WordPress Name Directory plugin <= 1.34.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by hhhai in WordPress Plugin Name Directory versions = 1.34.0...

WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dcs in WordPress Plugin Mang Board WP versions = 2.4.1...

WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin wpForo Forum versions = 3.1.5...

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Calculated Fields Form versions = 5.5.1.1...

WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Event Tickets versions = 5.29.4...

WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WPS Limit Login versions = 1.5.9.3...

WordPress PixelYourSite – Your smart PIXEL (TAG) Manager plugin <= 11.4.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin PixelYourSite – Your smart PIXEL TAG Manager versions = 11.4.1...

WordPress Ninja Forms plugin <= 3.15.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin Ninja Forms versions = 3.15.3...

CVE-2026-91999

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91852

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-73192

An improper neutralization of input during web page generation 'Cross-site Scripting' CWE-79 vulnerability when using the XSSAPI.getValidHref in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting XSS attack in every feature using this metho...

Cross-site Scripting (XSS)

Overview org.apache.sling:org.apache.sling.xss is a package for providing XSS protection based on the OWASP AntiSamy and OWASP Java Encoder libraries. Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper escaping in the XSS Webconsole plugin. An attacker can...

WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by benzdeus in WordPress Plugin Premium Blocks – Gutenberg Blocks for WordPress versions = 2.3.17...

EUVD-2026-85179

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91928

The Apache Sling XSS component is vulnerable to a cross-site scripting (XSS) issue caused by the improper neutralization of input during web page generation. This vulnerability affects versions prior to 2.4.12 . The CVSS 3.1 score is 6.1 (MEDIUM) , indicating that while exploitation requires user...

EUVD-2026-85176

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91852 Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...

CVE-2026-91852

The Apache Sling XSS component (versions before 2.4.12 ) is vulnerable to a cross-site scripting (XSS) flaw caused by the improper neutralization of input during web page generation . This vulnerability allows for potential impact on confidentiality and integrity, with a CVSS3.1 base score of 6.1...

EUVD-2026-85175

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue...