-Educar 2.10 allows remote unauthenticated attackers to inject arbitrary JavaScript via the ref_cod_matricula parameter in /educar_aluno_lst.php, affecting users who click malicious links. The vulnerability has publicly available exploit code and a low CVSS score (2.1) due to requirement for user interaction, but represents a typical web application flaw in educational management systems with potential for credential theft or session hijacking.

Reflected cross-site scripting (XSS) in Intern Membership Management System 1.0 allows remote attackers to inject malicious scripts via the email parameter in fill_details.php, executable only with user interaction. The vulnerability has a publicly available exploit and affects the error message handler, resulting in integrity impact (CVSS 2.1, EPSS 0.07%). While the attack vector is network-accessible and requires minimal complexity, the low CVSS and EPSS scores reflect the necessity for user interaction and limited technical impact.

Stored cross-site scripting (XSS) in Simple Car Rental System 1.0 allows authenticated administrators to inject malicious scripts via the car_name parameter in /admin/add_vehicles.php, which are then executed in the browsers of other users viewing vehicle listings. The vulnerability requires high-privilege admin access and user interaction (UI:P), limiting real-world impact despite network-accessible delivery. Publicly available exploit code exists but EPSS exploitation probability is extremely low at 0.05%, suggesting the attack scenario (admin-initiated XSS against themselves or other admins) has minimal practical risk.

Universal cross-site scripting (XSS) in Safari and macOS allows remote attackers to execute arbitrary JavaScript in the context of visited websites by processing maliciously crafted web content. The vulnerability affects Safari 18.5 and earlier, and macOS Sequoia 15.5 and earlier, and is fixed in Safari 18.6 and macOS Sequoia 15.6. Attack requires user interaction (clicking a malicious link or visiting a compromised site) but carries no authentication requirement. EPSS score of 0.04% indicates low real-world exploitation probability despite the moderate CVSS rating.

Cross-site scripting in DECE Software Geodi before version 9.0.146 allows authenticated low-privileged remote attackers to inject malicious scripts that execute in other users' browsers, crossing a security scope boundary (S:C). The CVSS vector confirms network-accessible exploitation requiring only low-privilege authentication and victim interaction, making it a realistic internal threat vector in multi-user deployments. No public exploit code identified at time of analysis and EPSS of 0.13% (32nd percentile) signals low exploitation probability, though the scope change elevates post-exploitation impact potential beyond the attacker's own session.

Stored cross-site scripting (XSS) in JPACookieShop GoodsController allows authenticated users to inject malicious scripts that execute in other users' browsers, with public exploit code available and CVSS 2.0 reflecting low impact due to required user interaction and authenticated access prerequisites.

Reflected cross-site scripting (XSS) in JPACookieShop's GoodsCustController.goodsSearch function allows remote unauthenticated attackers to inject malicious scripts via the keyword parameter, affecting user sessions with minimal complexity. The vulnerability carries a CVSS 2.1 score but requires user interaction (clicking a malicious link), and public exploit code is available. With an EPSS of 0.06% and no confirmed active exploitation in the wild, the real-world risk is low despite the disclosed POC.

Roothub versions up to 2.6 contain a reflected cross-site scripting (XSS) vulnerability in the SystemConfigAdminController Edit function that allows authenticated users to inject malicious scripts via the web interface. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, limiting its practical impact despite network-accessible delivery. Publicly available exploit code exists, though real-world exploitation risk is low given the EPSS score of 0.06% and the authentication barrier.

Cross-site scripting (XSS) in Comodo Dragon up to version 134.0.6998.179 affects the IP DNS Leakage Detector component, allowing remote attackers to inject malicious scripts. The vulnerability requires user interaction and involves high attack complexity, resulting in limited integrity impact. Public exploit code exists and the vendor has not responded to disclosure, though EPSS scoring (0.05%, 15th percentile) and lack of CISA KEV listing suggest low real-world exploitation likelihood despite proof-of-concept availability.

Cross-site scripting (XSS) in macrozheng mall up to version 1.0.3 allows authenticated remote attackers to inject malicious scripts via the configUrl parameter in the Swagger UI component (/swagger-ui/index.html). Exploitation requires user interaction (clicking a malicious link) and an authenticated session, limiting attack scope to integrity impact. Publicly available exploit code exists, and the vendor has not responded to early disclosure or patched the vulnerability.

Stored Cross-Site Scripting in the Educenter WordPress theme Circle Counter Block allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript into pages, executing when users visit affected content. The vulnerability stems from insufficient input sanitization in the circle-counter.php block component (versions up to 1.6.2) and affects all users viewing injected pages. CVSS 6.4 (medium) reflects the requirement for authenticated access and limited scope; no public exploit code or active exploitation has been confirmed at time of analysis.

Cross-site scripting (XSS) in Church Donation System 1.0 allows authenticated remote attackers to inject arbitrary JavaScript via the fname parameter in /admin/edit_members.php, requiring user interaction to execute. The vulnerability has a publicly disclosed exploit and EPSS score of 0.05% (16th percentile), indicating low real-world exploitation probability despite public availability of proof-of-concept code.

Stored cross-site scripting in tawk.to Live Chat 1.6.1 allows unauthenticated remote attackers to inject persistent JavaScript payloads via the chat widget, which execute in the browsers of support agents or site administrators who view the tainted transcripts. The CVSS 3.1 Scope:Changed metric confirms the injected script executes in the victim's browser origin, enabling session hijacking or credential theft against the hosting site - not merely the chat platform. A public proof-of-concept is available on GitHub; no CISA KEV listing exists and EPSS sits at 0.43% (35th percentile), indicating low current mass-exploitation but a meaningful attacker-accessible entry point given the lowered skill bar from the POC.

Cross-site scripting (XSS) vulnerability in D-Link DCS-6010L firmware 1.15.03 allows authenticated remote attackers to inject malicious scripts via the paratest argument in the Management Application's /vb.htm endpoint. The vulnerability requires user interaction (UI:P) and affects an end-of-life product with publicly available exploit code, though real-world risk is significantly limited by authentication requirement (PR:L) and very low EPSS score (0.05%).

Stored Cross-Site Scripting in Kron Technologies Kron PAM (versions before 3.7) allows a highly privileged authenticated attacker to inject persistent malicious scripts into the application that execute in the browsers of other users who view the affected content. Despite the high privilege required to plant the payload, the impact is rated High on both confidentiality and integrity - a realistic concern in Privileged Access Management platforms where session hijacking or credential harvesting against super-administrators carries severe downstream risk. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.18% (40th percentile).

Reflected cross-site scripting in PHPGurukul Taxi Stand Management System 1.0 allows authenticated remote attackers to inject malicious scripts via the registrationnumber or licensenumber parameters in /admin/new-autoortaxi-entry-form.php, requiring user interaction to trigger. The vulnerability carries a low CVSS score of 2.0 due to authentication and user-interaction requirements, though publicly available exploit code exists and EPSS scoring (0.07%) indicates minimal real-world exploitation probability.

Stored Cross-Site Scripting in Mine CloudVod WordPress plugin versions up to 2.1.10 allows authenticated attackers with Contributor-level access to inject arbitrary JavaScript through the 'audio' parameter due to insufficient input sanitization and output escaping. When injected pages are accessed by other users, the malicious scripts execute in their browsers, potentially compromising site security and user data. No public exploit code or active exploitation has been confirmed at analysis time.

Reflected cross-site scripting (XSS) in the FunnelCockpit WordPress plugin up to version 1.4.3 allows unauthenticated attackers to inject arbitrary JavaScript through the 'error' parameter due to insufficient input sanitization and output escaping. Exploitation requires social engineering an administrative user to click a malicious link, enabling attackers to steal session cookies, perform administrative actions, or redirect users to phishing sites. No public exploit code or active exploitation has been confirmed at time of analysis.

