CVE-2026-55839

Kestra , an open-source event-driven orchestration platform, is vulnerable to stored cross-site scripting (XSS) in versions prior to 1.3.24 . The root cause is in the custom Markdown parser (ui/src/utils/markdown_plugins/link.ts), which renders parsed attributes from the [[link]] syntax directly ...

EUVD-2026-60976

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-55839

Kestra is an open-source, event-driven orchestration platform. Prior to 1.3.24, Kestra's custom Markdown parser in ui/src/utils/markdownplugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom link syntax...

CVE-2026-73393

Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...

CVE-2026-73382

Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...

CVE-2026-73375

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-73378

Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...

CVE-2026-73358

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

CVE-2026-73360

Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...

CVE-2026-73359

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...

CVE-2026-73362

Unauthenticated Cross Site Scripting XSS in URL Shortify = 2.5.0 versions...

CVE-2026-73351

Unauthenticated Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.1 versions...

CVE-2026-73338

Unauthenticated Cross Site Scripting XSS in Autopay = 5.0.0 versions...

CVE-2026-73342

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

CVE-2026-68567

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

CVE-2026-68565

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

CVE-2026-66645

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66643

Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...

CVE-2026-66646

Contributor Cross Site Scripting XSS in WP Tab Widget = 1.2.11 versions...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...