By weakness (CWE)

CWE-79: related vulnerabilities

CVEs classified under CWE-79. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

728 published vulnerabilities · page 7 of 8

• CVE-2026-13377MEDIUM 4.8

  WatchGuard Fireware OS contains a stored cross-site scripting (XSS) vulnerability in its SIP Proxy module that allows authenticated attackers with high privileges to inject malicious scripts into web pages. When other users access the affected page, the injected script executes in their browser, potentially compromising their session or stealing sensitive information. This is a follow-on attack vector for an earlier vulnerability (CVE-2025-6947) that was not fully mitigated. The vulnerability affects a broad range of WatchGuard Firebox appliances and FireboxCloud deployments.

• CVE-2026-22674MEDIUM 4.8

  Hashgraph Guardian versions up to 3.6.0 contain a stored cross-site scripting (XSS) flaw in the branding configuration feature. An authenticated user with the STANDARD_REGISTRY role can inject malicious JavaScript by submitting a specially crafted company name through the branding API. This injected script executes automatically in every authenticated user's browser on each page load, potentially allowing the attacker to steal session tokens, perform unauthorized actions, or redirect users to malicious sites.

• CVE-2026-25558MEDIUM 4.8

  QloApps versions up to 1.7.0 contain a stored cross-site scripting (XSS) vulnerability in the admin file manager. An authenticated administrator can upload a specially crafted SVG file containing malicious JavaScript code. When any user subsequently views or accesses that file, the embedded script executes in their browser, potentially compromising their session or stealing sensitive information. The vulnerability requires administrator-level access to exploit but poses a persistent risk once injected.

• CVE-2026-34127MEDIUM 4.8

  A stored cross-site scripting (XSS) vulnerability exists in TP-Link's TL-SG108PE v5 managed switch web interface. When an administrator imports a configuration file containing malicious code in the SYSNAM parameter, that code is stored without proper sanitization. The next time an administrator accesses the web management interface, the injected script executes in their browser. This could allow an attacker (who must already have administrator credentials) to steal session cookies, modify switch settings, or extract sensitive information from the management interface.

• CVE-2026-34694MEDIUM 4.8

  Adobe Experience Manager Forms JEE contains a stored cross-site scripting (XSS) vulnerability in form fields that allows a high-privileged attacker to inject malicious JavaScript code. When other users visit a page containing the compromised form field, the malicious script executes in their browser, potentially compromising their session, credentials, or sensitive data. The vulnerability affects versions LTS SP1, 6.5.24.0 and earlier.

• CVE-2026-36460MEDIUM 4.8

  Dovestones Software's ADPhonebook application before version 4.0.1.1 contains a Cross-Site Scripting (XSS) vulnerability in its administrative configuration API. An authenticated administrator can inject malicious JavaScript code into various system configuration sections, which is then stored and executed in the browsers of other users who access those settings. This requires both admin privileges and user interaction (a victim must view the affected configuration), limiting but not eliminating the risk.

• CVE-2026-40986MEDIUM 4.8

  Spring Web Flow contains a flaw in how it handles error responses from the JavaScript RemotingHandler. When an error occurs, the framework renders the response body as HTML regardless of the actual content type, which can allow an attacker to inject malicious scripts into the browser. An attacker could craft a request that triggers an error response containing attacker-controlled input (such as a parameter value), and if that input is reflected in the error details without proper sanitization, it executes as JavaScript in the victim's browser. This requires the victim to be logged in and click on a malicious link, making it a moderate-risk vulnerability.

• CVE-2026-47933MEDIUM 4.8

  Adobe ColdFusion versions 2023.19, 2025.8 and earlier contain a stored cross-site scripting (XSS) vulnerability that allows low-privileged attackers to inject malicious JavaScript into form fields. When other users view pages containing these compromised fields, the attacker's script executes in their browsers. This is a persistence mechanism rather than a one-time attack—the malicious code remains embedded in the application until remediated.

• CVE-2026-48823MEDIUM 4.8

  Shaarli, a self-hosted bookmarking application, contains a stored cross-site scripting (XSS) flaw in how it handles user-supplied tags. An authenticated attacker can embed malicious JavaScript into a bookmark's tags field. When other users search by tag on the homepage, the attacker's code executes in their browser. This affects anyone using the tag filtering feature, including administrators. The issue is fixed in version 0.16.2.

• CVE-2026-55890MEDIUM 4.8

  Grav, a file-based web content platform, contains a stored cross-site scripting (XSS) vulnerability in how it handles Markdown image styling. An authenticated editor can inject malicious code through image style parameters in Markdown that will execute in the browsers of users viewing the rendered content. This vulnerability exists because a previous XSS fix (CVE-2026-42841) was incomplete and left another code path unprotected. The vulnerability requires editor-level permissions to exploit and is fixed in version 2.0.0-rc.9.

• CVE-2026-56381MEDIUM 4.8

  Craft CMS versions from 5.0.0-RC1 onward contain a stored cross-site scripting (XSS) vulnerability in the User Permissions page. An administrator can inject malicious JavaScript code into user group names, which then executes whenever other users access or modify permission settings. This is a privilege-based attack where an already-compromised or malicious admin account can harm other users through their browser.

• CVE-2026-56383MEDIUM 4.8

  Craft CMS has a stored cross-site scripting (XSS) flaw in its editable table component when using row heading column types. An administrator with change permissions can inject malicious JavaScript into row heading default values. This code then runs automatically when other users view pages containing that table field, potentially compromising their accounts or stealing sensitive data. The vulnerability affects Craft CMS versions 4.5.0-beta.1 through 4.16.18 and 5.0.0-RC1 through 5.8.22.