Stored Cross-Site Scripting in WP Get The Table WordPress plugin versions up to 1.5 allows authenticated attackers with Contributor-level access and above to inject arbitrary web scripts via the 'url' parameter due to insufficient input sanitization and output escaping. Injected scripts execute whenever any user accesses the affected pages, potentially compromising site visitors and enabling account hijacking, malware distribution, or data theft. No public exploit code or active exploitation has been confirmed at time of analysis, but the vulnerability requires only contributor-level access and has a moderate CVSS score of 6.4 reflecting limited technical complexity and network-based attack vector.

Stored Cross-Site Scripting in Taeggie Feed plugin for WordPress (all versions up to 0.1.10) allows authenticated attackers with contributor-level access or above to inject arbitrary JavaScript via the taeggie-feed shortcode's name attribute, which is rendered unsanitized in both a script tag ID and jQuery.getScript() call. The vulnerability has a CVSS score of 6.4 with cross-site impact; no public exploit code or active exploitation has been confirmed at this time.

Stored Cross-Site Scripting in muse.ai WordPress plugin versions up to 0.4 allows authenticated attackers with contributor-level access to inject malicious scripts via insufficiently sanitized shortcode attributes, enabling arbitrary code execution in the context of any user viewing affected pages. The vulnerability requires authentication and user interaction (page access by victims), resulting in a CVSS 6.4 score; no public exploit code or active exploitation has been identified at time of analysis.

Reflected cross-site scripting in Post Grid Master WordPress plugin versions up to 3.4.13 allows unauthenticated attackers to inject arbitrary JavaScript through the 'argsArray[read_more_text]' parameter due to insufficient input sanitization and output escaping. An attacker can craft a malicious link and trick users into clicking it, causing the injected script to execute in their browser with the victim's privileges. Publicly available exploit code exists, and the vulnerability affects all installations of the plugin through version 3.4.13.

Stored Cross-Site Scripting in Structured Content plugin for WordPress up to version 1.6.4 allows authenticated contributors and above to inject arbitrary JavaScript via the sc_fs_local_business shortcode due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially enabling account compromise, malware distribution, or defacement. No public exploit code or active exploitation has been confirmed at this time.

Cross-site scripting in Dataprom Informatics PACS-ACSS (Physical Access Control and Security System) affects all versions prior to the 16.05.2025 release, enabling unauthenticated remote attackers to inject and execute malicious scripts in the context of a victim's browser session. The CVSS vector assigns UI:N (no user interaction), which for XSS typically implies stored rather than reflected injection - meaning a payload planted in the system may execute automatically when administrators or operators view affected pages. No public exploit code has been identified at time of analysis, and no active exploitation is confirmed; however, the sensitivity of physical access control systems makes even moderate-severity XSS high-consequence in operational environments.

Stored cross-site scripting in Fleetwire Fleet Management WordPress plugin versions up to 1.0.19 allows authenticated contributors and above to inject malicious scripts via the fleetwire_list shortcode due to insufficient input sanitization and output escaping. When site visitors access pages containing the injected shortcode, the attacker's scripts execute in their browsers with access to session cookies and site functionality, enabling credential theft, malware distribution, or defacement. No public exploit code or active exploitation has been confirmed at time of analysis.

Stored Cross-Site Scripting in the Valuation Calculator WordPress plugin (all versions up to 1.3.2) allows authenticated attackers with Contributor-level access or higher to inject arbitrary JavaScript through the 'link' parameter due to insufficient input sanitization and output escaping. Injected scripts execute in the context of any user viewing the affected page, potentially compromising site visitors and enabling session hijacking, credential theft, or malware distribution. No public exploit code or active exploitation has been confirmed at time of analysis.

