By weakness (CWE)

CWE-79: related vulnerabilities

CVEs classified under CWE-79. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

728 published vulnerabilities · page 5 of 8

• CVE-2026-52725MEDIUM 6.1

  Angular's dynamic component creation feature contains a security flaw that allows attackers to bypass script-execution protections. When an Angular application dynamically creates a component, the framework should prevent mounting that component onto dangerous HTML elements like <script> tags. This vulnerability fails to enforce that restriction, meaning an attacker who can control where a component is mounted could force it onto a script tag, causing arbitrary JavaScript code to execute in the user's browser. This is a client-side XSS vulnerability that requires user interaction and control over component placement to exploit.

• CVE-2026-52760MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Apache ActiveMQ's Web Console browse page. An authenticated message producer can craft a JMS message ID containing malicious HTML or JavaScript. When an administrator browses the queue through the Web Console, that payload executes in their browser, potentially allowing the attacker to steal session tokens, modify queue contents, or perform actions as the administrator. The vulnerability requires authentication to trigger but exploits a trust boundary between producer and administrator roles.

• CVE-2026-53737MEDIUM 6.1

  Juicer, a plugin or tool for managing remote feeds, contains a stored cross-site scripting (XSS) vulnerability in versions through 1.12.18. When an administrator visits the plugin's settings page, the plugin fails to properly sanitize data pulled from a connected remote feed before displaying it. An attacker who controls or can manipulate that feed source can inject malicious JavaScript code that will execute in the administrator's browser session. This runs with the privileges of the logged-in admin, potentially allowing the attacker to perform unauthorized actions or steal sensitive information.

• CVE-2026-54265MEDIUM 6.1

  Angular versions prior to 22.0.1, 21.2.17, and 20.3.25 contain a vulnerability in the compiler that allows developers to accidentally create XSS vulnerabilities in their applications. The issue occurs when developers use Angular's two-way binding syntax (a shorthand for linking data both into and out of a component) on sensitive HTML properties like innerHTML or src. Under normal circumstances, Angular automatically cleans these properties to prevent malicious code injection. However, the two-way binding syntax bypasses that automatic cleaning, leaving applications vulnerable if they bind user-controlled data to these properties. An attacker who can influence what data gets bound could inject malicious JavaScript that runs in users' browsers.

• CVE-2026-54267MEDIUM 6.1

  Angular applications using server-side rendering (SSR) with client hydration are vulnerable to a DOM Clobbering attack that could allow attackers to inject or manipulate cached application state. When an Angular app serializes its runtime state (like HTTP responses) into an HTML script tag during SSR, the client-side code retrieves this state by searching for an element with the ID 'ng-state'. If an attacker can control user input or CMS content that sets element IDs before the legitimate script tag loads, they can create a fake 'ng-state' element. When Angular's hydration process looks for this element, it finds the attacker's version instead and attempts to parse its content as application state, potentially leading to information disclosure or application manipulation.

• CVE-2026-54386MEDIUM 6.1

  marimo, a notebook environment for Python, contains a reflected cross-site scripting (XSS) vulnerability in versions before 0.23.9. An attacker can craft a malicious link containing malicious code in the file query parameter. When a user visits this link while accessing their marimo server, the injected JavaScript executes in the user's browser without being blocked by standard security protections. No authentication is required to exploit this vulnerability—any user who clicks a crafted link is at risk. The impact is limited to the attacker's ability to read or modify data visible to the victim within that marimo session, or perform actions on their behalf.

• CVE-2026-55877MEDIUM 6.1

  Symfony UX, a popular JavaScript framework for the Symfony PHP framework, contains a cross-site scripting (XSS) vulnerability in how it renders SVG icons. The ux_icon() Twig function treats icon content as safe HTML without sanitizing it first. This means if an SVG file or icon data from the Iconify service contains malicious code—such as embedded script tags or event handlers—that code will execute in a user's browser. An attacker could exploit this by serving a malicious SVG or by compromising icon sources to run unauthorized JavaScript in the context of the affected application.

• CVE-2026-56263MEDIUM 6.1

  Crawl4AI, a web crawling framework, contains a stored cross-site scripting (XSS) vulnerability in its monitoring dashboard. An attacker can craft a malicious crawl request containing JavaScript code. When a dashboard operator views the crawl results, the malicious code executes in their browser without being sanitized, potentially allowing the attacker to steal session tokens, redirect the operator to phishing sites, or perform actions on their behalf. The vulnerability affects versions prior to 0.8.7.

• CVE-2026-56317MEDIUM 6.1

  Nuxt, a popular Vue.js framework, has a cross-site scripting (XSS) vulnerability in its NoScript component. When developers use the NoScript component to render untrusted data—such as user-supplied query parameters—the framework writes that content directly to the DOM without sanitizing it. An attacker can craft a malicious URL containing JavaScript that executes in the victim's browser when they visit the page, potentially stealing session tokens, modifying page content, or redirecting users to phishing sites.

• CVE-2026-56347MEDIUM 6.1

  AVideo's TopMenu plugin version 26.0 and earlier allows attackers to inject malicious code into menu items that will execute when site visitors view the page. The plugin fails to properly sanitize user-supplied text in menu configurations, enabling stored cross-site scripting attacks. Once injected, the malicious code runs in visitors' browsers, potentially compromising their session security or enabling unauthorized site modifications.

• CVE-2026-56698MEDIUM 6.1

  Nuxt, a popular JavaScript framework, has a security flaw in its navigateTo function that fails to block certain types of links when users can control where they navigate. If an attacker tricks a user into clicking a specially crafted link or can inject malicious input into the navigation destination, the attacker's JavaScript code executes within the legitimate application's security context. This affects Nuxt 4.0.0 through 4.4.6 and all 3.x versions before 3.21.7. The vulnerability requires user interaction and is rated as medium severity because the impact is limited to information disclosure and minor manipulation within the page, though it can affect multiple users if hosted on shared origins.