• CVE-2026-56393MEDIUM 4.8

  Craft CMS administrators can inject malicious JavaScript code into configuration fields—such as section names, volume names, or checkbox labels—that will execute when other administrators view those settings in the control panel. This happens because Craft renders these fields without removing potentially harmful code. An attacker with admin privileges and the ability to modify admin settings could weaponize this to steal session tokens or perform unauthorized actions on behalf of other users.

• CVE-2026-58034MEDIUM 4.8

  A cross-site scripting (XSS) vulnerability exists in Wikimedia Foundation's CheckUser extension for MediaWiki. The flaw is located in a Vue component responsible for blocking connected temporary accounts. An authenticated administrator with high privileges can craft malicious input that executes unintended JavaScript in the browsers of other users viewing the affected page, potentially leading to session hijacking or credential theft.

• CVE-2026-58035MEDIUM 4.8

  MediaWiki contains a cross-site scripting (XSS) vulnerability in its Special:Block page interface that allows an authenticated user with administrative privileges to inject malicious scripts. When a victim visits the affected page after the attacker has crafted a malicious block, the injected code executes in the victim's browser in the context of the wiki. This is a reflected or stored XSS issue depending on how the input flows through the Special Block feature, and it requires both high-privilege attacker account and user interaction to successfully exploit.

• CVE-2026-58657MEDIUM 4.8

  Grav, a flat-file CMS platform, contains a stored CSS injection flaw in its Markdown image resize feature. A content editor with page-editing privileges can embed malicious CSS into image resize parameters that will execute in the browser of any administrator or reviewer who views the crafted page. Unlike traditional injections, this attack doesn't require JavaScript—it abuses CSS properties to manipulate the visual layout or create overlay attacks that could deceive users into performing unintended actions.

• CVE-2026-6371MEDIUM 4.8

  Limatek System Inc.'s LimRAD NAC product contains a stored cross-site scripting (XSS) vulnerability that allows an authenticated attacker with limited network access to inject malicious scripts into the web interface. These scripts persist in the system and execute in the browsers of other users who view affected pages, potentially compromising session integrity and enabling unauthorized actions within the NAC application.

• CVE-2026-8078MEDIUM 4.8

  Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases contain a stored cross-site scripting (XSS) vulnerability in the global settings change log. An administrator with permission to modify global settings can inject malicious HTML or JavaScript into changelog messages. When other users view the Activate Changes page or Audit log, this malicious code executes in their browsers, potentially compromising their sessions or stealing information.

• CVE-2026-8661MEDIUM 4.8

  A flaw in Rapid7 InsightConnect's Markdown Plugin allows attackers to trick the system into making unwanted outbound web requests when processing user-supplied Markdown content. The vulnerability exists in the markdown_to_pdf action and stems from incomplete sanitization of HTML elements like images and stylesheets that can load external resources. An attacker can embed specially crafted Markdown with image tags or CSS imports pointing to internal or external targets, causing the affected server to fetch those resources on the attacker's behalf. Versions prior to 4.0.2 are vulnerable; an initial patch in 4.0.0 addressed JavaScript execution but overlooked resource-loading vectors.

• CVE-2026-9549MEDIUM 4.8

  Checkmk versions before 2.5.0p5, 2.4.0p31, 2.3.0p48, and all 2.2.0 releases contain a stored cross-site scripting vulnerability in the service discovery active check output feature. An administrator with the ability to configure active or custom checks can inject malicious HTML or JavaScript that will execute in the browsers of other administrators or users with host read permissions when they view or run checks on the service discovery page. The attack is persistent—the injected code remains in the system until removed.

• CVE-2026-12463MEDIUM 4.7

  Google Chrome on Linux contains a flaw in how it handles Views that allows an attacker who has already compromised Chrome's rendering engine to inject malicious scripts or HTML content into web pages. This is a secondary attack—the attacker must first gain control of the renderer process before exploiting this vulnerability. The flaw affects Chrome versions prior to 149.0.7827.155 on Linux systems.

• CVE-2026-2827MEDIUM 4.7

  The Open User Map PRO WordPress plugin contains a security flaw that allows attackers to inject malicious scripts into website pages. An unauthenticated attacker can exploit insufficient input validation in the 'oum_location_notification' parameter to store harmful code that executes whenever site visitors view an affected page. This stored cross-site scripting (XSS) vulnerability affects all versions up to and including 1.4.31.

• CVE-2026-44587MEDIUM 4.7

  CarrierWave, a popular Ruby file-upload framework, contains a flaw in its content-type blocking mechanism that silently fails to prevent dangerous uploads. When developers configure a denylist to block file types—most commonly SVG files to prevent stored cross-site scripting (XSS)—the framework inadvertently allows those exact files through due to improper handling of special characters in the filter rules. An attacker can exploit this to upload malicious SVG files containing embedded JavaScript that executes in users' browsers when served by the application, resulting in account compromise or data theft.

• CVE-2026-44757MEDIUM 4.7

  SAP Wily Introscope Enterprise Manager contains a cross-site scripting (XSS) vulnerability that allows an attacker to inject malicious code into a specially crafted URL. When a legitimate user visits that URL, the attacker's script runs in their browser under the application's security context. This could expose sensitive session data or allow the attacker to perform actions on behalf of the victim. The vulnerability requires the attacker to trick a user into clicking a link, and carries a CVSS 4.7 (Medium) severity rating.

• CVE-2026-11443MEDIUM 4.6

  Allegra contains a cross-site scripting (XSS) vulnerability in its downloadAttachment method that allows attackers to inject malicious scripts. An authenticated user must be tricked into visiting a malicious page or opening a malicious file to trigger the attack. Once executed, the injected script runs with the privileges of the logged-in user, potentially allowing access to sensitive information or account compromise.

