CVE-2026-10082

The Advanced Ads WordPress plugin before 2.0.23 does not sanitize and escape a shortcode parameter before outputting it in the page, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the affected content is viewed, including by higher-privileged...

BIT-OPENBAO-2026-33758 OpenBao has Reflected XSS in its OIDC authentication error message

OpenBao is an open source identity-based secrets management system. Prior to version 2.5.2, OpenBao installations that have an OIDC/JWT authentication method enabled and a role with callbackmode=direct configured are vulnerable to XSS via the errordescription parameter on the page for a failed...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

DEBIAN-CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

AZL-94010 CVE-2026-15928 affecting package xmlrpc-c 1.60.04-4

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

UBUNTU-CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

EUVD-2026-49062

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07–1.67.01 are vulnerable to a reflected XSS in the error page component. The CVE entry specifies a reflected cross-site scripting vulnerability with NETWORK attack vector, no privileges required, and user interaction needed. Impact is HIGH on confidentiality (both vul...

PT-2026-64829

Name of the Vulnerable Software and Affected Versions XMLRPC-C Library versions 1.07 through 1.67.01 Description A reflected cross-site scripting XSS issue exists in the error page component. Reflected XSS occurs when an application includes untrusted data in a web page without proper validation ...

PT-2026-65319

Name of the Vulnerable Software and Affected Versions GetGenie versions prior to 4.4.4 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update GetGenie to version 4.4.4 o...

PT-2026-64951

Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

PT-2026-64997

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.2 Description Stored cross-site scripting is possible due to improper escaping of the title-img Individual Attribute List value during the rendering of Gallery and Kanban cover images. This occurs via unescaped sty...

PT-2026-65317

Name of the Vulnerable Software and Affected Versions Message Filter for Contact Form 7 versions prior to 1.6.4 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...

PT-2026-64955

Author Cross Site Scripting XSS in Orbit Fox by ThemeIsle = 3.0.7 versions...

PT-2026-64995

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Stored and reflected cross-site scripting issues exist in SVG sanitization. Authenticated attackers can bypass the HTML parser-based cleaner by hiding script tags within desc, style, or noscript...

PT-2026-65063

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0, from 10.0.0 through 10.9.0. Users are recommended to upgrade to version 10.10.0, which fixes the issue...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...