1047377 matches found
CVE-2026-45733 Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...
CVE-2026-45733
Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the iconClass label value is returned raw by getNoteIcon and inserted without HTML attribute encoding into class attributes in...
CVE-2026-73426
Trix (a WYSIWYG rich text editor by Basecamp) versions prior to 2.1.17 are vulnerable to stored cross-site scripting (XSS) . The root cause is a data-trix-serialized-attributes attribute that bypasses the DOMPurify sanitizer. An attacker can craft HTML containing this attribute with a malicious p...
CVE-2026-73426 Trix: Stored XSS vulnerability through serialized attributes
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...
CVE-2026-73426 Trix: Stored XSS vulnerability through serialized attributes
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...
EUVD-2026-60825
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...
CVE-2026-32333
Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...
CVE-2026-28568
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
CVE-2026-28569
Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-73393
The WordPress Subscribe2 plugin (versions ≤ 10.46) contains an unauthenticated reflected XSS flaw, exploitable via network without privileges; CVSS 7.1 (High). Patchstack is the CNA. No exploitation evidence or fix version is provided in the documents. Monitor for updates. Patchstack advisory: ht...
CVE-2026-73393 WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
EUVD-2026-60800
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73382 WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73382
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
EUVD-2026-60797
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73382
The WordPress Site Reviews plugin (versions ≤ 8.2.0) has an unauthenticated Cross-Site Scripting (XSS) vulnerability, exploitable over the network with no privileges required, rated CVSS 7.1 HIGH. No in-the-wild exploitation has been reported. No patch version is provided in the available documen...
CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...