UBUNTU-CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

WordPress Ultimate Dashboard plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard versions = 3.11.2...

WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Ultimate Dashboard Pro versions = 3.11.2...

CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75838

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75838

DOMPurify before 3.4.13 is affected by a cross-site scripting (XSS) vulnerability in its IN_PLACE sanitization mode. The root cause is that element-removal hooks fail to neutralize detached subtrees , allowing an attacker to supply HTML with event handlers on descendant elements that execute afte...

CVE-2026-75838 DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75838 DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in INPLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned...

CVE-2026-75107

Grav Form Plugin versions before 9.1.19 contain a stored cross-site scripting (XSS) vulnerability. The plugin fails to escape field-definition properties—specifically prepend, append, spacer text, section text, and select option labels—when rendering form templates. The root cause is the use of u...

CVE-2026-74902

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-74902

SiYuan (note-taking app) before v3.7.4 has a file upload validation flaw: filenames are inserted into HTML via insertAdjacentHTML without escaping. A crafted filename carrying script payloads triggers XSS that escalates to full OS command access when a victim drags, drops, or pastes the file into...

CVE-2026-74902 SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

EUVD-2026-60583

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...

CVE-2026-19447

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...

WordPress Bold Page Builder plugin <= 5.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Bold Page Builder versions = 5.6.8...

WordPress SureDash plugin <= 1.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'draweropenverposition' Block/Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin SureDash versions = 1.10.3...

WordPress Smash Balloon Social Post Feed plugin <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'id' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Smash Balloon Social Post Feed versions = 4.9.0...

WordPress Snippet Shortcodes plugin <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Snippet Shortcodes versions = 5.2.0...

CVE-2026-19447

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Fileorbis Informatics Services Trade Inc. FileOrbis allows Stored XSS. This issue affects FileOrbis: before 16.5...