By weakness (CWE)

CWE-79: related vulnerabilities

CVEs classified under CWE-79. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

261 published vulnerabilities · page 1 of 3

• CVE-2026-43984HIGH 8.9

  Tautulli, a Python monitoring application for Plex Media Server, contains a stored cross-site scripting (XSS) vulnerability in versions before 2.17.1. The flaw allows low-privilege users—including guest accounts when enabled—to inject malicious code into application logs via an unauthenticated endpoint. When an administrator views the logs, the injected code executes in their browser without restriction, giving attackers control within the admin's session. This is a privilege escalation and lateral attack vector that requires only guest-level access to trigger.

• CVE-2026-41031HIGH 8.7

  Vinna Process Monitor version 4.0 Service Pack 1 (Build 63255) contains a stored cross-site scripting vulnerability that allows authenticated users with minimal privileges to inject malicious code that persists in the application. When other users—particularly administrators—view the affected content, the injected code executes in their browsers, enabling attackers to steal administrative tokens and session credentials without requiring further user interaction after the initial injection.

• CVE-2026-45348HIGH 8.7

  pyLoad is a popular open-source download manager. A vulnerability in its web interface allows attackers to inject malicious JavaScript code. If someone with access to submit download links injects code into a URL, that code executes in the browser of any operator viewing the downloads list. This happens because the application inserts the URL directly into the page without sanitizing it, and the modern theme lacks security policies that would block inline scripts. The vulnerability affects all versions before 0.5.0b3.dev100.

• CVE-2026-47759HIGH 8.7

  TinyMCE, a widely-used open-source rich text editor, contains a stored cross-site scripting (XSS) vulnerability in versions before 5.11.1, 7.9.3, and 8.5.1. Authenticated attackers can craft malicious content that exploits unsanitized data-mce-* attributes (such as data-mce-href, data-mce-src, and data-mce-style) to inject and persist malicious scripts. When the editor serializes the content, attackers' payloads override legitimate attribute protections, allowing arbitrary JavaScript execution in users' browsers. The vulnerability requires user interaction and authentication but affects all users viewing the injected content.

• CVE-2026-47760HIGH 8.7

  TinyMCE, a widely used open-source rich text editor, contains a cross-site scripting (XSS) vulnerability in versions 6.8.0 through 7.0.x. The flaw stems from improper handling of SVG namespace scope within the editor's HTML sanitizer. An attacker with login access can craft malicious SVG payloads using nested elements that evade the sanitizer's attribute filtering, allowing them to inject and execute arbitrary JavaScript in the context of the application. The vulnerability requires user interaction (clicking or otherwise engaging with the crafted content) but can affect all users viewing that content once injected. This issue is resolved in TinyMCE 7.1.0.

• CVE-2026-47761HIGH 8.7

  TinyMCE, a widely-used open source rich text editor, contains a stored cross-site scripting (XSS) vulnerability in its media plugin. An authenticated attacker can inject malicious JavaScript by crafting specially formed data-mce-* HTML attributes within media content. When that content is later viewed or rendered by any user, the injected script executes in their browser with the privileges of the application. This is particularly dangerous because the malicious payload persists in the editor's content—it isn't just a temporary injection. Organizations using TinyMCE versions prior to 5.11.1, 7.9.3, or 8.5.1 with the media plugin active should prioritize upgrading immediately.

• CVE-2026-47762HIGH 8.7

  TinyMCE, a widely-used open-source rich text editor, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated attackers to inject malicious scripts into protected content. The flaw exists in how the editor processes specially crafted comments marked with the mce:protected tag, bypassing built-in sanitization controls. When a user later restores or views the protected content, the injected script executes in their browser. This affects users who have enabled TinyMCE's protect option, a feature designed to mark content as requiring special handling. The vulnerability has been patched in versions 5.11.1, 7.9.3, and 8.5.1.

• CVE-2026-48527HIGH 8.7

  HAX CMS, a platform for managing distributed microsites with PHP or Node.js backends, contains a stored cross-site scripting (XSS) flaw in its page-editing API. Authenticated users with page-editing permissions can inject malicious scripts that persist in the system by circumventing the HTML sanitizer through a specific formatting bypass. Once stored, these scripts execute in the browsers of other users who view the affected pages, potentially stealing credentials, hijacking sessions, or defacing content.

• CVE-2026-49368HIGH 8.7

  JetBrains YouTrack versions before 2026.1.13162 contain a stored cross-site scripting (XSS) vulnerability in project notification templates. An authenticated attacker can inject malicious scripts into notification templates that will execute in the browsers of other users who view those notifications. This is a stored XSS rather than a reflected attack, meaning the payload persists and affects multiple users over time, increasing its impact potential.

• CVE-2026-9024HIGH 8.7

  A stored cross-site scripting (XSS) vulnerability exists in DELMIA Service Process Engineer's Process Experience Studio component across multiple releases. An attacker with user-level access can inject malicious scripts that persist in the application, executing in the browsers of other users who view the affected content. This allows unauthorized access to sensitive data or actions performed on behalf of victims within their authenticated sessions.

• CVE-2026-41098HIGH 8.4

  Azure Stack Edge contains a cross-site scripting (XSS) vulnerability that allows an authorized administrator to inject malicious scripts into the web interface. When other authorized users interact with the compromised interface, those scripts execute in their browsers, enabling the attacker to spoof content, steal session tokens, or perform actions on their behalf. This is a high-severity issue because it affects a privileged management interface and can lead to widespread compromise within an organization's edge infrastructure.