• CVE-2026-56809MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in Ricoh Web Image Monitor, a web-based management interface found on multiple laser printers and multifunction printers (MFPs). An attacker can craft a malicious URL that, when visited by a printer administrator or authorized user, executes arbitrary JavaScript in their browser. This allows the attacker to perform actions on behalf of the logged-in user, such as modifying printer settings, accessing sensitive information, or pivoting into the network.

• CVE-2026-5793MEDIUM 6.1

  BiEticaret, an e-commerce platform by Inrove Software and Internet Services, contains a reflected cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user clicks a crafted link, the attacker's code executes in the victim's browser within the context of the BiEticaret application, potentially stealing session tokens, redirecting to phishing pages, or performing unauthorized actions on behalf of the user. Versions before 3.3.57 are affected.

• CVE-2026-57958MEDIUM 6.1

  Mixpost, a social media management platform, contains a reflected cross-site scripting (XSS) vulnerability in its OAuth callback handling. An attacker can craft a malicious callback URL with specially crafted error parameters that, when clicked by an authenticated user, executes arbitrary JavaScript in that user's browser. This can lead to session hijacking or unauthorized actions performed on behalf of the victim. The vulnerability affects Mixpost versions through 2.6.0 and requires no authentication to exploit, though the attack depends on tricking a logged-in user into clicking a malicious link.

• CVE-2026-58030MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's SyntaxHighlight_GeSHi extension, which is used to display colored code syntax highlighting on MediaWiki installations. The flaw allows an attacker to inject malicious scripts into web pages viewed by other users. The vulnerability stems from improper sanitization of user input in the SyntaxHighlight.php file before it is rendered in HTML. An attacker would need to trick a user into visiting a malicious wiki page or clicking a crafted link, but once triggered, the injected script executes in the victim's browser within the context of the MediaWiki site. This could allow theft of session cookies, credential harvesting, defacement, or redirection to malicious sites.

• CVE-2026-58032MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in MediaWiki's JavaScript API module that can allow attackers to inject malicious code into web pages viewed by other users. An attacker would need to trick a user into clicking a link or visiting a malicious page, but once executed, the injected script runs in the victim's browser with the permissions of the legitimate MediaWiki site. This could lead to session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.

• CVE-2026-58037MEDIUM 6.1

  MediaWiki contains a cross-site scripting (XSS) vulnerability in multiple logging and language components. An attacker can inject malicious scripts into log entries or language-related output that execute in the browsers of users viewing those pages, potentially stealing session tokens, performing actions on behalf of logged-in users, or redirecting them to malicious sites. User interaction is required—the victim must view a page containing the injected payload—but no special permissions are needed to exploit this flaw.

• CVE-2026-58038MEDIUM 6.1

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's timeline component that allows attackers to inject malicious scripts into web pages. The flaw stems from improper validation of user input during page generation, affecting the Timeline.php file and EasyTimeline.pl script. An attacker can craft a malicious timeline input that, when rendered in a victim's browser, executes arbitrary JavaScript in the context of the wiki site. This requires user interaction—specifically, a victim must view or interact with a page containing the malicious timeline—but does not require authentication to exploit.

• CVE-2026-59710MEDIUM 6.1

  Showdown, a popular markdown-to-HTML converter, contains a stored cross-site scripting (XSS) vulnerability in how it processes table headers. When markdown containing malicious content is rendered using the default GitHub flavor configuration, an attacker can inject arbitrary HTML and JavaScript-executing SVG elements through specially crafted double-quote characters in table header text. Once injected, the malicious code persists in the rendered output and executes in the browsers of anyone viewing the content. This is particularly dangerous in applications that accept user-submitted markdown and display it to other users without sanitization.

• CVE-2026-59711MEDIUM 6.1

  Showdown, a popular markdown-to-HTML converter, has a cross-site scripting (XSS) vulnerability in how it handles metadata titles. When a specific option (completeHTMLDocument) is turned on, the library fails to properly escape special characters in markdown frontmatter metadata before inserting them into HTML title tags. An attacker can craft a markdown document with malicious code in the metadata that, when processed, breaks out of the title context and executes JavaScript in users' browsers. The vulnerability requires user interaction—someone must process the attacker's markdown—but can affect any application using Showdown with this option enabled.

• CVE-2026-59895MEDIUM 6.1

  Hono, a JavaScript framework for building web applications, contains a flaw in its CSS class composition utility (cx() function) that fails to properly sanitize user-supplied class names during server-side rendering. When untrusted input is passed as a class attribute in JSX, an attacker can break out of the attribute context and inject arbitrary HTML markup into the rendered page. This occurs because the function marks its output as safe HTML without actually escaping the input strings. The vulnerability affects Hono versions 4.0.0 through 4.12.26 and has been patched in version 4.12.27.

• CVE-2026-59923MEDIUM 6.1

  Mistune, a widely-used Python library for converting Markdown to HTML, contains a flaw in how it validates links and image URLs. An attacker can craft Markdown that includes specially encoded JavaScript commands disguised in percent-encoded format. When a user renders this malicious Markdown through Mistune versions before 3.3.0, the library fails to block these hidden scripts, allowing them to execute in the browser. This affects any application that accepts user-supplied Markdown and displays the rendered output to other users.

• CVE-2026-59926MEDIUM 6.1

  Mistune, a popular Python library for converting Markdown into HTML, has a vulnerability in how it handles formatting directives. When users include special formatting instructions (called admonitions) in Markdown, the library failed to properly clean certain styling options before adding them to the generated HTML. This oversight allows an attacker to inject malicious code that could compromise website visitors' browsers, even if the site owner thought they had protective settings turned on. The issue affects Mistune versions before 3.2.1.