Mozilla Firefox and Thunderbird execute JavaScript via crafted object/embed tags, enabling remote attackers to achieve high-impact XSS without authentication. Affects Firefox <141, Firefox ESR <128.13/<140.1, and Thunderbird <141/128.13/140.1. Users must visit a malicious page (UI:R), but attack complexity is low (AC:L) and no privileges required (PR:N). Vendor-released patches available across all affected product lines. No public exploit identified at time of analysis, though the attack surface is broad given browser/email client ubiquity.

Stored Cross-Site Scripting in WP Shortcodes Plugin - Shortcodes Ultimate allows authenticated attackers with Author-level access to inject arbitrary JavaScript through insufficiently sanitized 'Title' and 'Slide link' fields in image uploads, affecting all versions up to 7.4.2. The injected scripts execute in the context of any user viewing affected pages, enabling session hijacking, credential theft, or malware distribution. No public exploit code has been identified at time of analysis, but the vulnerability requires only standard WordPress Author privileges and network access to exploit.

Cross-site scripting in HotelRunner's B2B platform allows a high-privileged authenticated attacker to inject malicious scripts into web pages viewed by other users. The Changed scope (S:C) in the CVSS vector confirms the injected payload executes in a victim's browser context, enabling session hijacking or credential theft against other platform users. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.15% (36th percentile) reflects a low probability of widespread exploitation.

Reflected and DOM-Based Cross-Site Scripting in Rolantis Information Technologies Agentis (all versions before 4.32) allows remote unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session when the victim is tricked into clicking a crafted URL. The Scope:Changed vector indicates injected script executes in the context of a different security origin than the vulnerable component. No public exploit code has been identified and EPSS sits at 0.17% (38th percentile), consistent with an unweaponized, newly disclosed web application flaw reported by Turkey's national CERT (USOM).

Reflected cross-site scripting in Public Chat Room 1.0 allows authenticated remote attackers to inject malicious scripts via the chat_msg or your_name parameters in /send_message.php, requiring user interaction to trigger payload execution. The vulnerability has a low CVSS score (2.0) and EPSS exploitation probability (0.05th percentile), but publicly available exploit code exists, limiting attack complexity for threat actors with valid credentials.

Reflected cross-site scripting (XSS) in PHPGurukul Apartment Visitors Management System 1.0 allows remote attackers to inject malicious scripts via the searchdata parameter in /search-visitor.php. The vulnerability requires user interaction (clicking a malicious link) but enables session hijacking, credential theft, and malware distribution. Publicly available exploit code exists; however, the low EPSS score (0.07%) and minimal scope impact suggest limited real-world exploitation pressure despite public disclosure.

Cross-site scripting (XSS) in PHPGurukul Taxi Stand Management System 1.0 allows remote attackers to inject malicious scripts via the searchdata parameter in /search.php. The vulnerability requires user interaction (clicking a malicious link) and has limited integrity impact. A publicly available proof-of-concept exists, though EPSS score of 0.07% suggests minimal real-world exploitation probability despite active public disclosure.

Reflected cross-site scripting (XSS) in PHPGurukul Taxi Stand Management System 1.0 allows remote attackers to inject arbitrary JavaScript via the searchdata parameter in /admin/search-autoortaxi.php. The vulnerability requires user interaction (clicking a malicious link) but no authentication. Publicly available exploit code exists, though EPSS score (0.07%) indicates low real-world exploitation probability relative to CVSS severity.

Stored cross-site scripting (XSS) in PHPGurukul Taxi Stand Management System 1.0 allows authenticated users to inject malicious scripts via the adminname parameter in /admin/admin-profile.php, affecting application integrity. The vulnerability requires user interaction (UI:P per CVSS 4.0 vector) and an authenticated admin account (PR:L), but public exploit code exists and the risk is amplified by the admin-tier access context. EPSS exploitation probability is minimal at 0.05% percentile, suggesting limited real-world weaponization despite proof-of-concept availability.

