CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-19922

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount1 results in cross site scripting. The attack can be initiated remotely. The exploit has...

CVE-2026-19922

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount1 results in cross site scripting. The attack can be initiated remotely. The exploit has...

EUVD-2026-59812

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount1 results in cross site scripting. The attack can be initiated remotely. The exploit has...

PT-2026-73068

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount 1 results in cross site scripting. The attack can be initiated remotely. The exploit ha...

containerized-data-importer1.66-api-1.66.0-1.1 on GA media (moderate)

containerized-data-importer1.66-api-1.66.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:11514-1 Rating: moderate Cross-References: CVE-2025-47911 CVE-2025-58058 CVE-2025-58190 CVE-2026-27136 CVE-2026-34986 CVE-2026-35469 CVE-2026-39821 CVE-2026-39827 CVE-2026-39828 CVE-2026-39832...

CVE-2026-73053

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...

CVE-2026-19916

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file editfooditems.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now...

CVE-2026-19916

CVE-2026-19916 affects code-projects Online Food Order System 1.0. The vulnerability is in an unknown function within the file edit_food_items.php, where manipulating the argument dname yields cross-site scripting (XSS). Remote exploitation is possible and the exploit is public. Connected sources...

CVE-2026-19916

A vulnerability was detected in code-projects Online Food Order System 1.0. The affected element is an unknown function of the file editfooditems.php. Performing a manipulation of the argument dname results in cross site scripting. Remote exploitation of the attack is possible. The exploit is now...

CVE-2026-73053 SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...

CVE-2026-73053

SiYuan before v3.7.4 has a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, enabling arbitrary code execution on ...

CVE-2026-73053

SiYuan versions before v3.7.4 contain a cross-site scripting vulnerability in the unicode2Emoji function that fails to sanitize codepoint branch output. Attackers can craft document icons with hex-encoded markup that executes in the renderer with Node integration enabled, achieving arbitrary code...

CVE-2026-73052

CVE-2026-73052 concerns SiYuan before v3.7.4. The issue arises because attribute-view field names are stored without HTML escaping and are interpolated into option elements via innerHTML in the sort menu. This allows stored XSS: an attacker can rename a database field to inject markup, which can ...

CVE-2026-73050

SiYuan versions before v3.7.4 fail to validate or escape the color field in attribute-view select options, allowing stored cross-site scripting through eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, executing arbitrary...

CVE-2026-73050

CVE-2026-73050 affects SiYuan before v3.7.4, where the color field in attribute-view select options is not validated/escaped, allowing stored XSS via eight unescaped render sites. Attackers can inject event-handler attributes by including quotation marks in the color value, enabling arbitrary Jav...

CVE-2026-73044

SiYuan before v3.7.4 is affected: it fails to validate/escape table column width values, enabling stored XSS via style attributes. Attackers can use the setAttrViewColWidth API to break out of style attributes and inject event handlers on every table cell, enabling arbitrary code execution in the...

CVE-2026-19904

A vulnerability was found in SourceCodester Online Book Store System 1.0. This vulnerability affects unknown code of the file /admin/index.php?page=sitesettings of the component System Settings Module. The manipulation results in cross site scripting. The attack can be executed remotely. The...