• CVE-2026-34096MEDIUM 4.6

  CVE-2026-34096 is a reflected cross-site scripting (XSS) vulnerability in Guardian's language-system component. The flaw exists in the designer.php file, where user-supplied input via the 'name' GET parameter is inserted directly into an HTML input field without proper sanitization. An authenticated user can exploit this by crafting a malicious URL containing script tags; when a victim visits that URL, the injected script executes in their browser within the security context of their authenticated session. This allows an attacker to steal session tokens, modify page content, or perform actions on behalf of the victim.

• CVE-2026-34097MEDIUM 4.6

  Guardian language-system contains a cross-site scripting (XSS) vulnerability in its text_file.php component where user-controlled input is not properly validated before being placed into HTML form attributes. An authenticated user can manipulate the 'id' parameter to inject malicious scripts that execute within another user's browser session, potentially compromising their account or session data.

• CVE-2026-34098MEDIUM 4.6

  CVE-2026-34098 is a stored cross-site scripting (XSS) vulnerability in Guardian language-system's media.php file. An authenticated user can inject malicious script code through the 'id' GET parameter, which gets embedded directly into the HTML page without proper sanitization. When another user visits the crafted URL, the injected script executes in their browser with their session privileges. This requires an attacker to already have login credentials and victim interaction (clicking a malicious link), limiting the attack surface but posing a real risk in multi-user environments.

• CVE-2026-45106MEDIUM 4.6

  Weblate, a collaborative localization and translation platform, contains a stored cross-site scripting (XSS) vulnerability in its live search preview feature. Before version 2026.5, the tool failed to sanitize HTML and CSS content entered into source fields and context fields by contributors. When another user performs a search that matches this malicious content, the unescaped HTML and CSS executes in their browser within the authenticated Weblate editor environment. Any authenticated user can inject this payload, making it a contributor-level threat that persists and affects all users who trigger the matching search.

• CVE-2026-45462MEDIUM 4.6

  CVE-2026-45462 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authorized user to inject malicious scripts into web pages. When other users view the affected page, the script executes in their browser, potentially allowing the attacker to steal session data, redirect users, or impersonate trusted content. The vulnerability requires an authenticated attacker and user interaction (such as clicking a link), limiting its blast radius but making it a meaningful concern for organizations where SharePoint access is broadly distributed.

• CVE-2026-45467MEDIUM 4.6

  CVE-2026-45467 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint that allows an authenticated user to inject malicious scripts into web pages. When another user views the compromised page, the script executes in their browser, potentially allowing the attacker to steal credentials, manipulate content they see, or impersonate the attacker. The vulnerability requires an authorized SharePoint user to set it up and a victim to click or view the malicious content, limiting its reach but making it effective in insider threat scenarios.

• CVE-2026-45468MEDIUM 4.6

  CVE-2026-45468 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated user to inject malicious scripts into web pages. When a victim views the compromised page, the attacker can steal sensitive information or impersonate the victim within SharePoint. The vulnerability requires an authorized account to exploit and user interaction to trigger, making it moderate in severity but still a genuine risk in environments where SharePoint users have elevated privileges or access to sensitive data.

• CVE-2026-45479MEDIUM 4.6

  CVE-2026-45479 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious code into web pages. When a user views the compromised page, the attacker can steal session credentials, redirect users to phishing sites, or perform actions on behalf of the victim. The attack requires both valid SharePoint credentials and user interaction (clicking a malicious link or visiting a crafted page), which moderates its overall risk.

• CVE-2026-45483MEDIUM 4.6

  Microsoft Office Project Server contains a cross-site scripting (XSS) vulnerability that allows an authenticated user to inject malicious code into web pages viewed by others. An attacker would need valid login credentials and would require a victim to interact with a crafted link or page element. The injected code runs in the victim's browser in the context of Project Server, enabling spoofing attacks such as credential theft or unauthorized actions on behalf of the user. This is a moderate-severity issue that primarily affects organizations where Project Server access is restricted to authenticated users.

• CVE-2026-46609MEDIUM 4.6

  Umbraco CMS versions 14.0.0 through 17.3.x contain a stored cross-site scripting (XSS) vulnerability in a confirmation dialog. Authenticated users can inject malicious HTML into an input field that gets rendered without proper encoding, allowing attackers to execute arbitrary JavaScript in the context of other users' browsers. This requires an attacker to have valid credentials and typically requires user interaction to trigger the payload.

• CVE-2026-47637MEDIUM 4.6

  CVE-2026-47637 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious script into web pages. When a user views a compromised page, the attacker can steal session tokens, redirect users to phishing sites, or perform actions on behalf of the victim. The attack requires an authorized attacker and user interaction (clicking a link or viewing content), limiting its immediate blast radius but still representing a meaningful risk in collaborative environments where SharePoint is heavily used.

• CVE-2026-47638MEDIUM 4.6

  CVE-2026-47638 is a cross-site scripting (XSS) vulnerability in Microsoft Office SharePoint that allows an authenticated attacker to inject malicious scripts into web pages. When a user views the compromised page, the attacker's script executes in their browser, enabling spoofing attacks—such as phishing, credential theft, or session hijacking—while appearing to come from a trusted SharePoint instance. The vulnerability requires user interaction and existing authentication, limiting but not eliminating the risk in organizations with many SharePoint users.

• CVE-2026-47640MEDIUM 4.6

  Microsoft Office SharePoint contains a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts into web pages. When a user with appropriate permissions views a compromised page, the injected script executes in their browser, potentially allowing the attacker to steal session tokens, modify page content, or redirect users to malicious sites. This is a reflected or stored XSS flaw depending on how SharePoint processes and stores the unfiltered input.