• CVE-2026-6824HIGH 8.4

  A stored cross-site scripting (XSS) vulnerability affects certain 1xxx series network video recorder (NVR) devices. Attackers with high-level administrative access can inject malicious JavaScript into the device through specific functional modules that fail to properly validate user input. Unlike reflected XSS attacks that require a user to click a malicious link, this vulnerability persists on the NVR backend—meaning when any administrator or authorized user logs in and views the compromised pages, the attacker's scripts run automatically in their browser session without additional user interaction beyond normal login. This could enable an attacker to impersonate users, perform unauthorized actions on the device or connected systems, or exfiltrate sensitive data like recordings or credentials.

• CVE-2026-24751HIGH 8.2

  Kiteworks, a platform used to securely share and manage sensitive business data, contains a reflected cross-site scripting (XSS) vulnerability in its Secure Data Forms feature. An attacker can craft a malicious link that, when clicked by a legitimate user, causes the victim's browser to execute arbitrary JavaScript code within the context of the Kiteworks application. This could allow the attacker to steal session cookies, impersonate the user, or perform unauthorized actions on their behalf. The vulnerability affects all versions of Kiteworks prior to 9.3.0.

• CVE-2026-24752HIGH 8.2

  Kiteworks, a private data network platform, contains a reflected cross-site scripting (XSS) flaw in its Secure Data Forms component that could allow an attacker to inject malicious JavaScript. An attacker could craft a deceptive link and trick a user into clicking it, causing the user's browser to execute arbitrary code in the context of their Kiteworks session. This is a social engineering attack vector rather than a direct infrastructure compromise, but the impact can be severe if the victim has administrative or sensitive data access.

• CVE-2026-45627HIGH 8.2

  Arcane, a Docker container management interface, contains a reflected cross-site scripting (XSS) vulnerability in its unauthenticated logo endpoint. An attacker can craft a malicious URL containing injected CSS or JavaScript that gets reflected into an SVG document served to a logged-in admin user. When the admin visits this link, the injected script executes in the browser with full access to Arcane's origin, including HttpOnly session cookies, potentially leading to complete account compromise. The vulnerability exists because the endpoint does not properly escape user input and the application lacks protective HTTP headers. This issue is resolved in Arcane version 1.19.0.

• CVE-2026-47631HIGH 8.1

  Microsoft Exchange Server contains a cross-site scripting (XSS) vulnerability that could allow attackers to inject malicious scripts into web pages served by the Exchange interface. An attacker can trick users into visiting a crafted link, causing their browser to execute malicious code in the context of their Exchange session. This could lead to account compromise, email theft, or impersonation of the user to other Exchange recipients. The vulnerability requires user interaction (clicking a link) but does not require special privileges to exploit.

• CVE-2025-14773HIGH 8.0

  ABB T-MAC Plus versions up to 4.0-24 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. When another user views a page containing the injected script, the script executes in their browser with their privileges, potentially enabling attackers to steal sensitive information, hijack sessions, or perform unauthorized actions on behalf of victims. The vulnerability requires both user authentication and victim interaction, limiting but not eliminating its risk in multi-user environments.

• CVE-2026-33245HIGH 8.0

  React Router, a widely-used routing library for React applications, contains a cross-site scripting (XSS) vulnerability in its experimental React Server Components (RSC) feature. Versions 7.7.0 through 7.13.1 are affected. If an attacker can influence redirect instructions sent to your application—for example, through a compromised backend endpoint or man-in-the-middle scenario—malicious code could execute in users' browsers. The vulnerability is limited to applications actively using the unstable RSC APIs; standard React Router implementations are not impacted. A patch is available in version 7.13.2.

• CVE-2026-41722HIGH 8.0

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated attackers with policy creation, view, or text-widget privileges to inject malicious scripts. These scripts execute in the context of administrative actions within VMware Cloud Foundation Operations, potentially allowing attackers to perform unauthorized administrative operations. The vulnerability requires user interaction (such as an administrator viewing a malicious policy or widget) but can have significant impact once triggered.

• CVE-2026-41723HIGH 8.0

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts. These scripts execute in the context of administrative sessions, potentially enabling attackers to perform unauthorized administrative actions. The vulnerability requires an attacker to have legitimate access credentials and user interaction to succeed, but poses significant risk to organizations running affected VMware infrastructure management platforms.

• CVE-2026-41724HIGH 8.0

  VMware Cloud Foundation Operations contains multiple stored cross-site scripting (XSS) vulnerabilities that allow authenticated users with policy, view, or text-widget creation privileges to inject malicious scripts. These scripts execute in the context of administrative sessions, potentially enabling attackers to perform unauthorized administrative actions without additional authentication. The vulnerability requires both authentication and user interaction (clicking a link or visiting a crafted page), but once triggered, grants full administrative capability within the affected platform.

• CVE-2026-45644HIGH 8.0

  Microsoft Live Share Canvas SDK contains a cross-site scripting (XSS) vulnerability that allows an authorized user to inject malicious code into web pages. An attacker with valid credentials can craft specially formatted input that executes arbitrary JavaScript in the context of other users' browsers, potentially allowing them to steal sessions, modify content, or escalate their privileges within collaborative environments. The vulnerability requires user interaction—specifically, a victim must view a page containing the attacker's injected payload—but poses significant risk in teams using Live Share Canvas for real-time code collaboration.

• CVE-2026-41518HIGH 7.6

  Chartbrew, an open-source data visualization platform, contains a stored cross-site scripting (XSS) vulnerability affecting versions 4.9.0 through 5.0.0. A project editor can inject malicious HTML and JavaScript into chart legend fields, which is then executed in the browsers of anyone viewing the public dashboard—including unauthenticated users—without requiring any user interaction. This allows an attacker to steal sensitive data, hijack user sessions, or perform actions on behalf of viewers.