• CVE-2026-59929MEDIUM 6.1

  Mistune, a popular Python Markdown parser, contains a vulnerability in its URL sanitization logic that fails to block certain legacy and less-common URL schemes. While it successfully blocks javascript:, vbscript:, file:, and data: URLs, attackers can bypass this protection by using alternative schemes like feed:, view-source:, jar:, or others to inject malicious links into rendered HTML. When users click these links or the content is processed by certain browsers, script execution may occur. This affects Mistune versions prior to 3.3.0.

• CVE-2026-60092MEDIUM 6.1

  AVideo's Meet plugin contains a stored cross-site scripting (XSS) vulnerability that allows an unauthenticated attacker to inject malicious JavaScript into the Participants management panel. An attacker can join any public meeting while supplying a crafted User-Agent header containing HTML and JavaScript code. This payload is saved to the database without sanitization and later displayed without encoding when the meeting host or site administrator views the participant list, causing the attacker's code to execute in their authenticated browser session. The vulnerability requires user interaction (opening the Participants panel) but affects a privileged user, making it a serious risk for meeting organizers and administrators.

• CVE-2026-7660MEDIUM 6.1

  The Easy Updates Manager WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability in its pagination feature. Attackers can craft malicious links that inject JavaScript code into pages. When a WordPress administrator clicks such a link, the injected script executes in their browser with their privileges, potentially allowing attackers to steal credentials, modify site content, or perform unauthorized actions. The vulnerability affects versions 9.0.20 and earlier.

• CVE-2026-8059MEDIUM 6.1

  IBM Datacap and IBM Datacap Navigator versions 9.1.7, 9.1.8, and 9.1.9 contain a cross-site scripting (XSS) vulnerability in their Web UI. An unauthenticated attacker can inject malicious JavaScript code that executes in the browser of a legitimate user, potentially stealing credentials or modifying the application's behavior without the user's knowledge.

• CVE-2026-8306MEDIUM 6.1

  A stored cross-site scripting (XSS) vulnerability exists in Armiya Information Technologies' Access Control System (GKS) that allows attackers to inject malicious scripts into the application. Unlike reflected XSS attacks that require tricking a user into clicking a link, this vulnerability persists in the system, meaning any user who views the affected page will execute the attacker's code. The vulnerability requires network access and user interaction but does not demand special privileges to exploit.

• CVE-2026-8310MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in Webbeyaz Web Design's Mediküm Web product. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in the victim's browser within the context of the Mediküm Web application. This allows theft of session cookies, credential harvesting, or malware injection. The vulnerability affects all versions through 08072026. Notably, the vendor has indicated the product is no longer supported, meaning no patches are expected.

• CVE-2026-8403MEDIUM 6.1

  SYSGUARD 6001, a security appliance from Eksagate Electronic Engineering and Computer Industry Trade Inc., contains a stored cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages served by the product. Once injected, these scripts execute in the browsers of users who access the affected pages, potentially stealing credentials, session tokens, or sensitive information. The vulnerability affects versions 2.0.2 through 6.1.3.x; version 6.1.4.0 and later are patched. A critical concern: the vendor has confirmed this product line is no longer supported, meaning no further security updates or vendor assistance should be expected.

• CVE-2026-8622MEDIUM 6.1

  The Image Sizes on Demand WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability affecting all versions through 1.3. An attacker can craft a malicious link that, when clicked by an administrator, executes arbitrary JavaScript in their browser session. The vulnerability stems from improper handling of the PHP_SELF server variable on the plugin's settings page, which fails to sanitize or escape user input. Because execution requires administrator interaction and is limited to admin context, the risk is moderate—but any successful attack grants the attacker the ability to perform administrative actions on the WordPress site.

• CVE-2026-8628MEDIUM 6.1

  The EntreDroppers WordPress plugin contains a reflected cross-site scripting (XSS) vulnerability that allows unauthenticated attackers to inject malicious scripts into web pages. An attacker can craft a malicious URL and trick users into clicking it; when clicked, the injected script executes in the victim's browser within the context of the WordPress site. The flaw exists because the plugin fails to properly sanitize and escape the PHP_SELF variable, which is directly reflected into HTML form attributes without protection. All versions through 1.1.2 are affected.

• CVE-2026-9280MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the Ad Inserter – Ad Manager & AdSense Ads WordPress plugin affecting all versions up to 2.8.15. The flaw allows attackers to inject malicious scripts into web pages by crafting a deceptive link. If a user clicks the link while viewing a page with the plugin's iframe mode enabled, the attacker's script executes in their browser. This attack requires no special permissions and relies on social engineering to succeed.

• CVE-2026-9838MEDIUM 6.1

  A reflected cross-site scripting (XSS) vulnerability exists in the ICS Calendar WordPress plugin affecting all versions up to 12.0.9. An attacker can inject malicious JavaScript by crafting a specially designed link and tricking a user into clicking it. The vulnerable code path is reachable through an unauthenticated AJAX action that fails to properly sanitize user input before displaying it in the page. If successful, the injected script executes in the victim's browser with their privileges, potentially allowing the attacker to steal session cookies, perform actions on their behalf, or redirect them to malicious sites.

• CVE-2026-28116MEDIUM 5.9

  Emilia Projects Progress Planner versions 1.9.0 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows authenticated administrators to inject malicious scripts into the application. When other users view affected pages, the injected code executes in their browsers, potentially enabling session hijacking, credential theft, or further lateral movement within the application environment.

• CVE-2026-31981MEDIUM 5.9

  A stored HTML injection vulnerability in Nozomi Networks CMC and Guardian allows authenticated administrators to inject malicious HTML into configuration data. When other users view the affected data in the Diagram tab or Graph view, the injected HTML renders in their browsers. This can be used to conduct phishing attacks or redirect users to malicious sites. The vulnerability requires administrative access to exploit and user interaction (viewing the affected data) to trigger, limiting its scope but still warranting remediation in environments where admin accounts may be compromised or insider threats are a concern.