• CVE-2026-4770MEDIUM 4.6

  A DOM-based cross-site scripting (XSS) vulnerability exists in TR7 Cyber Defense Inc.'s Web Application Firewall that allows an authenticated attacker to inject malicious scripts into the application. The vulnerability arises from improper sanitization of user input during web page generation. An attacker with valid credentials can craft a malicious link or payload that, when clicked by another user, executes arbitrary JavaScript in their browser context. This affects WAF versions from 1.0.42.239 up to (but not including) 1.4.0.117.

• CVE-2026-48562MEDIUM 4.6

  CVE-2026-48562 is a cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server that allows an authorized user to inject malicious code into web pages. When other users view the compromised page, the attacker's code executes in their browser, enabling spoofing attacks—impersonation or manipulation of content that appears to come from legitimate sources. This requires an attacker already have valid SharePoint credentials and the victim must interact with the malicious content, but once those conditions are met, the attack is straightforward to execute.

• CVE-2026-61456MEDIUM 4.6

  The Grav API plugin before version 1.0.3 contains a stored cross-site scripting (XSS) vulnerability in its media upload handler. An authenticated user with API media write permissions can upload an SVG file containing malicious JavaScript. Because the plugin fails to sanitize SVG content and serves the file with an image MIME type, opening the file in a browser causes the embedded script to execute in the administrator's session context. This allows attackers to steal session cookies or hijack admin sessions without requiring any additional user interaction beyond the attacker uploading the payload.

• CVE-2026-10100MEDIUM 4.4

  The Simple Custom Login Page plugin for WordPress contains a security flaw that allows administrators to inadvertently inject malicious code into the login page viewed by all users. When a site admin configures colors for the login page through the plugin's settings, an attacker with admin access can craft CSS injection payloads in those color fields. Because the plugin doesn't properly validate these inputs before displaying them, an attacker can break out of the intended styling context and insert arbitrary CSS rules. This enables phishing attacks—for example, by hiding the real login form or overlaying a fake one to steal credentials.

• CVE-2026-10104MEDIUM 4.4

  The Product Video Gallery for WordPress plugin contains a stored cross-site scripting (XSS) vulnerability that allows authenticated shop managers and higher-privilege users to inject malicious scripts into gallery pages. When other users visit these compromised pages, the injected scripts execute in their browsers. This vulnerability affects all versions up to and including 1.5.1.8 and results from the plugin's failure to properly sanitize and escape user input in the custom_thumbnail parameter.

• CVE-2026-11356MEDIUM 4.4

  The Ivory Search WordPress plugin contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 5.5.15. An administrator with the highest access level can inject malicious code into two plugin settings—menu_title and menu_magnifier_color—that will then execute in the browsers of any user who visits an affected page. This is a persistence risk: the malicious script lives in the database and runs every time someone views the compromised page.

• CVE-2026-11358MEDIUM 4.4

  The Orbit Fox WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in its admin settings panel. An authenticated administrator can inject malicious JavaScript that persists in the database and executes for any user viewing affected pages. The vulnerability exists only in multi-site WordPress installations or single-site setups where the unfiltered_html capability has been disabled—a common hardening practice. Versions up to and including 3.0.6 are affected.

• CVE-2026-12041MEDIUM 4.4

  The Chatra Live Chat plugin for WordPress contains a security flaw that allows administrators to inadvertently inject malicious scripts into the site through the plugin's settings panel. When an administrator (or anyone with equivalent permissions) saves settings in the plugin, those settings are not properly validated or cleaned, meaning an attacker with admin access could craft a malicious payload that runs in visitors' browsers. This risk is limited to WordPress multisite networks or sites where the 'unfiltered_html' capability has been restricted—standard single-site WordPress installations with unfiltered_html enabled are not affected.

• CVE-2026-12108MEDIUM 4.4

  The Highlighting Code Block plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 2.2.0. An authenticated administrator can inject malicious scripts through the plugin's settings that will execute for any user viewing affected pages. This vulnerability only manifests in WordPress multisite installations or where the unfiltered_html capability has been restricted, which are common hardening configurations.

• CVE-2026-12114MEDIUM 4.4

  A vulnerability in the Team Members – Multi Language Supported Team Plugin for WordPress allows authenticated administrators to inject malicious scripts into plugin settings. When other users visit pages containing these injected scripts, the malicious code executes in their browsers. This is a stored attack—the payload persists in the plugin's configuration. The vulnerability only manifests on WordPress multisite installations or where the unfiltered_html capability has been intentionally restricted, which are less common configurations. An attacker would need full administrator privileges to exploit it.

• CVE-2026-12399MEDIUM 4.4

  The Gutenverse WordPress plugin—a page builder and site editor tool—contains a stored cross-site scripting (XSS) vulnerability in its admin settings. An editor or administrator with site access could inject malicious code that persists in the WordPress database. When other users visit affected pages, that injected code executes in their browsers. The vulnerability only manifests in WordPress multisite networks or installations where the unfiltered_html capability has been disabled, making it a targeted but real risk for certain WordPress configurations.

• CVE-2026-12430MEDIUM 4.4

  Blocksy Companion, a popular WordPress plugin, contains a stored cross-site scripting (XSS) vulnerability affecting all versions through 2.1.45. Authenticated users with editor-level permissions or higher can inject malicious scripts into the plugin's admin settings that will execute for anyone viewing the affected pages. This vulnerability only manifests in WordPress multisite installations or single-site setups where the unfiltered_html capability has been disabled—a common hardening practice. The threat is limited to authenticated attackers but can lead to session hijacking, credential theft, or site defacement.

