CVE-2026-19988

The CVE-2026-19988 affects the Alaev SEO Tools Extension for Chrome (up to version 1.0.10). The vulnerability targets Popup UI, specifically the addDiv function in src/popup.html, enabling basic cross-site scripting via manipulation. Exploitation is possible remotely and the exploit is public. No...

CVE-2026-19988

A vulnerability was detected in Alaev SEO Tools Extension up to 1.0.10 on Chrome. This impacts the function addDiv of the file src/popup.html of the component Popup UI. Performing a manipulation results in basic cross site scripting. The attack can be initiated remotely. The exploit is now public...

PT-2026-76881

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description A security flaw allows remote exploitation via cross site scripting XSS, a technique where malicious scripts are injected into trusted websites. The issue exists in the...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

PT-2026-76764

Name of the Vulnerable Software and Affected Versions Legora versions prior to 2026-08-14 Description A cross-site scripting issue exists where attackers can execute arbitrary JavaScript in a victim's browser. This occurs when a Mermaid block is prefixed with a gray-matter JavaScript front-matter...

EUVD-2026-60355

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-67925

Cross Site Scripting vulnerability in JeecgBoot v.3.9.2 allows a remote attacker to execute arbitrary code via the endpoint /airag/chat/upload...

CVE-2026-67925

JeecgBoot v3.9.2 has a stored XSS flaw in the /airag/chat/upload endpoint, exploitable by an unauthenticated remote attacker with user interaction required (CVSS 6.1). No patch version or PoC is provided; affected organizations should monitor the referenced GitHub issue (#9773) for remediation de...

CVE-2026-50771

Cross Site Scripting vulnerability in Squirro Cognitive Search 3.14.2 allows a remote attacker to execute arbtirary code via the Email Notification, Create Evaluation Sets and HTML Editor functions...

CVE-2026-50771

A stored/reflected XSS vulnerability exists in Squirro Cognitive Search versions below 3.14.2, exploitable through the Email Notification, Create Evaluation Sets, and HTML Editor functions. No authentication is required, though user interaction is needed. CVSS 6.1 (MEDIUM) reflects low confidenti...

CVE-2026-10734

The CVE-2026-10734 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the Infility Global WordPress plugin. Affected software: Infility Global plugin for WordPress (versions up to and including 2.15.21). Root cause: insufficient input sanitization and output escaping on the /cf7...

CVE-2026-10734 Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-10734 Infility Global <= 2.15.21 - Unauthenticated Stored Cross-Site Scripting via /cf7_record Log Endpoint

The Infility Global plugin for WordPress is vulnerable to Stored Cross-Site Scripting via /cf7record Log Endpoint in all versions up to, and including, 2.15.21 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-16758

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

CVE-2026-15726

The Serious Slider WordPress plugin is vulnerable to Stored Cross‑Site Scripting via the theme shortcode attribute in all versions up to and including 1.4.0, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject a...

CVE-2026-15726 Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15002 Autopay <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

CVE-2026-15009 Advanced File Manager <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter

The Advanced File Manager – Ultimate File Manager for WordPress And Document Library Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'soundFile' parameter in all versions up to, and including, 5.4.12 due to insufficient input sanitization and output escaping. Th...

CVE-2026-2487 Admin Custom Login <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting

The Admin Custom Login plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.6.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2026-19922

A security flaw has been discovered in code-projects Online Shopping System 1.0. Affected by this issue is some unknown functionality of the file /checkout.php. Performing a manipulation of the argument amount1 results in cross site scripting. The attack can be initiated remotely. The exploit has...