Stored cross-site scripting (XSS) in PHPGurukul Time Table Generator System 1.0 allows authenticated users to inject malicious scripts via the adminname parameter in /admin/profile.php, affecting other users who view the compromised admin profile. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting direct impact to integrity (VI:L), but publicly available exploit code demonstrates feasibility for authorized attackers to escalate privileges or perform actions on behalf of administrators.

Stored cross-site scripting (XSS) in PHPGurukul Online Banquet Booking System 1.0 allows authenticated remote attackers to inject malicious scripts via the searchdata parameter in /admin/booking-search.php, which are then reflected to other users viewing search results. The vulnerability requires user interaction (clicking a malicious link) and authenticated access to the admin panel, resulting in session hijacking or credential theft. Publicly available exploit code exists, though the EPSS score of 0.07% (percentile 21%) and low CVSS score of 2.0 suggest limited real-world exploitation likelihood due to the authentication and user interaction requirements.

Stored or reflected cross-site scripting (XSS) vulnerability in PHPGurukul Online Banquet Booking System 1.0 allows remote attackers to inject malicious scripts via the user_login or userpassword parameters in /admin/login.php. User interaction is required for exploitation. Publicly available exploit code exists, and EPSS score of 0.10% indicates low real-world exploitation probability despite public disclosure.

Reflected cross-site scripting (XSS) in PHPGurukul Online Banquet Booking System 1.0 allows authenticated remote attackers to inject malicious scripts via the adminname parameter in /admin/admin-profile.php. The vulnerability requires user interaction (UI:P) to trigger payload execution but carries public exploit code, making it readily weaponizable despite the low CVSS score of 2.0 and minimal EPSS probability (0.07%).

Execute arbitrary shortcodes in WordPress sites running WP Shortcodes Plugin - Shortcodes Ultimate through version 7.4.2 via Cross-Site Request Forgery targeting site administrators. Unauthenticated attackers can forge requests that bypass nonce validation in the preview function, allowing execution of arbitrary shortcodes if an admin clicks a malicious link. When combined with CVE-2025-7354, this enables Reflected Cross-Site Scripting. EPSS score of 6.1 (moderate CVSS) reflects the UI requirement and need for admin interaction, though real-world risk is elevated due to the attack surface in WordPress admin workflows. No public exploit code or CISA KEV confirmation identified at time of analysis.

Improper restriction of rendered UI layers in RuoYi up to version 4.8.1 allows authenticated remote attackers to manipulate image source handling, leading to unauthorized UI layer visibility or modification. The CVSS score of 2.1 reflects limited integrity impact requiring authenticated access, but the low EPSS score (0.05%, 15th percentile) suggests this vulnerability has minimal real-world exploitation probability despite publicly available exploit code.

Stored cross-site scripting (XSS) in RuoYi up to version 4.8.1 allows authenticated users to inject malicious scripts via the SysNoticeController.addSave function, compromising integrity of system notices. The vulnerability requires user interaction and authenticated access but has a publicly available proof-of-concept. With an EPSS score of 0.05%, exploitation remains unlikely in practice despite the public disclosure.

Cross-site scripting (XSS) in WikiDocs up to version 1.0.78 allows remote attackers to inject malicious scripts via the path parameter in template.inc.php, requiring user interaction to trigger. The vulnerability has publicly available exploit code and carries a low CVSS score (2.1) due to its reliance on user interaction and limited impact scope, though the EPSS score of 0.10% suggests minimal real-world exploitation likelihood despite public disclosure.

Reflected cross-site scripting in Huashengdun WebSSH up to version 1.6.2 allows remote attackers to inject malicious scripts via the hostname or port parameters on the login page, requiring user interaction to trigger. The vulnerability has a low CVSS score of 2.1 due to user interaction requirement and limited impact (integrity only), but publicly available exploit code exists and the vendor has not responded to disclosure attempts.