• CVE-2026-41846MEDIUM 5.9

  Spring Framework contains a reflected cross-site scripting (XSS) vulnerability in its JSP form tag library. When developers use Spring MVC form tags and bind user-supplied input to the cssClass, cssErrorClass, or cssStyle attributes without proper sanitization, an attacker can inject malicious HTML and JavaScript code. This code executes in the victim's browser when they view the affected page, potentially allowing credential theft, session hijacking, or other client-side attacks. The vulnerability requires user interaction (such as clicking a malicious link) to trigger.

• CVE-2026-56007MEDIUM 5.9

  A stored cross-site scripting (XSS) vulnerability exists in OceanWP's Ocean Product Sharing plugin through version 2.2.2. An attacker with administrative privileges can inject malicious scripts into product sharing features that persist in the database and execute in the browsers of other users who view the affected content. This allows the attacker to steal session tokens, deface pages, or perform actions on behalf of legitimate users.

• CVE-2026-56009MEDIUM 5.9

  Bricksable, a plugin for the Bricks Builder page builder, contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with elevated privileges to inject malicious scripts. These scripts are then executed in the browsers of other users who view the affected pages or content. The vulnerability affects Bricksable versions up to and including 1.6.83.

• CVE-2026-57722MEDIUM 5.9

  ShortPixel's Enable Media Replace plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users with elevated privileges to inject malicious scripts into web pages. Unlike reflected XSS, stored XSS persists in the application, meaning the attack payload remains in the database and executes automatically whenever affected pages are viewed. This affects all versions through 4.2.1. An attacker would need administrative or editor-level access to inject the payload, but once stored, any user—including site visitors—viewing the compromised content could be affected.

• CVE-2026-48821MEDIUM 5.8

  Shaarli, a self-hosted bookmarking application, has a cross-site scripting (XSS) vulnerability in its thumbnail synchronization feature affecting versions 0.16.1 and earlier. When administrators use the thumbnail update tool, the system retrieves bookmark data from the server and displays it on the page without properly cleaning the content first. An attacker who controls bookmark titles can inject malicious scripts that execute when an administrator runs the thumbnail sync. The scripts run with the administrator's permissions, potentially allowing unauthorized access to accounts, elevation of privileges, or installation of persistent backdoors. The vulnerability has been patched in version 0.16.2.

• CVE-2026-48822MEDIUM 5.8

  Shaarli, a personal bookmarking service, contains a stored cross-site scripting (XSS) vulnerability in how it processes bookmark descriptions. An authenticated attacker can craft a specially-formatted bookmark that executes malicious JavaScript in the browsers of other users who view that bookmark. The vulnerability exists because the application's sanitization logic overlooks a specific Markdown syntax variant—reference-style links—allowing dangerous protocols like javascript: to slip through unfiltered. This affects versions 0.16.1 and earlier.

• CVE-2026-25624MEDIUM 5.7

  A cross-site scripting (XSS) vulnerability exists in Arista Next Generation Firewall's administrative dashboard. An attacker with administrative credentials can inject malicious code into web form fields that are then reflected back to other administrators viewing the dashboard, potentially allowing them to steal session tokens, modify firewall rules, or perform other administrative actions on behalf of legitimate users. This is a stored or reflected XSS issue that requires an attacker to have already compromised an admin account or trick an admin into clicking a malicious link.

• CVE-2026-44696MEDIUM 5.7

  OpenProject, a widely-used open-source project management platform, contains a vulnerability in how it sanitizes user-supplied CSS in formatted text fields. Versions prior to 17.4.0 fail to properly restrict CSS properties when users add styling to work package descriptions, comments, project descriptions, and news items. Any authenticated user with write permissions can inject arbitrary CSS, potentially enabling visual deception attacks, credential harvesting through fake login forms overlaid on legitimate content, or other client-side manipulation. The vulnerability requires an attacker to have valid account access and user interaction (clicking or viewing the malicious content), which limits its immediate threat scope but makes it a meaningful risk for organizations where internal users may be adversarial or where guest/contractor accounts have write access.

• CVE-2026-49220MEDIUM 5.7

  Jellyfin, a self-hosted open-source media server, contains a cross-site scripting (XSS) vulnerability that allows unprivileged users to inject malicious JavaScript into an administrative account. An attacker can craft a special Client header value during the authentication process that, when viewed by an admin in the dashboard, executes arbitrary code in that admin's browser session. This could grant the attacker the ability to perform administrative actions, modify system settings, or access sensitive information without explicit authorization. The vulnerability affects Jellyfin versions prior to 10.11.9.

• CVE-2025-5085MEDIUM 5.5

  The WP Nano AD plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions 1.31 and earlier. An authenticated administrator can inject malicious scripts through the 'blogrole_link' parameter that persist in the database and execute in the browsers of users who view affected pages. The vulnerability is limited to WordPress multisite installations or those with the 'unfiltered_html' capability disabled, which narrows its real-world scope but makes it critical for affected deployments.

• CVE-2026-12163MEDIUM 5.5

  Fortra's File Integrity Monitoring (FIM) solution, previously known as Tripwire Enterprise, has a stored cross-site scripting (XSS) vulnerability affecting versions before 9.4.0.1. An authenticated insider with elevated privileges can inject malicious script into configuration fields that later execute in a user's browser when viewing the Asset View UI component. The vulnerability requires both authentication and privilege escalation, limiting immediate risk but posing a real threat in environments where privileged users may be compromised or act maliciously.

