1144771 matches found
CVE-2026-66611: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66606: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...
CVE-2026-73402: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
PT-2026-78963
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
PT-2026-78981
Unauthenticated Cross Site Scripting XSS in NotificationX Pro = 3.1.4 versions...
CVE-2026-66615: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...
CVE-2026-66614: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...
PT-2026-78964
Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...
PT-2026-78965
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
JetBrains YouTrack < 2026.2.18068 Stored XSS (CVE-2026-75048)
The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.18068. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via the fenced code-block language label was possible. CVE-2026-75048 Note that Nessus has not tested for this issue but...
PT-2026-79078
Mongoose is an embedded web server and network library. Prior to 7.22, an attacker who can create a file with an HTML payload in its name can trigger stored cross-site scripting when a user browses a directory served with MG ENABLE DIRLIST. The printdirentry path called by listdir in src/http.c...
CVE-2026-71368: Improper Neutralization of Input During Web Page Generation
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...
CVE-2026-66590: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...
Cross-site Scripting (XSS)
Overview org.springframework:spring-webmvc is a package that provides Model-View-Controller MVC architecture and ready components that can be used to develop flexible and loosely coupled web applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS when sending vi...
PT-2026-78972
Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...
PT-2026-78977
Name of the Vulnerable Software and Affected Versions Flatastic versions 2.0 and earlier Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...
PT-2026-78983
Subscriber Cross Site Scripting XSS in WP BASE Booking = 6.3.2 versions...
PT-2026-78961
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...