• CVE-2026-9809HIGH 7.6

  Mautic 7 contains a stored cross-site scripting (XSS) vulnerability in its Projects component. When project names are displayed as tags or in hover-over tooltips on admin pages—like campaign, email, or form management screens—the application fails to sanitize user input. An authenticated attacker with project creation or editing permissions can inject malicious JavaScript into a project name. When an administrator later views any entity tied to that compromised project and hovers over its tag, the attacker's script runs in the admin's browser with their full privileges. This could lead to unauthorized administrative actions, system configuration changes, or data theft.

• CVE-2026-45481HIGH 7.3

  A cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint allows an authenticated user to inject malicious scripts into web pages. An attacker with valid SharePoint access can craft a specially formed input that bypasses input validation, causing the server to generate pages containing attacker-controlled JavaScript. When other authorized users view the compromised page, their browser executes the injected script in the context of the SharePoint application, enabling the attacker to impersonate them, steal session tokens, or perform actions on their behalf. The vulnerability requires user interaction (clicking a link or visiting a page) but poses significant risk within organizations that rely on SharePoint for document management and collaboration.

• CVE-2026-47634HIGH 7.3

  A vulnerability in Microsoft Office SharePoint allows someone with valid access to inject malicious content that tricks downstream components into displaying fake or spoofed information to other users. The attacker must have legitimate credentials and convince a user to interact with the malicious content, but once triggered, the attack succeeds reliably and can achieve high impact by either stealing sensitive data or modifying what users see.

• CVE-2023-54351HIGH 7.2

  The Sonaar Music Plugin for WordPress version 4.7 contains a stored cross-site scripting (XSS) vulnerability. An attacker can inject malicious JavaScript code through the comment functionality on music playlist pages. When site visitors view these playlists, the malicious script executes in their browsers, potentially allowing attackers to steal session cookies, redirect users, deface content, or perform actions on behalf of the victim. No authentication is required to exploit this vulnerability.

• CVE-2025-11262HIGH 7.2

  Link Whisper Free, a WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. When site visitors access affected pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, redirect users, or perform actions on their behalf. The vulnerability stems from improper handling of the user_id parameter and affects all versions up to 0.9.0.

• CVE-2026-2374HIGH 7.2

  The Login No Captcha reCAPTCHA WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in all versions up to 1.8.0. An unauthenticated attacker can exploit this by triggering a login attempt from a non-standard login page URL (such as xmlrpc.php), which causes the plugin to store malicious JavaScript in the WordPress admin dashboard settings. When an administrator logs in within 30 seconds of the attack, that JavaScript executes in their browser with the administrator's privileges. The vulnerability requires the admin to have a whitelisted IP address configured in the plugin, which is a common configuration for sites restricting login access.

• CVE-2026-50231HIGH 7.2

  Lyrion Music Server version 9.2.0 contains a stored cross-site scripting (XSS) vulnerability in its log viewer that allows attackers to inject malicious JavaScript without authentication. The vulnerability exists because the application fails to properly escape template variables, allowing crafted input to be permanently stored and executed in the browsers of users who view the logs. Attackers can inject payloads through multiple vectors including search parameters, log line numbers, file paths, or by manipulating values that the server naturally logs such as HTTP headers, stream titles, and player names.

• CVE-2026-50232HIGH 7.2

  Lyrion Music Server version 9.2.0 has a stored cross-site scripting (XSS) vulnerability that lets attackers embed malicious code into audio file metadata fields such as GENRE, ARTIST, and ALBUM. When users browse or play these files through the web interface, the injected scripts execute in their browser, potentially granting attackers access to server management functions and sensitive configuration details. Unlike reflected XSS attacks that require a specially crafted link, this vulnerability persists in the server's database, affecting any user who interacts with a poisoned media file.

• CVE-2026-7052HIGH 7.2

  HT Contact Form, a popular WordPress form builder plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 2.8.2. An unauthenticated attacker can inject malicious scripts through file upload fields that persist in the database and execute in administrators' browsers when viewing form submissions. The vulnerability requires the 'Store Submissions' setting to be enabled—a common configuration. This is a stored rather than reflected attack, making it more dangerous because the payload remains active until manually removed.

• CVE-2026-7556HIGH 7.2

  The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 7.5.49.7212. An unauthenticated attacker can inject malicious scripts into page comments that execute when users visit the affected page. However, exploitation requires two conditions: the site administrator must have enabled the 'Parse Vimeo and YouTube links' setting (which is not enabled by default), and a moderator must approve the malicious comment before it becomes visible. Once those conditions are met, the injected code runs in the browsers of everyone who views the page.

• CVE-2026-7634HIGH 7.2

  The SlimStat Analytics plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts through the User-Agent header. When an administrator has enabled the 'show_complete_user_agent_tooltip' setting, these injected scripts will execute in the browsers of users who visit affected pages. This is a stored vulnerability, meaning the malicious payload persists in the database rather than requiring a specially crafted link. All versions up to and including 5.4.11 are affected.

• CVE-2026-8438HIGH 7.2

  The All-In-One Security (AIOS) WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 5.4.7. An unauthenticated attacker can inject malicious JavaScript into debug logs by crafting specially designed REST API requests. When site administrators view the debug logs page, the injected script executes in their browser, potentially allowing the attacker to steal session credentials, execute unauthorized actions, or compromise the entire WordPress site. The vulnerability requires two specific plugin features to be enabled: the 'Disable REST API for non-logged in users' setting and debug logging.