• CVE-2018-25384MEDIUM 5.4

  Wikidforum 2.20 has a stored cross-site scripting (XSS) flaw that lets authenticated users inject malicious JavaScript into forum replies. When other users view those compromised posts through the rpc.php endpoint, the injected code executes in their browsers, potentially stealing session cookies, redirecting to phishing pages, or performing unauthorized actions on their behalf.

• CVE-2019-25739MEDIUM 5.4

  GigToDo version 1.3 is vulnerable to a stored cross-site scripting (XSS) attack. An authenticated user can inject malicious JavaScript or HTML code into a proposal description field. When other users—particularly administrators—view that proposal, the attacker's code executes in their browser, potentially stealing session cookies or redirecting them to malicious sites. The vulnerability requires an attacker to already have valid login credentials, but the impact affects anyone who later views the compromised proposal.

• CVE-2019-25742MEDIUM 5.4

  The Zoner Real Estate WordPress theme version 4.1.1 has a stored cross-site scripting (XSS) flaw in its property creation form. Authenticated real estate agents can inject malicious JavaScript into the property's address field, and that script will execute when site administrators review the property for approval. This could allow attackers to steal admin session cookies or hijack their accounts.

• CVE-2019-25743MEDIUM 5.4

  WordPress Soliloquy Lite version 2.5.6 contains a stored cross-site scripting (XSS) vulnerability in its post editing functionality. An authenticated attacker can inject malicious JavaScript code into a post's title field, which persists in the WordPress database. When other users—particularly administrators or editors—preview that post, the injected script executes in their browser, potentially compromising their session or enabling further attacks. The vulnerability requires an attacker to have valid WordPress credentials but does not require tricking users into clicking malicious links, making it a genuine persistence risk in multi-user WordPress environments.

• CVE-2019-25744MEDIUM 5.4

  WordPress Popup Builder version 3.49 contains a stored cross-site scripting (XSS) flaw that allows authenticated users to inject malicious JavaScript into posts or pages. An attacker with WordPress login credentials can craft a specially formatted post title containing script code that breaks out of HTML option tags, causing the malicious script to execute in the browsers of site visitors viewing popup selections. This is a persistence vulnerability—the injected code remains in the database and executes repeatedly.

• CVE-2020-37256MEDIUM 5.4

  Grav, a popular flat-file CMS, contains a cross-site scripting (XSS) flaw in its Admin plugin page editor affecting versions before 1.6.30. An authenticated user with page editing rights can embed malicious scripts into page content. When another user (typically an administrator) views or interacts with that page, the injected script executes in their browser context, potentially allowing the attacker to escalate privileges, modify site content, or install unauthorized plugins that grant deeper system access.

• CVE-2024-30476MEDIUM 5.4

  PowerStore Manager contains a vulnerability that allows authenticated users with low-level permissions to inject malicious scripts into the application. When other users access affected areas, their browsers execute these scripts, potentially allowing the attacker to steal sessions, modify data, or perform actions on their behalf. The attack requires an authenticated account and user interaction to succeed.

• CVE-2025-33128MEDIUM 5.4

  IBM Engineering Workflow Management contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the Web UI. An attacker with valid credentials could craft a payload that executes in the browser of other users viewing the same application, potentially stealing session credentials or performing unauthorized actions on their behalf. The vulnerability requires user interaction (a victim must view the attacker's injected content) but spreads through a trusted application interface, making it a meaningful risk in collaborative engineering environments.

• CVE-2025-36323MEDIUM 5.4

  IBM watsonx.data intelligence versions 5.2.0 through 5.3.0 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the Web UI. An attacker with valid credentials could craft a payload that executes in the browser of other users viewing the application, potentially stealing session credentials or manipulating application behavior within that trusted session. This requires user interaction—the victim must click a malicious link or visit a compromised page—but operates within the security perimeter of an already-authenticated application.

• CVE-2026-10585MEDIUM 5.4

  A vulnerability in GitHub Enterprise Server allows an authenticated user to inject malicious code into discussion titles that executes in other users' browsers. The flaw stems from improper handling of user input in Q&A discussions—specifically, the system failed to sanitize discussion titles before embedding them in structured data markup, creating an opening for attackers to break out of that context and run arbitrary JavaScript. An attacker would need valid credentials and would need to trick another user into viewing the malicious discussion, but the payload could then access that victim's session or sensitive information.

• CVE-2026-10850MEDIUM 5.4

  Plane CE version 1.3.1 contains a stored cross-site scripting (XSS) vulnerability in its API. A user with low-level project membership can inject malicious HTML and JavaScript code into the description field when creating intake work items through the REST API. This code is then stored and executed in the browsers of other users who view that work item, potentially allowing attackers to steal session tokens, redirect users to phishing sites, or perform actions on behalf of victims.

• CVE-2026-11372MEDIUM 5.4

  IBM TRIRIGA Application Platform versions 5.0.2 and 5.0.3 contain a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious JavaScript into the web interface. An attacker with valid credentials can manipulate the application's behavior and potentially steal session credentials from other users. This requires an existing account but does not need user interaction to execute once injected.

• CVE-2026-11569MEDIUM 5.4

  Quay, a container image registry platform, contains a vulnerability in its file upload endpoint that fails to properly validate file types. An authenticated user with write access to a repository can exploit this to upload a malicious SVG file containing embedded JavaScript code. Because the file is stored and then served inline by the CDN without proper content-type restrictions, any user visiting the archive URL will have that JavaScript execute in their browser—a stored cross-site scripting attack. The vulnerability requires an attacker to already have repository write permissions and the victim to click a link, which limits but does not eliminate risk in collaborative development environments.

• CVE-2026-12580MEDIUM 5.4

  EasyFlow .NET, a Digiwin product, contains a vulnerability that lets authenticated users inject malicious JavaScript code into web pages. When other users visit those pages, the injected code runs automatically in their browsers, potentially compromising their sessions, stealing sensitive data, or redirecting them to malicious sites. This is a stored attack—the malicious code persists on the server and affects anyone who views the affected content.

