WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by AndrewN in WordPress Plugin Best Payments Plugin for WP versions = 4.6.27...

WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sengtocxoen in WordPress Plugin Hippoo Mobile App for WooCommerce versions = 1.12.0...

WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin SimplyRETS Real Estate IDX versions = 3.2.9...

CVE-2026-109345

A flaw was found in DOMPurify. This vulnerability allows a remote attacker to conduct cross-site scripting XSS attacks by bypassing HTML sanitization when the library operates in in-place mode. When processing raw text elements containing embedded markup, the library removes the element but fails...

CVE-2026-109344

A flaw was found in DOMPurify. When performing in-place sanitization directly on active webpage elements, the library fails to neutralize content detached by post-processing hooks. A remote attacker can exploit this issue by supplying crafted markup containing malicious event handlers inside...

CVE-2026-76565

Reflected XSS via pricefrom / priceto Filter Parameters in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Injects Arbitrary JavaScript via Crafted Price Filter URL SUMMARY PhocaCart 6.1.7 for Joomla is vulnerable to Reflected Cross-Site Scripting XSS via the pricefrom and priceto GET...

CVE-2026-76564

Stored XSS via User-Agent in Admin Order View in PhocaCart PhocaCart ≤ 6.1.7 — Unauthenticated Attacker Stores XSS Payload via Checkout. Executes in Admin Browser Context SUMMARY PhocaCart 6.1.7 for Joomla stores the raw HTTP User-Agent header from checkout requests in the orders database table...

https-nj.gov---CVE-2018-14042

https-nj.gov---CVE-2018-14042 Vulnearability Report of the New Jersey official site In Bootstrap prior to 4.1.2, XSS is possible in the main collapse data attribute. The data-target attribute, the data-parent attribute and the data-container is vulnerable to Cross-Site Scripting attacks. Test...

CVE-2026-109345

DOMPurify before 3.4.16 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization because INPLACE mode returns a force-removed style element whose text content still carries markup. Attackers can supply a style element containing a closing style tag and an img...

CVE-2026-109327

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109322

Grav Guestbook plugin before 0.5.2 contains a stored cross-site scripting vulnerability because its AJAX Load more and Admin Load all handlers insert stored author and message fields into the DOM as unescaped HTML via jQuery. Unauthenticated visitors can submit markup that executes in other...

CVE-2026-109307

Craft CMS 5.0.0 before 5.10.14 contains a DOM-based cross-site scripting vulnerability in the control panel login and 2FA verification flow, where a user-controlled returnUrl accepting javascript: URLs is used in client-side navigation. Attackers can lure a 2FA-enabled victim into opening a craft...

CVE-2026-109300

Open WebUI from 0.6.31 before 0.11.4 contains a stored cross-site scripting vulnerability in its Markdown renderer, which treats user-authored tool-call details blocks as tool output and mounts their embeds attribute in script-enabled iframes. Authenticated users can post crafted channel messages...

CVE-2026-109290

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109288

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-108478

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 8.8.8...

CVE-2026-108908

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7callboarduserset.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched...

EUVD-2026-97724

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...

CVE-2026-108482

The LeapWorx Premium Addons for Elementor WordPress plugin (versions

CVE-2026-108482 WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Stored XSS.This issue affects Premium Addons for Elementor: from n/a through 4.11.110...