• CVE-2026-12560MEDIUM 4.4

  The Editorial Rating plugin for WordPress contains a cross-site scripting (XSS) vulnerability that allows administrators to inject malicious scripts through the 'Link URL' field. These scripts execute when anyone visits the affected page, potentially compromising site visitors. The vulnerability affects all plugin versions up to 4.0.5 and requires admin-level access to exploit, limiting its immediate blast radius but presenting a significant insider threat risk.

• CVE-2026-15283MEDIUM 4.4

  WPvivid Backup for MainWP, a WordPress plugin used for backup management in multi-site setups, contains a stored cross-site scripting (XSS) flaw in its admin settings panel. An authenticated administrator can inject malicious scripts that persist in the database and execute in the browsers of other users who access the affected pages. The vulnerability is limited to WordPress multi-site installations or sites where the 'unfiltered_html' capability has been explicitly disabled—standard single-site WordPress installations with default settings are not at risk.

• CVE-2026-47733MEDIUM 4.4

  Rocket.Chat versions before 8.5.0 contain a flaw in how the ImageElement component processes user-supplied image URLs in markdown content. When rendering image links, the component fails to filter dangerous protocol prefixes like javascript: and data:, allowing an authenticated attacker to craft a malicious markdown image that executes arbitrary JavaScript when clicked by another user. The vulnerability requires user interaction (clicking the link) and works primarily on older browsers, but poses a real risk in environments where users share untrusted markdown content or where attackers have internal access.

• CVE-2026-7421MEDIUM 4.4

  A WordPress plugin called Passeum Ticketing contains a vulnerability that allows site administrators to inadvertently (or maliciously in compromised accounts) inject malicious scripts into a website. The plugin fails to properly validate the shop name setting, allowing an attacker with admin access to point the site to a malicious domain. When this happens, the plugin loads JavaScript and CSS files from that attacker-controlled domain, which then executes on every page of the website for all visitors. This is a stored cross-site scripting (XSS) vulnerability specific to multisite WordPress installations.

• CVE-2026-7430MEDIUM 4.4

  The Post Snippets plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting all versions up to 4.0.19. An authenticated administrator can inject malicious code through the plugin's import feature. When that code is imported, it gets embedded unsafely into the post editor's JavaScript, allowing the attacker to execute arbitrary scripts that run whenever any administrator opens a post editor page. This is a privilege-escalation and persistence risk: an attacker with admin access can compromise the experience of other admins and potentially maintain control across sessions.

• CVE-2026-8853MEDIUM 4.4

  MW WP Form, a WordPress plugin used for form management, contains a stored cross-site scripting (XSS) flaw in how it handles memo field data. An attacker with editor-level WordPress access or higher can inject malicious scripts into memo fields that will execute in the browsers of anyone viewing affected pages. The vulnerability exists because the plugin stores memo data directly without properly cleaning or escaping it, and uses a database storage method that bypasses WordPress's built-in security filters.

• CVE-2026-8991MEDIUM 4.4

  A WordPress plugin called 'Drag and Drop Multiple File Upload for Contact Form 7' contains a stored cross-site scripting (XSS) vulnerability in versions up to 1.3.9.7. An attacker with administrator access can inject malicious scripts into the plugin's settings, which will then execute in the browsers of any user who views the affected pages. This is a privilege-escalation risk that exploits insufficient input validation on two specific settings fields.

• CVE-2026-9594MEDIUM 4.4

  The WP Maps plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability affecting versions up to 4.9.4. An attacker with administrator access or a custom role granted the wpgmp_manage_location capability can inject malicious scripts into location messages. These scripts execute whenever site visitors access pages containing the injected content, potentially compromising user sessions, stealing credentials, or redirecting visitors to malicious sites. The vulnerability requires authenticated access and administrative privileges, limiting its immediate risk but making it a concern for organizations with admin account security gaps or custom role configurations.

• CVE-2026-10153MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been identified in westboy CicadasCMS. The flaw exists in the Search function and can be exploited by manipulating a specific argument to inject malicious scripts. An attacker can send a crafted request to a vulnerable instance to execute arbitrary JavaScript in the context of other users' browsers, potentially stealing session data, credentials, or performing actions on their behalf. Exploitation requires user interaction (such as clicking a malicious link) but does not require authentication. A proof-of-concept has already been published, increasing practical risk.

• CVE-2026-10173MEDIUM 4.3

  Orthanc Explorer 2 versions up to 1.12.0 contain a reflected cross-site scripting (XSS) vulnerability in the StudyList component. An attacker can craft a malicious URL with a specially crafted 'remote-source' parameter that, when visited by a user, executes arbitrary JavaScript in their browser within the context of the Orthanc application. This allows theft of session tokens, modification of data, or unauthorized actions performed on behalf of the victim. The vulnerability requires user interaction—a victim must click a malicious link—but can be exploited remotely without authentication.

• CVE-2026-10289MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in Hotel and Tourism Reservation System version 1.0. An attacker can inject malicious scripts by manipulating parameters in the reservation form—specifically the name, email, people count, or booking number fields in the /ht/tour.php file. When a victim visits a crafted link or page, the injected script executes in their browser, potentially allowing session hijacking, credential theft, or defacement. Public exploits are available, increasing active exploitation risk.

• CVE-2026-10301MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0. An attacker can craft a malicious URL containing JavaScript code in the 'page' parameter of index.php. When a user visits this link, the script executes in their browser, potentially allowing theft of session cookies, credential capture, or malware redirection. The vulnerability requires user interaction (clicking a link) but poses a meaningful risk to organizations running this system, especially those handling sensitive fee or financial data.