• CVE-2026-12619MEDIUM 5.4

  Microchip GridTime 3000 contains a cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. When another user views the affected page, the injected script executes in their browser within the GridTime 3000 application context, potentially compromising their session, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability requires an authenticated attacker and user interaction (a victim must click a link or visit a crafted page), but can affect users across different security boundaries.

• CVE-2026-12621MEDIUM 5.4

  A cross-site scripting (XSS) vulnerability exists in the password reset form of GridTime 3000. An attacker with valid login credentials can inject malicious JavaScript code that executes in the browser of other users viewing the form, potentially stealing session cookies, credentials, or triggering unauthorized actions. The vulnerability affects versions 1.0r0.03 through 1.1.x, with the fix available in version 1.2r0.0 and later.

• CVE-2026-13977MEDIUM 5.4

  Google Chrome versions before 150.0.7871.47 contain a flaw in how the browser parses HTML that allows attackers to inject malicious scripts or HTML content into web pages. An attacker can craft a specially designed webpage that, when visited, injects arbitrary code into the page—potentially stealing data, capturing user credentials, or performing actions on the user's behalf. The vulnerability requires user interaction (visiting the malicious page) but does not require special browser permissions or system access.

• CVE-2026-24754MEDIUM 5.4

  Kiteworks, a private data network platform used for secure file sharing and collaboration, contains a stored cross-site scripting (XSS) vulnerability in its Secure Data Forms feature. An authenticated user with legitimate access could craft malicious input that persists in the application and executes in other users' browsers when they view the affected form. This allows the attacker to steal session tokens, perform actions on behalf of victims, or harvest sensitive data passing through their sessions. The vulnerability requires prior authentication and user interaction (clicking a link or viewing a page), limiting but not eliminating its risk. Kiteworks versions before 9.3.0 are affected; upgrading resolves the issue.

• CVE-2026-25557MEDIUM 5.4

  Evoluted PHP Directory Listing Script versions up to 4.0.5 contain a reflected cross-site scripting (XSS) vulnerability in the directory parameter handling. When a user visits a specially crafted malicious link, JavaScript code embedded in the directory path gets executed in their browser, potentially allowing attackers to steal session cookies, redirect users to phishing sites, or perform actions on their behalf. The vulnerability requires user interaction—victims must click a malicious link—but no special privileges are needed to exploit it.

• CVE-2026-26378MEDIUM 5.4

  Koha, an open-source library management system, contains a cross-site scripting (XSS) vulnerability in its Invoice feature file upload functionality. An authenticated attacker can craft a malicious file upload that executes arbitrary code in the browsers of users who interact with the uploaded invoice. The vulnerability affects Koha version 25.11 and earlier. Exploitation requires an attacker to have valid library system credentials and user interaction—typically a staff member viewing or processing the invoice.

• CVE-2026-33113MEDIUM 5.4

  Microsoft Office SharePoint contains a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into web pages. When a user visits a compromised SharePoint page, the injected code executes in their browser, potentially allowing the attacker to steal session tokens, redirect users to phishing sites, or perform actions on behalf of the victim. This is a reflected or stored XSS flaw—the vulnerability itself requires user interaction to trigger, but the impact can be significant for organizations relying on SharePoint for document collaboration and intranet services.

• CVE-2026-33244MEDIUM 5.4

  React Router versions 7.5.1 through 7.13.1 contain a cross-site scripting (XSS) vulnerability when used in Framework Mode with pre-rendering. If your application redirects users to untrusted URLs and generates static HTML files during build time, attackers can inject malicious scripts into those pre-rendered pages. This vulnerability does not affect applications using the more common Declarative Mode or Data Mode routing approaches. The issue has been fixed in version 7.13.2.

• CVE-2026-34033MEDIUM 5.4

  Apache Answer contains a cross-site scripting (XSS) vulnerability in its notification email system. When authenticated users include content in certain fields, that content reaches other users' inboxes without proper HTML escaping, potentially allowing injection of malicious scripts. An attacker with valid credentials could craft messages designed to execute code when recipients open their emails or click embedded links. This affects Apache Answer versions through 2.0.0.

• CVE-2026-34692MEDIUM 5.4

  Adobe Experience Manager contains a cross-site scripting (XSS) flaw that allows attackers to inject and execute malicious JavaScript in a user's browser. The attack requires tricking a victim into visiting a specially crafted webpage while authenticated to AEM. Once executed, the attacker can steal session data, modify page content, or perform actions on behalf of the victim within the AEM interface.

• CVE-2026-36162MEDIUM 5.4

  LiquidFiles v4.2.7 contains a vulnerability that allows authenticated users to inject malicious code into file share names. When other users view these crafted shares, the malicious code executes in their browsers, potentially allowing the attacker to steal session data, redirect users, or perform actions on their behalf. The attacker must already have valid credentials to exploit this, and a victim must interact with the poisoned share for the attack to succeed.

• CVE-2026-36163MEDIUM 5.4

  LiquidFiles v4.2.7 contains a stored HTML injection flaw in its file viewing feature. When an authenticated user uploads a crafted HTML file, the application fails to properly sanitize or escape the content before displaying it to other users. This allows an attacker to embed malicious JavaScript that executes in victims' browsers, potentially stealing session tokens, redirecting users, or performing actions on their behalf within the LiquidFiles interface.

• CVE-2026-36728MEDIUM 5.4

  FastapiAdmin version 2.2.0 contains a stored cross-site scripting (XSS) vulnerability in its AI assistant chat feature. An authenticated attacker can inject malicious JavaScript or HTML through a crafted chat message. When other users view the message, the malicious script executes in their browser with access to their session and sensitive data. This requires an attacker with valid login credentials and victim user interaction (viewing the chat), limiting but not eliminating real-world risk.