• CVE-2026-8901HIGH 7.2

  A WordPress plugin called 'Integration for Freshsales – Contact Form 7, WPForms, Elementor, Gravity Forms and More' contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.0.15. Attackers can inject malicious scripts through form submissions. The injected code executes when a form submission fails to reach the CRM API and an administrator later views the error details in the WordPress admin dashboard. This affects any WordPress site using the vulnerable plugin versions without requiring the attacker to be logged in.

• CVE-2025-15654HIGH 7.1

  CVE-2025-15654 is a reflected cross-site scripting (XSS) vulnerability in Fox-themes Prague versions 2.2.8 and earlier. An attacker can craft a malicious URL containing unsanitized input that, when visited by a user, executes arbitrary JavaScript in their browser within the context of the vulnerable application. This allows the attacker to steal session cookies, perform actions on behalf of the victim, or redirect them to phishing sites—all without modifying the application itself.

• CVE-2025-52759HIGH 7.1

  A reflected cross-site scripting (XSS) vulnerability exists in the UnboundStudio Accordion FAQ plugin affecting versions up to 2.2.1. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the context of the affected site. This allows theft of session cookies, credential harvesting, malware injection, or other client-side attacks. The vulnerability requires user interaction—specifically clicking a malicious link—but has no authentication barrier, making it a straightforward social engineering vector.

• CVE-2025-67448HIGH 7.1

  A stored cross-site scripting (XSS) vulnerability exists in the SMS module of Neterbit NW-431F routers running firmware version 20241014-IR03 and earlier. An attacker can craft a malicious SMS message and send it to a router user; when that user views the message, the embedded script executes in their browser. This allows attackers to steal session tokens, redirect users, inject fake content, or perform actions on behalf of the victim—all without the victim realizing they've been compromised through what appears to be a routine SMS.

• CVE-2026-41845HIGH 7.1

  Spring Framework contains a flaw in its JavaScriptUtils.javaScriptEscape() function that fails to properly escape certain characters. This weakness allows attackers to inject malicious JavaScript code that executes in users' browsers, potentially stealing session data, credentials, or performing actions on behalf of the user. The vulnerability requires user interaction—specifically clicking a malicious link or visiting a compromised page—but does not require authentication. Multiple versions of Spring Framework across the 5.3, 6.1, 6.2, and 7.0 release lines are affected.

• CVE-2026-42678HIGH 7.1

  GiveWP, a popular WordPress donation and fundraising plugin maintained by Liquid Web/StellarWP, contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by site visitors. Unlike traditional XSS flaws, this vulnerability operates at the DOM (Document Object Model) level in the browser, meaning the attack payload is crafted and executed client-side rather than originating from the server. An attacker can trick a user into clicking a malicious link or visiting a compromised page, leading to credential theft, session hijacking, or unauthorized actions taken on behalf of the victim within the vulnerable GiveWP installation.

• CVE-2026-42681HIGH 7.1

  E2Pdf.Com's e2pdf plugin contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user visits a crafted link, the injected code executes in their browser within the context of the affected site, potentially allowing theft of session data, credentials, or sensitive information. The vulnerability affects e2pdf versions up to and including 1.32.14.

• CVE-2026-42683HIGH 7.1

  VikBooking Hotel Booking Engine & PMS contains a DOM-based cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious link or embed JavaScript in user-controllable input fields; when a victim visits the page or interacts with the compromised element, the script executes in their browser with access to session data and sensitive information. This is a client-side vulnerability requiring user interaction but affecting multiple users through a single compromised page.

• CVE-2026-42685HIGH 7.1

  Ahmad WP Job Portal versions up to 2.5.1 contain a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. An attacker can craft a specially designed link and trick a user into clicking it, causing the injected code to execute in that user's browser with their privileges. This vulnerability requires user interaction—the victim must click a malicious link—but once triggered, it can be used to steal session tokens, deface content, redirect users to phishing sites, or perform actions on behalf of the victim.

• CVE-2026-48209HIGH 7.1

  OTRS ticket management systems contain a reflected cross-site scripting (XSS) vulnerability in how they handle user input during ticket operations. An attacker can craft a malicious URL containing JavaScript code and trick an authenticated agent into clicking it. When opened, the script executes within the agent's browser session, potentially allowing the attacker to steal session tokens, modify tickets, or perform actions on behalf of that agent. The attack requires social engineering to deliver the link but does not require the attacker to have direct system access.

• CVE-2026-48839HIGH 7.1

  A cross-site scripting (XSS) vulnerability exists in VeronaLabs WP Statistics plugin versions up to 14.16.6. The flaw allows attackers to inject malicious scripts that execute in a user's browser when they interact with a compromised page. Unlike traditional XSS attacks that rely on server-side injection, this variant operates at the DOM (Document Object Model) level, meaning the vulnerability stems from how the plugin processes user input on the client side. An attacker could craft a malicious link or embed code that, when visited by a site administrator or editor, steals session tokens, modifies page content, or performs actions on their behalf.

• CVE-2026-48865HIGH 7.1

  ThimPress LearnPress, a popular WordPress learning management plugin, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages viewed by users. An attacker can craft a malicious URL and trick a user into clicking it, causing the victim's browser to execute arbitrary JavaScript in the context of the LearnPress application. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the user.