• CVE-2026-10810MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Fees Management System version 1.0 and earlier. The flaw is located in the /navbar.php file, where unsanitized input in the 'page' parameter allows an attacker to inject malicious scripts. An attacker can craft a malicious URL and trick a user into clicking it, causing the injected script to execute in the victim's browser. This could lead to session hijacking, credential theft, or malware distribution. Public exploit code is available, increasing the risk of opportunistic attacks.

• CVE-2026-11337MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in tittuvarghese CollegeManagementSystem affecting the fetch.php endpoint. An attacker can inject malicious scripts through the department_name parameter, which are then executed in a victim's browser when they interact with a crafted link. The attack requires user interaction but no authentication, making it a practical threat in educational environments where students and staff may click on shared links. Public exploit code is available, increasing the likelihood of opportunistic attacks.

• CVE-2026-11436MEDIUM 4.3

  Mage AI versions up to 0.9.79 contain a reflected cross-site scripting (XSS) vulnerability in the sign-in flow. An attacker can craft a malicious URL with a manipulated redirect parameter that, when clicked by a user, executes JavaScript in the victim's browser within the context of the Mage AI application. The vulnerability requires user interaction—someone must click the malicious link—but no authentication is needed to trigger it. Public exploit details are now available.

• CVE-2026-11512MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability has been discovered in itsourcecode Hospital Management System version 1.0. The flaw exists in the billing module (/billing.php) and can be triggered by manipulating the patientid parameter. An attacker can craft a malicious link or form that, when clicked by a hospital staff member or administrator, injects arbitrary JavaScript into their browser session. This could allow the attacker to steal session credentials, modify billing records, or perform unauthorized actions on behalf of the logged-in user. The vulnerability requires user interaction (a victim must click a malicious link) but needs no authentication to set up the attack. Public exploit details are available, increasing real-world risk.

• CVE-2026-11518MEDIUM 4.3

  SourceCodester Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in its user management functionality. An attacker can inject malicious code through the fullname or username fields in the /users.php file, which is then reflected back to users viewing that data. While the vulnerability requires user interaction (such as clicking a malicious link), it could be exploited remotely to steal session cookies, redirect users, or perform actions on their behalf within the application.

• CVE-2026-12176MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in SourceCodester CET Automated Grading System with AI Predictive Analytics version 1.0. An attacker can inject malicious JavaScript through the 'action' parameter in /index.php, which executes in a victim's browser when they visit a crafted link. The vulnerability requires user interaction (clicking a link) but can be exploited remotely without authentication. Public exploit details are available, increasing the practical risk of opportunistic attacks.

• CVE-2026-12811MEDIUM 4.3

  Kortix-AI's Suna application (versions up to 0.8.38) contains a cross-site scripting (XSS) vulnerability in its authentication page. An attacker can manipulate the returnURL parameter to inject malicious code that executes in a user's browser when they visit a crafted link. The vulnerability requires user interaction—someone must click a malicious link—but carries no authentication barrier. Public exploit code exists. Upgrading to version 0.8.39 eliminates the risk.

• CVE-2026-13499MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability exists in the yashpokharna2555 restaurant-management-system, specifically in the registration handler component. An attacker can inject malicious code through the Username field in login_register.php. When a user visits a crafted link, the injected script executes in their browser, allowing the attacker to steal session cookies, redirect users, or perform actions on their behalf. The vulnerability requires user interaction (clicking a malicious link) but can be exploited remotely without authentication.

• CVE-2026-13536MEDIUM 4.3

  GotoHTTP versions up to 10.2 contain a cross-site scripting (XSS) vulnerability in the /reg.12x file endpoint. An attacker can inject malicious code through the 'sn' parameter, which the application echoes back without proper sanitization. The vulnerability requires user interaction—a victim must click a crafted link—but can be exploited remotely without authentication. The vendor has acknowledged the issue and removed the unnecessary parameter echo from the codebase, though they have not released a patched version, deferring the fix to a future release.

• CVE-2026-13554MEDIUM 4.3

  A stored cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious JavaScript code through the amenities management interface that executes in the browsers of other users—specifically administrators—when they view the poisoned data. The vulnerability requires user interaction (clicking a link or viewing a page with the payload) but no authentication to create the malicious input.

• CVE-2026-13556MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious code through the Name parameter in the user editing interface (/admin/mod_users/controller.php?action=edit), which is then executed in the context of another user's browser. The vulnerability requires user interaction—such as a victim clicking a malicious link—but can cause session hijacking, credential theft, or unauthorized administrative actions. The vulnerability has been publicly disclosed.

• CVE-2026-13557MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in itsourcecode Online Hotel Management System version 1.0. An attacker can inject malicious scripts through the 'Name' parameter in the room management admin interface, which are then reflected back to users who interact with the affected page. This requires user interaction (such as clicking a malicious link) to trigger, but once executed, the injected code runs in the victim's browser with the same privileges as their session.

• CVE-2026-13567MEDIUM 4.3

  A reflected cross-site scripting (XSS) vulnerability has been identified in code-projects Online Music Site version 1.0. The flaw exists in the feedback form handler (/Frontend/Feedback.php) and can be exploited by injecting malicious code into form fields (name, email, address, or message). When a victim visits a malicious link crafted by an attacker, the injected code executes in their browser, potentially allowing credential theft, session hijacking, or malware distribution. Public exploit code is already available, raising the attack likelihood.

• CVE-2026-14633MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project's hidden REST API endpoint at /index.php/api/product/set. An attacker can inject malicious scripts via the title or description parameters, which are then reflected back to users. This requires a user to interact with a crafted link or request, but once exploited, it allows arbitrary JavaScript execution in the victim's browser context. The vulnerability has been publicly disclosed, and the affected codebase uses a rolling release model, meaning patch deployment is version-agnostic.