• CVE-2026-43915MEDIUM 5.4

  Coturn, an open-source TURN/STUN server implementation, contains a stored cross-site scripting (XSS) flaw in its web administration interface. An attacker can inject malicious HTML or JavaScript through a crafted username when creating a TURN allocation. When an authenticated administrator views the session list, the injected code executes in their browser, potentially allowing session hijacking, credential theft, or administrative takeover. The vulnerability is particularly concerning in deployments using anonymous access mode, where no TURN credentials are required for exploitation. Version 4.11.0 and later resolve this issue.

• CVE-2026-44311MEDIUM 5.4

  Fabric.js, a popular JavaScript library for working with HTML5 canvas, contains a Cross-Site Scripting (XSS) vulnerability in versions before 7.4.0. The issue stems from improper handling of user input when converting gradient objects to SVG format. Specifically, when the toSVG() method processes color values in gradient color stops, it fails to escape special characters. If a web application takes the generated SVG string and inserts it into a webpage, an attacker can craft malicious input that executes arbitrary JavaScript in users' browsers. The vulnerability requires user interaction and affects the integrity and confidentiality of the browser session.

• CVE-2026-44727MEDIUM 5.4

  Jupyter Server versions before 2.20 contain a stored cross-site scripting (XSS) vulnerability in the notebook conversion feature. When a user opens a malicious notebook through the web interface, specially crafted HTML content in the notebook can execute arbitrary JavaScript in the browser with access to session cookies and the Jupyter API. An attacker who can get a user to open a prepared notebook—either by hosting it or tricking them into uploading it—can steal credentials, modify notebooks, or execute code on the Jupyter kernel itself. The vulnerability requires user interaction (opening the notebook) and authenticated access to Jupyter, which limits the immediate blast radius but poses significant risk in multi-user or shared research environments.

• CVE-2026-45453MEDIUM 5.4

  CVE-2026-45453 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. When a user visits a compromised page, the attacker's script executes in their browser, enabling spoofing attacks—such as stealing credentials, impersonating legitimate content, or redirecting users to phishing sites. The vulnerability requires user interaction (clicking a malicious link or visiting a crafted URL) but does not require authentication to exploit.

• CVE-2026-45464MEDIUM 5.4

  CVE-2026-45464 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. An attacker can trick users into visiting a crafted SharePoint page, causing their browser to execute the injected code. This enables spoofing attacks where legitimate content or UI elements can be forged to deceive users into divulging credentials, transferring funds, or trusting false information. The vulnerability requires user interaction—a person must click a malicious link or visit a compromised page—but the attacker does not need authentication to craft the attack.

• CVE-2026-45465MEDIUM 5.4

  CVE-2026-45465 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an attacker to inject malicious code into web pages generated by the application. When a user visits a compromised page, the injected script executes in their browser, potentially stealing session tokens, credentials, or performing actions on behalf of the victim. The vulnerability requires user interaction—someone must click a malicious link or visit a booby-trapped SharePoint page—but no special privileges are needed to launch the attack. This is a spoofing risk, meaning attackers could impersonate legitimate SharePoint content or trusted users.

• CVE-2026-45580MEDIUM 5.4

  WWBN AVideo, an open-source video streaming platform, contains a stored cross-site scripting (XSS) vulnerability in its Live plugin. A user with streaming permissions can inject malicious JavaScript into the stream configuration, which then executes in the browsers of anyone—logged-in or anonymous—who views that live stream. The vulnerability persists because user-controlled input (the stream key) is inserted directly into an HTML class attribute without proper sanitization.

• CVE-2026-45778MEDIUM 5.4

  OpenXDMoD, an open-source HPC (High Performance Computing) metrics collection and analysis framework, contains a stored cross-site scripting (XSS) vulnerability in user profiles combined with a password reset abuse vector. An authenticated attacker can inject malicious JavaScript into their profile, then weaponize the password reset feature to send victims a crafted link. When a victim clicks the link, the attacker's payload executes in their browser, enabling credential theft and account hijacking. All versions prior to 11.0.3 are affected.

• CVE-2026-46342MEDIUM 5.4

  Nuxt, a popular Vue.js framework, contains a vulnerability in its island component rendering system that allows attackers to manipulate server responses by crafting malicious requests. The vulnerability exists because the framework computes a security hash client-side but never validates it server-side, meaning an attacker can request the same endpoint with different parameters and receive unintended responses. This could enable attackers to conduct XSS attacks or retrieve sensitive information if islands expose data meant for other users. The issue affects Nuxt 3.1.0 through 3.21.5 and 4.0.0-alpha.1 through 4.4.5, as well as the associated @nuxt/nitro-server package.

• CVE-2026-46546MEDIUM 5.4

  Frappe Learning Management System prior to version 2.53.0 contains a vulnerability where authenticated users can inject malicious code into certain editable fields. When these fields are displayed in page metadata, visiting users' browsers are automatically redirected to attacker-controlled URLs without their knowledge. The vulnerability requires an attacker to have valid user credentials and for a victim to visit a page containing the injected content, but once triggered, it can lead to credential theft, malware distribution, or other social engineering attacks.

• CVE-2026-47106MEDIUM 5.4

  Ellucian Banner Self-Service contains a stored cross-site scripting (XSS) vulnerability in its course search feature. An authenticated user with write access to the Banner ERP system can inject malicious code into faculty names, email addresses, course descriptions, or course titles. When other users later view course meeting times through an unauthenticated API endpoint, that malicious code executes in their browsers without any sanitization, potentially compromising their sessions or stealing sensitive information. The vulnerability affects all versions released before April 23, 2025.

