PT-2026-77098

Unauthenticated Cross Site Scripting XSS in Chaty Pro = 3.5.8 versions...

PT-2026-77087

Unauthenticated Cross Site Scripting XSS in WP Multilang = 2.4.31 versions...

PT-2026-77104

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

PT-2026-77061

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

PT-2026-77069

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

PT-2026-77052

Unauthenticated Cross Site Scripting XSS in BP Better Messages = 2.15.22 versions...

PT-2026-77786

Name of the Vulnerable Software and Affected Versions Oracle Transportation Execution versions 12.2.3 through 12.2.15 Description A flaw in the Internal Operations component allows a low privileged attacker with network access via HTTP to compromise the system. Successful exploitation requires...

PT-2026-77596

Name of the Vulnerable Software and Affected Versions Oracle Hyperion Infrastructure Technology version 11.2.25.0.000 Description An unauthenticated attacker with network access via HTTP can compromise the Installation and Configuration component of Oracle Hyperion Infrastructure Technology. This...

CVE-2026-75626: Improper Neutralization of Input During Web Page Generation

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata. Attackers can inject malicious HTML elements with event handlers into correlation results that execute scripts in the operator's browser when the correlations view is...

PT-2026-78245

Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 2.17.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server and lat...

PT-2026-77196

Name of the Vulnerable Software and Affected Versions Joomla! Core versions 5.1.0 through 5.4.7 Joomla! Core versions 6.0.0 through 6.1.2 Description Improper escaping flags in schema.org markup outputs create a Cross-Site Scripting XSS vector. XSS is a security flaw that allows an attacker to...

PT-2026-80393

Apache Answer vulnerable to Cross-site Scripting in github.com/apache/answer...

PT-2026-77064

Name of the Vulnerable Software and Affected Versions Wise Chat versions prior to 3.5 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into...

PT-2026-77114

Name of the Vulnerable Software and Affected Versions Subscribe2 versions prior to 10.47 Description An unauthenticated Cross Site Scripting XSS issue exists in the Subscribe2 WordPress plugin. This flaw allows a remote attacker to execute malicious scripts in the browser of a user without...

PT-2026-78018

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description A flaw in the Endeca Application Controller component allows a low-privileged attacker with network access via HTTP to compromise the system. The...

PT-2026-77065

Name of the Vulnerable Software and Affected Versions Featured Video Plus versions prior to 2.3.4 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 2.3.3...

PT-2026-77072

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

PT-2026-77066

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-77075

Unauthenticated Cross Site Scripting XSS in Templately = 3.7.1 versions...

PT-2026-76917

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML. Attackers can craft a malicious filename containing script payloads that execute with full OS command access...