CVE-2026-66673: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Flatastic = 2.0 versions...

PT-2026-78981

Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...

PT-2026-78965

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

PT-2026-78963

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66597: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66581: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...

CVE-2026-71368: Improper Neutralization of Input During Web Page Generation

F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...

PT-2026-78964

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66615: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...

CVE-2026-66614: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

CVE-2026-66606: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

PT-2026-79078

Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG ENABLE DIRLIST. The printdirentry path called by listdir in src/http.c...

CVE-2026-66590: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

Cross-site Scripting (XSS)

Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sending vi...

JetBrains YouTrack < 2026.2.18068 Stored XSS (CVE-2026-75048)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18068. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via the fenced code-block language label was possible. CVE-2026-75048 Note that Nessus has not tested for this issue but...

PT-2026-78972

Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...

CVE-2026-66605: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

CVE-2026-66612: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2026-66598: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-77643: Improper Neutralization of Input During Web Page Generation

A cross-site scripting vulnerability in queryparser/termgeneratorinternal.cc in Xapian xapian-core before 2.1.0 and before 1.4.32 exists due to incomplete HTML escaping by Xapian::MSet::snippet. NOTE: this issue exists because of a missed corner case of CVE-2018-0499...