EUVD-2026-55236

A stored cross-site scripting XSS vulnerability in cube-root/directory-serve through 1.3.7 allows an attacker to inject arbitrary JavaScript into the web interface by uploading a file with a crafted filename containing HTML attribute-breaking characters...

Security Bulletin:Vulnerability in React affects IBM Netezza Appliance

Summary The React package is used by IBM Netezza Appliance. IBM Netezza Appliance has addressed the applicable CVEsCVE-2026-33244, CVE-2026-33245, CVE-2026-34077, CVE-2026-40181, CVE-2026-42211, CVE-2026-42342 Vulnerability Details CVEID:CVE-2026-33244 DESCRIPTION: React Router is a router for...

CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

WordPress Accordion plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by pajarori in WordPress Plugin Accordion versions = 3.0.6...

WordPress FluentCommunity plugin <= 2.7.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Septio Noerdiansyah in WordPress Plugin FluentCommunity versions = 2.7.5...

CVE-2026-17010

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-15047

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-13701

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...

CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

EUVD-2026-55082

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-57279

The CVE-2026-57279 entry concerns Cybozu Garoon with a Cross-Site Scripting (CWE-79) vulnerability in the Scheduler component. An attacker could inject and execute arbitrary script in the web browser of a user who is logged into Garoon, potentially leading to session takeover or hijacking of user...

CVE-2026-57279

Cybozu Garoon contains a cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of a user logged in to the product...

CVE-2026-15047

The s2Member WordPress plugin (versions prior to 260805 ) is vulnerable to a stored Cross-Site Scripting (XSS) attack. The root cause is the failure to escape several shortcode attributes before they are outputted within an inline script context . This allows users with contributor-level access t...

EUVD-2026-54995

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-15047

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-14293 Autopay / Blue Media for WooCommerce < 5.0.1 - Unauthenticated Stored XSS via CSS Editor

The Autopay WordPress plugin before 5.0.1 does not perform any capability or nonce check before saving a styling option from a public request, and does not escape that value when it is later output on the checkout page, allowing unauthenticated attackers to store JavaScript that executes in the...

CVE-2026-13701

The Advanced Excerpt WordPress plugin (versions before 4.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly sanitize and escape one of its settings before outputting it on the website's front end. Specifically, the vulnerability is linked to the Ellipsis Setting ....

EUVD-2026-55021

The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators including those without the unfilteredhtml capability, such as on multisite to perform Stored Cross-Site Scripting...