• CVE-2026-49371HIGH 7.1

  JetBrains TeamCity versions prior to 2026.1.1 contain a reflected cross-site scripting (XSS) vulnerability in the keyword filter feature. An attacker can craft a malicious URL containing unsanitized input that, when visited by a TeamCity user, executes arbitrary JavaScript in the victim's browser within the context of the TeamCity application. This allows session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-11166MEDIUM 6.8

  Google Chrome versions before 149.0.7827.53 contain a flaw in how it processes SVG (Scalable Vector Graphics) content that allows attackers to inject malicious scripts or HTML into web pages. An attacker would craft a specially designed HTML page and trick a user into visiting it; if the user does, arbitrary code could execute within the browser with the user's privileges, potentially stealing data, modifying page content, or performing actions on the user's behalf. The vulnerability requires user interaction and is rated Medium severity by Google's security team.

• CVE-2026-42676MEDIUM 6.5

  myCred, a gamification and community engagement plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. Unlike reflected XSS attacks that require victims to click a link, stored XSS persists in the application's database, meaning any user—including administrators—who views the affected content will execute the attacker's code. The vulnerability affects myCred versions up to and including 3.0.4. An authenticated attacker could exploit this to steal session tokens, redirect users, deface content, or perform actions on behalf of legitimate users.

• CVE-2026-45501MEDIUM 6.5

  CVE-2026-45501 is a Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server that allows an authenticated attacker to manipulate the server into making requests on their behalf, potentially enabling network-based spoofing attacks. The vulnerability requires valid credentials to exploit, limiting its immediate blast radius, but poses a meaningful risk for organizations where internal attackers or compromised user accounts exist. The vulnerability affects multiple versions of Exchange Server and Exchange Server Subscription Edition.

• CVE-2021-47982MEDIUM 6.4

  WordPress administrators using the WP-Paginate plugin version 2.1.3 should be aware of a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into the plugin's settings. An attacker with login credentials can submit crafted requests to the plugin configuration page, embedding JavaScript payloads that are permanently stored in the database and executed whenever site administrators access those settings. This means the payload runs in the admin's browser session, potentially allowing the attacker to steal session tokens, modify site content, create new admin accounts, or perform other harmful actions on behalf of the compromised administrator.

• CVE-2021-47983MEDIUM 6.4

  The Stripe Payments WordPress plugin version 2.0.39 contains a stored cross-site scripting (XSS) vulnerability that allows logged-in attackers to inject malicious JavaScript code into plugin settings. When an administrator views these compromised settings, the injected script executes in their browser with full administrative privileges. This type of attack is particularly dangerous because the malicious code persists in the database and affects all administrators who access the settings page.

• CVE-2021-47984MEDIUM 6.4

  The WP24 Domain Check WordPress plugin version 1.6.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with plugin access to inject malicious JavaScript code. When an admin later views the plugin's settings page, that injected code executes in their browser, potentially allowing the attacker to perform unauthorized actions on their behalf or steal sensitive information. This is a persistence threat—once injected, the malicious script remains in the plugin settings until manually removed.

• CVE-2025-14042MEDIUM 6.4

  The Automotive Car Dealership Business WordPress Theme contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 13.4.1. An attacker with contributor-level or higher permissions can inject malicious scripts into Portfolio Item 'Project Details' fields. These scripts will execute when other users view the affected pages, potentially compromising visitor sessions, stealing credentials, or defacing content. The vulnerability stems from the theme's failure to properly sanitize and escape user input in a custom field.

• CVE-2026-10024MEDIUM 6.4

  The TinyMCE shortcode Addon plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 1.0.0. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code into pages via the 'btnrel' shortcode attribute. Because the plugin fails to properly sanitize and escape this input, the injected script will execute in the browsers of anyone who views the affected page. This is a *stored* vulnerability, meaning the malicious code persists in the page content until explicitly removed.

• CVE-2026-10738MEDIUM 6.4

  The jQuery Hover Footnotes plugin for WordPress allows attackers who can write or edit content on a site (author-level access or higher) to hide malicious scripts inside footnote markup. These scripts execute whenever anyone views the affected page. The vulnerability exists because the plugin doesn't properly clean user input before storing it, and the hidden scripts bypass WordPress's built-in protections by using a specific syntax that avoids HTML tags.

• CVE-2026-10862MEDIUM 6.4

  The Accordions plugin for WordPress has a security flaw that allows authenticated users with custom-level permissions or higher to inject malicious scripts into accordion content. When other users view pages containing these injected scripts, the scripts execute in their browsers, potentially exposing sensitive information or performing unwanted actions on their behalf. This vulnerability affects all versions up to and including 2.3.23.

• CVE-2026-2382MEDIUM 6.4

  The FPW Category Thumbnails WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.9.5. Any user with Subscriber-level access or higher can inject malicious JavaScript through the 'id' parameter in an AJAX function. This script persists in the plugin's settings and executes whenever an administrator views that page, potentially compromising administrator accounts. The vulnerability stems from the plugin failing to properly clean and escape user input before storing and displaying it.

• CVE-2026-3011MEDIUM 6.4

  The Recipe Card Blocks Lite WordPress plugin contains a flaw that allows authenticated authors and above to inject malicious scripts into recipe blocks. These scripts execute when anyone views the published post or its print version, potentially compromising visitor sessions or redirecting them to malicious sites. The vulnerability exists because the plugin decodes special character sequences after security checks have already been completed, bypassing intended protections.

• CVE-2026-3722MEDIUM 6.4

  A WordPress plugin called 'Auto Image Attributes From Filename With Bulk Updater' fails to properly clean and display user-supplied data in image metadata fields. This allows authenticated users with Author-level permissions or higher to embed malicious code into image properties. When site visitors view pages containing the injected image, that code runs in their browsers—potentially stealing session cookies, performing actions on their behalf, or redirecting them to malicious sites. The vulnerability affects all versions up to and including 4.9.

