1125866 matches found
CVE-2026-78264 WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...
CVE-2026-78264
CVE-2026-78264 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the WordPress Toolset Blocks plugin in versions 1.6.26 and earlier . The CNA (Patchstack) assigns a CVSS 3.1 base score of 7.1 (HIGH) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-explo...
CVE-2026-78264 WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Toolset Blocks = 1.6.26 versions...
CVE-2026-78263 WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.2.1 versions...
CVE-2026-78263
Event Tickets WordPress plugin versions
CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...
CVE-2026-32556
CVE-2026-32556 affects the WordPress Boost plugin versions 2.0.4 and earlier , introducing an unauthenticated Cross-Site Scripting (XSS) vulnerability. A remote attacker can inject malicious script content that executes in the context of a victim's browser, requiring user interaction but no prior...
CVE-2026-32556 WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Boost = 2.0.4 versions...
CVE-2026-74998
A flaw was found in Roundcube Webmail. Responses from the Cascading Style Sheets CSS proxy were not properly validated. This could allow a remote attacker to exploit MIME sniffing vulnerabilities, resulting in information disclosure or Cross-Site Scripting XSS...
CVE-2026-30864
Combodo iTop versions prior to 3.2.3 are susceptible to a Reflected Cross-Site Scripting (XSS) vulnerability in the dashboard revert functionality . An authenticated attacker (low privileges) can craft a malicious URL that, when clicked by a victim, executes arbitrary script in the victim's brows...
CVE-2026-34491
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
EUVD-2026-65005
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-34491
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1...
CVE-2026-34491
A persistent cross-site scripting (XSS) vulnerability in the web interface of Johnson Controls Metasys (a building management system) allows a low-privilege user to inject a malicious payload via a crafted URL. The payload persists across logins and executes in the browser context of other users,...
CVE-2026-78414
A cross-site scripting (XSS) vulnerability exists in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 (Linux, Windows, macOS). An adjacent-network attacker who controls a rogue Nx server on the same network segment can set that server's site name to a script p...
EUVD-2026-64898
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
CVE-2026-78414 Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name
Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session toke...
CVE-2026-78290
Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...