• CVE-2026-14634MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in the Ecommerce-CodeIgniter-Bootstrap project affecting the Subscribed Emails Admin Page. An attacker can manipulate the User-Agent header to inject malicious scripts that execute in the context of an administrator's browser session. The vulnerability requires user interaction (an admin must visit a page with the malicious header present) and does not allow unauthorized data access or system availability impact, but could enable account compromise or administrative action abuse. Proof-of-concept code is publicly available, elevating the practical risk despite the CVSS medium rating.

• CVE-2026-14656MEDIUM 4.3

  A stored or reflected cross-site scripting (XSS) vulnerability exists in code-projects Assessment Management version 1.0, specifically in the user removal functionality at /admin/remove-user.php. An attacker can inject malicious JavaScript through the ID parameter, which executes in the browser of any admin who clicks a crafted link. This does not require the attacker to authenticate, but does require user interaction—typically clicking a malicious link. The vulnerability has been publicly disclosed, increasing exposure risk.

• CVE-2026-14704MEDIUM 4.3

  A cross-site scripting (XSS) vulnerability exists in stephen-kruger bluebox through version 4.5.12. An attacker can manipulate the 'code' argument to inject malicious scripts that execute in a victim's browser. The attack requires user interaction (such as clicking a link) but can be launched remotely. Public exploits are available, increasing the risk of active exploitation.

• CVE-2026-15202MEDIUM 4.3

  YzmCMS versions up to 7.5 contain a cross-site scripting (XSS) vulnerability in the header handling component that allows attackers to inject malicious scripts into web pages. The flaw exists in the `get_url` function within `/yzmphp/yzmphp.php`, where the HTTP_HOST parameter is not properly sanitized before being used. An attacker can craft a malicious link that, when clicked by a user, executes arbitrary JavaScript in their browser—potentially stealing session data, credentials, or redirecting them to malicious sites. The vulnerability requires user interaction (clicking a link) but can be exploited remotely without authentication.

• CVE-2026-32250MEDIUM 4.3

  NamelessMC, a website platform used for Minecraft server management, contains a reflected cross-site scripting (XSS) vulnerability in version 2.2.4. The flaw exists in how the application handles the `id` parameter on the user queries endpoint. An attacker can embed malicious JavaScript in a specially crafted URL; when a user clicks that link, the script runs in their browser with access to the site's session and data. This could enable attackers to steal session cookies, redirect users to phishing pages, or modify page content to deceive users.

• CVE-2026-56761MEDIUM 4.3

  Hono, a popular TypeScript web framework, contains a vulnerability in its server-side JSX rendering engine that allows attackers to inject malicious HTML into web pages. By crafting specially malformed attribute names—using characters like quotes and angle brackets—attackers can break out of HTML tag contexts and insert unintended HTML elements or attributes. This vulnerability affects Hono versions before 4.12.14. The attack requires user interaction (such as visiting a malicious link or form submission) and has limited impact on confidentiality, but can compromise the integrity of rendered content.

• CVE-2026-13957MEDIUM 4.2

  Google Chrome versions before 150.0.7871.47 contain a security UI flaw in its Extensions feature that allows attackers to execute unauthorized scripts or inject HTML content into web pages—a technique called Unsafe Cross-Site Scripting (UXSS). The attack requires two conditions: first, an attacker must trick a user into installing a malicious browser extension, and second, the user must visit a specially crafted webpage. Once those conditions are met, the attacker gains the ability to run arbitrary code within the browser's rendering context.

• CVE-2026-54298MEDIUM 4.2

  Astro, a popular web framework, contains a vulnerability in how it processes HTML attributes during server-side rendering. When developers use the spread syntax to pass object properties as HTML attributes—a common pattern for dynamic content—Astro fails to escape keys coming from untrusted sources like APIs or user input. An attacker can craft malicious property names that become unescaped HTML attributes, allowing them to inject event handlers (onclick, onmousemove) or break out of the attribute context entirely to inject new HTML elements. This affects Astro versions before 6.4.6.

• CVE-2026-13323MEDIUM 4.1

  Open VSX Registry, the extension marketplace used by VS Code and compatible editors, has a vulnerability in how it serves user-uploaded HTML files. An attacker with a publisher account can upload a malicious HTML file disguised as part of an extension package. When an authenticated user visits that file's link, the browser treats it as belonging to the open-vsx.org website rather than a separate, untrusted origin. This allows the attacker to steal the user's session tokens, create permanent access tokens for future unauthorized access, and publish fake or malicious extension updates that would reach all downstream users of that extension across VS Code, VSCodium, Cursor, Windsurf, and other compatible editors—a classic supply chain attack vector.

• CVE-2026-37700MEDIUM 4.1

  MaxSite CMS version 109.2 contains a cross-site scripting (XSS) vulnerability in its backend file upload feature that allows authenticated attackers to inject malicious scripts. When an administrator performs a file upload through the admin page endpoint, an attacker with login credentials could craft a request that executes JavaScript in the victim's browser, potentially exposing sensitive information displayed during the upload process.

• CVE-2026-42401MEDIUM 4.1

  CVE-2026-42401 is a stored HTML injection vulnerability in Kibana that allows an attacker with write access to an Elasticsearch index to inject malicious markup. When other users view the affected Kibana dashboard or visualization, the injected code is not properly sanitized before rendering in their browser. This can enable unauthorized UI changes and cause the victim's browser to make unintended outbound network requests on their behalf.

• CVE-2026-4983MEDIUM 4.1

  Open VSX Registry, an extension marketplace used by developers, has a vulnerability where it fails to properly secure SVG image files that extensions upload as icons. When someone views the icon directly, malicious code embedded in the SVG can execute in their browser. The impact depends on how the registry is hosted: if it uses its own servers, an attacker can steal session tokens and impersonate users; if it relies on external cloud storage like Amazon S3, the risk is lower but attackers can still create convincing fake login pages to harvest credentials.