• CVE-2026-4080MEDIUM 6.4

  The Easy Cart plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'add_to_cart' shortcode. Attackers with Contributor-level access or above can inject malicious scripts into shortcode parameters that will execute for any user viewing the affected page. The vulnerability stems from incomplete sanitization—while HTML tags are stripped, quotation marks are not escaped, allowing attackers to break out of HTML attribute context and inject event handlers like onclick or onerror. All versions through 1.8 are affected.

• CVE-2026-4081MEDIUM 6.4

  The ZeM STL plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into website pages. When someone visits a page containing the injected script, their browser executes the attacker's code. This happens because the plugin doesn't properly clean or escape user input when processing shortcode parameters like 'url', 'color', and 'bgcolor'. All versions up to 1.0 are affected.

• CVE-2026-4334MEDIUM 6.4

  The Shariff Wrapper plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.6.20. Attackers with Contributor-level access or higher can inject malicious scripts through the 'headline' parameter in the [shariff] shortcode. When other users view the affected page, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further compromise. The vulnerability stems from the plugin's use of a permissive HTML sanitization routine followed by unsafe string replacement operations that reintroduce dangerous content after the sanitization check.

• CVE-2026-50592MEDIUM 6.4

  Znuny, a widely-used open-source helpdesk and ticketing platform, contains a reflected cross-site scripting (XSS) vulnerability in its administrative communication log interface. An authenticated attacker with login credentials can craft a malicious URL containing injected JavaScript that executes in the browser of another administrator viewing the communication logs. This could allow credential theft, session hijacking, or other actions performed on behalf of the compromised administrator. The vulnerability affects Znuny LTS versions before 6.5.21 and Znuny versions before 7.3.3.

• CVE-2026-5714MEDIUM 6.4

  The Enable Media Replace plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Author-level permissions or higher to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially compromising their accounts, stealing session data, or performing actions on their behalf. The vulnerability exists in all versions up to and including 4.1.8 and results from the plugin's failure to properly sanitize and escape the 'location_dir' parameter.

• CVE-2026-6275MEDIUM 6.4

  The StatCounter – Free Real Time Visitor Stats WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated authors to inject malicious scripts into their posts. When any visitor views a post authored by an attacker, the injected script executes in their browser. The vulnerability exists because the plugin fails to properly escape the author's nickname before outputting it into JavaScript code on every post page.

• CVE-2026-6427MEDIUM 6.4

  The a3 Lazy Load WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 2.7.6. An attacker with Contributor-level permissions can craft a malicious video element that exploits a regex parsing bug in the plugin's video filtering logic. When this crafted content is viewed by any site user—including administrators—malicious JavaScript executes in their browser. The vulnerability stems from improper quote handling in HTML attribute processing, combined with unescaped output in the admin interface.

• CVE-2026-7662MEDIUM 6.4

  The ePaperFlip Publisher plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with Contributor-level permissions or higher to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including version 1 and stems from the plugin failing to properly filter and escape user input in the 'publicationid' shortcode attribute before inserting it into JavaScript code.

• CVE-2026-7795MEDIUM 6.4

  The Click to Chat – WA Widget plugin for WordPress contains a flaw that allows authenticated users with basic contributor permissions to inject malicious code into pages. When someone clicks the WhatsApp chat button on an affected site, the injected code executes in their browser. The vulnerability stems from improper handling of a shortcode parameter: the plugin escapes user input in a way that works for HTML attributes, but that escaping is later decoded by browsers when the value appears inside a JavaScript function call within an event handler. This creates a window for attackers to break out of the intended string context and run arbitrary JavaScript.

• CVE-2026-7796MEDIUM 6.4

  The EmbedPress WordPress plugin, used for embedding PDFs, videos, and other rich media content, contains a stored cross-site scripting (XSS) vulnerability that allows attackers with contributor-level access to inject malicious scripts into pages. When other users visit those pages, the injected scripts execute in their browsers, potentially allowing attackers to steal credentials, perform unauthorized actions, or compromise user sessions. This affects all versions up to and including 4.5.3.

• CVE-2026-8599MEDIUM 6.4

  MailerPress, a popular WordPress plugin for email marketing and automation, contains a vulnerability that allows attackers with author-level or higher permissions to inject malicious scripts into campaign content. These scripts execute when administrators preview the campaigns in the WordPress dashboard. The vulnerability stems from the plugin not properly filtering user input when storing campaign HTML, nor adequately escaping that content when displaying it. The public-facing preview that customers see is protected by security headers, so the risk is primarily to the WordPress site's admin users rather than to recipients of sent emails.

• CVE-2026-8677MEDIUM 6.4

  Prime Elementor Addons, a WordPress plugin for building pages with Elementor, has a stored cross-site scripting (XSS) vulnerability that allows contributors and higher-privileged users to inject malicious scripts into pages. When other users view those pages, the injected scripts execute in their browsers, potentially compromising their sessions or stealing sensitive information. The vulnerability persists through versions up to 1.3.3 because the plugin fails to properly sanitize widget HTML settings before storing them.

• CVE-2026-8841MEDIUM 6.4

  The Extra Settings for RocketChat plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to 0.1. A WordPress user with contributor-level permissions or higher can craft a malicious 'title' attribute in the 'rocketchat' shortcode to inject JavaScript code into a page. When other users visit that page, the injected script executes in their browser within the site's context, potentially allowing the attacker to steal credentials, perform actions on their behalf, or deface content.

• CVE-2026-8880MEDIUM 6.4

  The RomanCart Ecommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its shortcode handler. An authenticated user with contributor permissions or higher can inject malicious JavaScript code into pages through the romancart_button shortcode's attributes. Once injected, that code executes for every visitor who views the affected page, potentially leading to session hijacking, credential theft, or defacement. The vulnerability exists in versions 2.0.8 and earlier due to inadequate input validation and output encoding.