Stored cross-site scripting (XSS) in Portabilis i-Diario 1.5.0 allows authenticated users to inject malicious scripts via the Justificativa parameter in the /justificativas-de-falta endpoint, which are then executed in the browsers of other users viewing the page. The vulnerability requires user interaction (clicking a malicious link) and authenticated access, limiting its severity despite public exploit availability. EPSS exploitation probability is very low at 0.05 percentile, and the vendor has not responded to disclosure.

Stored cross-site scripting (XSS) in Portabilis i-Diario 1.5.0 allows authenticated users to inject malicious scripts via the filter[by_description] parameter in the /conteudos endpoint, which are then reflected to other users. The vulnerability requires user interaction (UI:P) to trigger but has low confidentiality impact and publicly available exploit code; however, the extremely low EPSS score (0.05%) and vendor non-responsiveness suggest limited real-world exploitation despite disclosed POC.

Cross-site scripting (XSS) in Portabilis i-Diario 1.5.0 allows authenticated users to inject malicious scripts via the Anexo parameter in the justificativas-de-falta endpoint, impacting other users who view the affected content. The vulnerability requires user interaction and authenticated access, with an EPSS score of 0.05% indicating low real-world exploitation likelihood despite public exploit availability. The vendor has not responded to disclosure communications.

Stored cross-site scripting in Portabilis i-Educar 2.9.0 allows authenticated remote attackers to inject malicious scripts via the nm_tipo parameter in the Turma Module administrative interface. The vulnerability requires user interaction and affects the integrity of application data. Publicly available exploit code exists, and the vendor has not responded to disclosure.

Stored cross-site scripting in Portabilis i-Educar up to version 2.10 allows authenticated remote attackers to inject malicious scripts via the Motivo/descricao parameter in the Calendar Module (/intranet/educar_calendario_dia_motivo_cad.php), requiring user interaction to execute. Public exploit code is available and the vendor has not responded to disclosure attempts despite early notification.

Stored cross-site scripting (XSS) vulnerability in Portabilis i-Educar 2.9.0 and 2.10.0 allows authenticated users to inject malicious scripts via the novo_titulo and novo_descricao parameters in the Agenda Module (/intranet/agenda.php), which are then executed in the browsers of other users viewing the affected content. The vulnerability requires user interaction (victim must view the crafted agenda entry) and authenticated access, resulting in a low-severity impact with an EPSS exploitation probability of 0.06% percentile 19. Public exploit code is available, though vendor did not respond to early disclosure notification.

Stored cross-site scripting (XSS) in Portabilis i-Educar 2.9.0 allows authenticated users to inject malicious scripts via the 'Deficiência ou Transtorno' parameter in the Disabilities Module (/intranet/educar_deficiencia_lst.php), affecting other users who view the injected content. The vulnerability requires user interaction (victim must view the page) and authenticated access, limiting its severity to reflected/stored XSS with user-level privileges. Public exploit code exists, but active exploitation has not been confirmed in CISA KEV, and the vendor has not responded to disclosure.

Stored cross-site scripting (XSS) in JeeSite's xssFilter function allows authenticated users to inject malicious scripts via the text parameter in EncodeUtils.java, affecting versions up to 5.12.0. The vulnerability requires user interaction to trigger payload execution and has publicly available exploit code. With EPSS score of 0.07% and CVSS 2.0, exploitation likelihood is low despite public disclosure, but remediation is straightforward via vendor patch.

Stored cross-site scripting in PHPGurukul Apartment Visitors Management System 1.0 allows authenticated users to inject malicious scripts via the adminname parameter in /admin-profile.php, affecting other administrators who view the modified profile. The vulnerability requires user interaction (UI:P) and authenticated access (PR:L), limiting its severity despite remote network accessibility. Publicly available exploit code exists, though real-world exploitation depends on social engineering authenticated users to click malicious links or administrative interaction.