• CVE-2026-47636MEDIUM 5.4

  CVE-2026-47636 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows attackers to inject malicious scripts into web pages. When a user visits a specially crafted SharePoint page, the injected code executes in their browser with their privileges, enabling attackers to impersonate users, steal session data, or perform actions on their behalf. The vulnerability requires user interaction (clicking a link or visiting a page) but does not require authentication to exploit.

• CVE-2026-47639MEDIUM 5.4

  CVE-2026-47639 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an attacker to inject malicious scripts into web pages. When a user visits a compromised page, the attacker's script executes in their browser, potentially stealing credentials, session tokens, or sensitive data, or redirecting users to fraudulent sites. Exploitation requires user interaction—the victim must click a link or visit a crafted page—but no authentication is needed from the attacker's side.

• CVE-2026-47694MEDIUM 5.4

  WWBN AVideo, an open-source video platform, contains a stored cross-site scripting (XSS) vulnerability in how it handles category descriptions. Any user with permission to create or modify video categories can inject malicious JavaScript code into the description field. This code then executes in the browsers of other users who view that category's gallery page. Unlike previously patched XSS issues affecting video titles or comments, this flaw specifically targets the category description rendering pipeline.

• CVE-2026-4772MEDIUM 5.4

  TR7 Cyber Defense Inc.'s WAF-ASP product contains a stored cross-site scripting (XSS) vulnerability that allows authenticated users to inject malicious scripts into web pages. An attacker with login credentials can craft a request that causes the WAF-ASP system to store and later serve malicious JavaScript to other users, potentially compromising their sessions, stealing credentials, or performing actions on their behalf. This is a stored variant of XSS, meaning the attack persists in the system rather than requiring each victim to click a malicious link.

• CVE-2026-47935MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw that allows an attacker to inject malicious JavaScript code into a victim's browser session. The vulnerability affects multiple versions up to 6.5.24, LTS SP1, and 2026.04. An attacker must trick a user into visiting a specially crafted webpage to trigger the exploit, but once executed, the malicious script runs with the victim's privileges and can access or modify sensitive data within the AEM application context across different origin boundaries.

• CVE-2026-47936MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with basic user permissions to embed malicious code into form fields. When other users view those pages, the attacker's JavaScript runs in their browsers. This is particularly concerning because the injected script can affect other domains or applications (indicated by the changed scope), potentially compromising session tokens or sensitive data from multiple contexts.

• CVE-2026-47939MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the injected scripts execute in their browsers. This is a persistence threat—the malicious payload remains in the system until remediated, affecting anyone who accesses the affected content.

• CVE-2026-47941MEDIUM 5.4

  Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier contain a stored cross-site scripting (XSS) flaw in form field handling. A low-privileged user can inject malicious JavaScript that persists in the application and executes in other users' browsers when they view the affected page. This is a persistence problem: the attack code lives in the application, not just in a URL or temporary input. The scope change means the XSS can affect resources beyond the vulnerable component itself.

• CVE-2026-47942MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level user access to embed malicious scripts into form fields. When other users view pages containing these compromised fields, the attacker's JavaScript executes in their browsers. This represents a medium-severity risk because it requires both initial low-privileged access and user interaction, but affects multiple versions of a widely-deployed content management platform.

• CVE-2026-47943MEDIUM 5.4

  Adobe Experience Manager (AEM) contains a stored cross-site scripting vulnerability affecting versions 6.5.24, LTS SP1, 2026.04 and earlier. A user with low-level permissions can inject malicious JavaScript code into form fields, which then executes when other users view the affected page. This is particularly risky because the malicious payload persists in the system rather than being temporary, and it affects the security boundary between different parts of the application (indicated by the scope change in the CVSS vector). The attack requires user interaction—victims must browse to the page containing the injected field—but the damage is real: attackers can steal session tokens, capture credentials, or perform unauthorized actions on behalf of victims.

• CVE-2026-47944MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) vulnerability that allows low-privileged users to inject malicious JavaScript code into form fields. When other users view pages containing these compromised fields, the attacker's scripts execute in their browsers. This is a persistence issue—the malicious payload remains in the system until removed, affecting anyone who accesses the affected content.

• CVE-2026-47945MEDIUM 5.4

  Adobe Experience Manager contains a stored cross-site scripting (XSS) flaw that allows attackers with low-level account access to inject malicious JavaScript into form fields. When legitimate users view pages containing these compromised fields, the malicious script executes in their browsers, potentially compromising their sessions, stealing credentials, or performing unauthorized actions on their behalf. The vulnerability affects multiple versions of AEM through version 2026.04 and earlier LTS releases.

• CVE-2026-47946MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based Cross-Site Scripting vulnerability that allows an attacker to inject malicious JavaScript code into a victim's browser session. The attack requires a logged-in user to visit a specially crafted webpage, at which point the attacker's script executes with the victim's privileges within the AEM application context. This can lead to unauthorized actions, data theft, or session hijacking depending on the victim's role and permissions.

• CVE-2026-47947MEDIUM 5.4

  Adobe Experience Manager contains a DOM-based cross-site scripting (XSS) flaw that allows attackers to inject malicious JavaScript into web pages viewed by authenticated users. The vulnerability affects multiple AEM versions through 6.5.24, LTS SP1, and 2026.04. Successful exploitation requires convincing a user to visit an attacker-controlled or compromised webpage while logged into an affected AEM instance. The attacker's code would then execute with the victim's privileges, potentially stealing session data, modifying content, or performing actions on their behalf.

• CVE-2026-47948MEDIUM 5.4

  Adobe Experience Manager versions up to 6.5.24, LTS SP1, and 2026.04 contain a stored cross-site scripting (XSS) flaw that allows attackers with low-level account access to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's scripts execute in their browsers, potentially allowing credential theft, session hijacking, or other client-side attacks. The vulnerability requires user interaction (viewing the affected page) and a valid login, but can impact users across different security contexts.