• CVE-2026-8882MEDIUM 6.4

  A WordPress plugin called WP ApplicantStack Jobs Display contains a security flaw that allows certain logged-in users to inject malicious code into web pages. When other users visit those pages, the injected code runs in their browsers, potentially compromising their accounts or stealing sensitive information. The vulnerability affects all versions up to and including 1.1.1 and requires the attacker to have at least contributor-level permissions on the WordPress site.

• CVE-2026-8883MEDIUM 6.4

  The Global Body Mass Index Calculator WordPress plugin contains a stored cross-site scripting (XSS) flaw affecting versions 1.2 and earlier. Attackers with contributor-level access can inject malicious scripts through the plugin's shortcode functionality. These scripts persist in the database and execute whenever site visitors view affected pages, potentially compromising user sessions, stealing credentials, or spreading malware across your WordPress site.

• CVE-2026-8885MEDIUM 6.4

  The DeMomentSomTres Shortcodes plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its 'callout' shortcode feature. An authenticated user with contributor-level permissions or higher can inject malicious JavaScript code through the 'width' and 'align' shortcode parameters. Because the plugin fails to properly sanitize and escape these inputs, the injected code executes whenever any visitor views the affected page. This creates a persistent threat that compromises site visitors, not just the page editor.

• CVE-2026-8893MEDIUM 6.4

  A stored cross-site scripting (XSS) vulnerability exists in the Express Payment For Stripe WordPress plugin up to version 1.28.0. Authenticated users with contributor-level permissions or higher can embed malicious scripts into pages using the [stripe-express] shortcode. These scripts execute in the browsers of anyone viewing the affected page, potentially allowing attackers to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability stems from the plugin failing to properly escape shortcode attribute values before rendering them in HTML.

• CVE-2026-8895MEDIUM 6.4

  A WordPress plugin called 'kk blog card' contains a security flaw that allows contributors and higher-level users to embed malicious scripts into pages. When someone visits a page with the injected code, the script runs automatically in their browser. The vulnerability exists in versions 1.3 and earlier, and stems from the plugin not properly filtering user input before inserting it into HTML code.

• CVE-2026-8900MEDIUM 6.4

  The Simple SEO Slideshow WordPress plugin has a security flaw that allows authenticated users with contributor-level permissions or higher to inject malicious scripts into pages. When someone visits a page containing this injected code, the script executes in their browser—including for administrators. The vulnerability exists because the plugin does not properly filter user input when processing shortcode attributes, even though WordPress has built-in protections that should catch this. All versions through 1.2.8 are affected.

• CVE-2026-8977MEDIUM 6.4

  The WP GDPR Cookie Consent plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with subscriber-level permissions or higher to inject malicious JavaScript code into website pages. When other users visit an affected page, the injected script executes in their browsers, potentially allowing attackers to steal session tokens, redirect visitors, inject malware, or perform other actions on behalf of legitimate users. The vulnerability exists because the plugin fails to properly validate user input and safely display stored configuration settings.

• CVE-2026-9243MEDIUM 6.4

  The Plus Addons for Elementor plugin contains a flaw that allows authenticated WordPress users with contributor-level permissions or higher to inject malicious scripts into website pages. When a victim visits an affected page, the injected script executes in their browser, potentially compromising their session or stealing data. The vulnerability exists in the Carousel Anything widget's handling of the carousel_direction parameter and affects versions up to 6.4.15.

• CVE-2026-9281MEDIUM 6.4

  Master Addons For Elementor, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with author-level permissions to inject malicious scripts into pages. The vulnerability exists in the Custom JS Extension feature and affects all versions up to 3.1.0. Because the injected scripts persist in the database and execute whenever visitors view the affected pages, this could be used to steal credentials, distribute malware, or redirect users to phishing sites. The core issue is that the plugin fails to properly validate and sanitize user input when saving custom JavaScript code, and the security checks that exist only apply to the visual editor interface, not to direct API calls.

• CVE-2026-9644MEDIUM 6.4

  A WordPress plugin called LiveSmart Video Chat has a security weakness that allows authenticated users with contributor-level permissions to inject malicious code into pages. When other visitors view those pages, the injected code runs in their browsers, potentially compromising their accounts or data. The vulnerability exists in all versions up to 1.2 and stems from the plugin not properly filtering user input before displaying it on pages.

• CVE-2026-9714MEDIUM 6.4

  A vulnerability in the Simple Divi Shortcode WordPress plugin (versions 1.2 and earlier) allows authenticated users with contributor-level permissions or higher to inject malicious code into pages. When other users view those pages, the injected code executes in their browsers. The vulnerability stems from the plugin failing to properly sanitize user input in the [showmodule] shortcode's 'id' parameter. While this requires authenticated access, the ability to execute arbitrary scripts across users' sessions creates a meaningful security risk for WordPress sites using this plugin.

• CVE-2025-65640MEDIUM 6.3

  Arket Globe Document Intelligence version 5.0.0.559 contains a reflected cross-site scripting (XSS) vulnerability in the "Task in Progress / Recent" page. An authenticated attacker can inject malicious JavaScript into document creation fields that will execute in the browsers of other users viewing that page, potentially allowing session hijacking, credential theft, or other malicious actions performed on behalf of those users.

• CVE-2026-25599MEDIUM 6.3

  This vulnerability affects Orca heat pump devices and their control portal. An attacker can intercept unencrypted communications between older Orca heat pumps and the control server, impersonate a legitimate device, and inject malicious code into the web portal. This injected code can steal user session cookies, compromise accounts, expose sensitive information, and grant attackers unauthorized access to the portal. The core issues are the lack of authentication, unencrypted HTTP connections, and missing input validation.