• CVE-2026-56354MEDIUM 4.1

  n8n, a popular workflow automation platform, contains vulnerabilities in its Form Node that allow authenticated users to inject malicious content. Specifically, two issues exist: unsanitized HTML in description fields can enable stored cross-site scripting (XSS) attacks, and overly permissive iframe sandbox settings can be exploited for phishing redirects. An attacker with workflow creation permissions could craft a malicious form that, when viewed by end users, executes scripts in their browsers or redirects them to attacker-controlled sites. The vulnerability affects versions before 1.123.24 in the 1.x branch and before 2.10.4 and 2.12.0 in the 2.x branch.

• CVE-2026-55592LOW 3.9

  Dashy, a self-hosted dashboard application, contains a vulnerability in its workspace feature that allows attackers to inject malicious links. When a logged-in user clicks a specially crafted workspace link, it can execute JavaScript code within the user's browser session. This code runs with the same permissions as the Dashy application itself, potentially exposing sensitive data or allowing unauthorized actions. The vulnerability has been patched in version 4.3.7.

• CVE-2026-10228LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in the raisulislamg4 student_management_system_by_php project. The flaw resides in the admission_form_check.php file, where user input passed through the Message parameter is not properly sanitized before being reflected in the web response. An authenticated attacker can craft malicious input that, when viewed by another user, executes arbitrary JavaScript in their browser. The vulnerability requires user interaction (clicking a malicious link) and affects only the integrity of data, not confidentiality or availability. Public exploit details are available, though the CVSS 3.5 score reflects the relatively constrained attack scenario requiring authentication and browser-based execution.

• CVE-2026-10234LOW 3.5

  Mettle sendportal versions up to 3.0.1 contain a cross-site scripting (XSS) vulnerability in the Campaign Handler component. An authenticated attacker can inject malicious scripts through the content parameter in the /webview/ endpoint, potentially allowing them to steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. The vulnerability requires user interaction to be effective and does not grant direct administrative access. Exploit code is publicly available, elevating practical risk despite the low CVSS score.

• CVE-2026-10244LOW 3.5

  SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in the medicine name creation function. An authenticated user can inject malicious script code through the medicine_name parameter, which executes in the context of other users' browsers. The vulnerability requires user interaction (clicking a link or visiting a page) to trigger, and an attacker must have valid login credentials to exploit it. Public exploits are now available.

• CVE-2026-10245LOW 3.5

  SourceCodester Pharmacy Sales and Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in its supplier creation functionality. An authenticated user can inject malicious code through the company name field when creating a supplier record. This code executes in the browsers of other users who view the supplier information, potentially allowing attackers to steal session tokens, redirect users to malicious sites, or perform unauthorized actions on their behalf. Public exploits for this vulnerability are already available.

• CVE-2026-10246LOW 3.5

  A stored cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An authenticated user can inject malicious scripts through the medicine presentation creation function, which are then executed in the browsers of other users who view that data. The attack requires user interaction and does not grant elevated privileges, but can be used to steal session tokens, redirect users, or perform actions on their behalf within the application.

• CVE-2026-10247LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in SourceCodester Pharmacy Sales and Inventory System version 1.0. An authenticated attacker can inject malicious scripts through the generic_name parameter in the create_generic_name function, which the application will then execute in users' browsers. This could allow the attacker to steal session cookies, hijack user accounts, or manipulate pharmacy data. The vulnerability requires user interaction to trigger and an authenticated account to exploit, limiting its immediate impact, but public exploit code is now available.

• CVE-2026-10567LOW 3.5

  A stored cross-site scripting (XSS) vulnerability exists in 1Panel-dev CordysCRM versions up to 1.4.1. An authenticated attacker can inject malicious JavaScript into the Description field of the ModuleFormController, which will execute in the browsers of other users who view the affected module form. The vulnerability requires user interaction (viewing the crafted form) to trigger, and does not grant the attacker direct access to sensitive data or system functions. Upgrading to version 1.7.0 resolves the issue.

• CVE-2026-11520LOW 3.5

  SourceCodester Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in the header.php file that allows authenticated users to inject malicious scripts through multiple parameters. An attacker with valid credentials can craft a specially crafted request to inject JavaScript that executes in the browsers of other users, potentially stealing session data or performing unauthorized actions on their behalf. Public exploit code is available, increasing the practical risk despite the low CVSS score.

• CVE-2026-11534LOW 3.5

  A cross-site scripting (XSS) vulnerability exists in imvks786's student_management_system application. The flaw allows attackers to inject malicious scripts through the name, address, or fname parameters in the /add.php file. An attacker with authenticated access can craft a malicious request that, when clicked by another user, executes arbitrary JavaScript in that user's browser. The vulnerability is publicly known, and the development team has been notified but has not yet responded with a patch.

• CVE-2026-12047LOW 3.5

  pgAdmin 4's cloud deployment wizard contains an HTML injection vulnerability in its AWS, Azure, and Google Cloud credential-verification endpoints. When pgAdmin receives an error message from a cloud provider's API (such as a rejected AWS access key), it forwards that error text directly into the web interface without removing HTML tags. An authenticated attacker can craft a malicious credential submission containing HTML/iframe code; when the cloud provider rejects it and echoes back the attacker's input in its error message, pgAdmin displays that message in the wizard—parsing it as HTML. This allows the attacker to inject an iframe pointing to a malicious site, redirecting the victim's browser away from pgAdmin. The vulnerability requires the attacker to be an authenticated pgAdmin user and requires user interaction (submitting the malicious credential). Redirecting another user would require an additional cross-site request-forgery vector.