• CVE-2026-39107MEDIUM 6.3

  Kimi AI v1.0 has a cross-site scripting (XSS) vulnerability in its Preview feature. When the AI generates code and displays it in the Preview tab, the application fails to sanitize the output properly. An attacker can embed malicious JavaScript in AI-generated responses, which then executes in a user's browser with the privileges of that session. This could allow theft of session cookies, unauthorized actions on behalf of the user, or credential harvesting.

• CVE-2026-7299MEDIUM 6.3

  Appsmith, a low-code application development platform, contains a stored cross-site scripting (XSS) vulnerability in its SQL query editor. An authenticated developer can craft malicious database object names (table or column names) that, when rendered by the autocomplete feature, inject and execute arbitrary JavaScript in the browsers of other workspace members. This is a *persistence* risk—the malicious payload lives in the database schema itself and activates whenever a colleague accesses the same data source, potentially compromising their sessions and Appsmith workspace access.

• CVE-2019-25731MEDIUM 6.1

  Zuz Music version 2.1 has a flaw that lets anyone send malicious code through the contact form without needing to log in. When site administrators read these messages, the injected code runs in their browsers, potentially allowing attackers to steal session data, modify settings, or trick them into performing unwanted actions. This is a persistent vulnerability, meaning the malicious payload stays stored on the server and affects every admin who views the inbox.

• CVE-2019-25737MEDIUM 6.1

  Live Chat Unlimited version 2.8.3 contains a stored cross-site scripting (XSS) vulnerability in its chat input field. An unauthenticated attacker can inject malicious JavaScript code that persists in the system and executes when administrators access the chat interface. This allows attackers to steal admin session cookies, redirect users to phishing sites, or perform unauthorized actions within the admin dashboard without requiring authentication.

• CVE-2026-10510MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in the GeniexWebView component of Transsion's AI Assistant Lifestyle application for Android. An attacker can craft a malicious URL containing injected JavaScript code in the web_action_data parameter, which the vulnerable WebView will execute with the same privileges as the application. This allows arbitrary JavaScript execution in the context of the app, potentially compromising user data or enabling phishing attacks. The vulnerability affects all versions of the application currently in distribution.

• CVE-2026-11150MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.53 contain a flaw in how the browser processes XML within HTML pages. An attacker can craft a malicious webpage that, when visited, injects arbitrary scripts or HTML content that execute in the context of unrelated sites (a technique known as Universal Cross-Site Scripting or UXSS). This bypasses the same-origin policy that normally prevents one site from accessing data or performing actions on another. The vulnerability requires user interaction—a victim must visit the attacker's page—but does not require any special browser configuration or user privileges to trigger.

• CVE-2026-11186MEDIUM 6.1

  Google Chrome versions prior to 149.0.7827.53 contain a vulnerability in CSS handling that allows attackers to inject malicious scripts or HTML into web pages users visit. An attacker would craft a specially designed webpage that, when opened in a vulnerable version of Chrome, bypasses security boundaries and executes unauthorized code in the context of other websites. This type of attack, known as Universal XSS (UXSS), is particularly dangerous because it affects the browser itself rather than individual websites, potentially compromising user data across multiple domains.

• CVE-2026-11273MEDIUM 6.1

  Google Chrome versions before 149.0.7827.53 contain a vulnerability in the Omnibox (the address/search bar) that fails to properly validate user input. An attacker can craft a malicious HTML page that, when visited by a user who interacts with the Omnibox through specific UI actions, allows injection of arbitrary scripts or HTML content. This is a cross-site scripting variant (UXSS) that bypasses the normal security boundary between web pages. The attack requires user interaction and social engineering to be effective, but once triggered, can compromise the integrity and confidentiality of the browsing session.

• CVE-2026-11603MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the Product Filter Widget for Elementor WordPress plugin through version 1.0.6. An attacker can craft a malicious link and trick a user into clicking it, causing arbitrary JavaScript to execute in the victim's browser within the context of their WordPress site. The vulnerability stems from the plugin's failure to properly sanitize user input in the 'args[filterFormArray]' parameter before displaying it back to the user. No authentication is required to exploit this flaw, and the attack is delivered silently via an admin-ajax.php endpoint without requiring verification that the request is legitimate.

• CVE-2026-1450MEDIUM 6.1

  The rognone WordPress plugin contains a reflected cross-site scripting (XSS) flaw that allows unauthenticated attackers to inject malicious scripts into web pages. The vulnerability exists in how the plugin handles the 'mode' parameter—it fails to properly sanitize user input and escape output, creating an opening for attackers to craft malicious links. If a user clicks such a link while using a site running the vulnerable plugin, the attacker's script executes in their browser with access to session data and sensitive information.

• CVE-2026-1451MEDIUM 6.1

  The rognone plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious JavaScript into pages viewed by unsuspecting users. An attacker could craft a malicious link containing JavaScript in the 'a' parameter and trick a user into clicking it, causing the script to execute in their browser within the context of the WordPress site. This works because the plugin fails to properly sanitize user input or escape output before displaying it. The vulnerability affects versions up to and including 0.6.2.

• CVE-2026-20233MEDIUM 6.1

  Cisco Webex Meetings contained a cross-site scripting (XSS) vulnerability in its web interface that could allow an attacker to inject malicious scripts if a user clicked a crafted link. The vulnerability resulted from weak input validation. Cisco has already patched the service, and users do not need to take action—the fix has been deployed automatically.