PT-2026-86855

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible...

CVE-2026-15984

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984

The QuickCal WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via Custom Field Parameters in all versions up to and including 1.0.20 . The root cause is insufficient input sanitization and output escaping. A critical aggravating factor is that the nonce guarding the unauthentic...

EUVD-2026-71885

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984 QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984: Improper Neutralization of Input During Web Page Generation

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

PT-2026-86320

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

PT-2026-84101

Name of the Vulnerable Software and Affected Versions Live Composer – Free WordPress Website Builder versions prior to 2.1.20 Description Insufficient input sanitization and output escaping in the dslc custom field shortcode allow authenticated attackers with contributor-level access or higher to...

Snipe-IT vulnerable to stored XSS via Markdown custom field

Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...

WordPress Advanced Classifieds & Directory Pro plugin < 3.4.3 - Unauthenticated Non-Public Listing Custom Field Disclosure vulnerability

Unauthenticated Non-Public Listing Custom Field Disclosure vulnerability discovered by Shikhali Jamalzade in WordPress Plugin Advanced Classifieds & Directory Pro versions 3.4.3...

CVE-2026-77996

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77996

YOOtheme Pro (a Joomla extension) is affected by an authenticated, privileged stored XSS in versions 1.0.0 through 5.0.41 . The root cause is a lack of escaping in the location custom field , which allows a privileged user to inject a cross-site scripting payload. The CVSS 4.0 base score is 7.5 (...

CVE-2026-77996 Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-77996: Improper Neutralization of Input During Web Page Generation

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

PT-2026-81293

Name of the Vulnerable Software and Affected Versions YOOtheme Pro versions 1.0.0 through 5.0.41 Description An authenticated and privileged stored Cross-Site Scripting XSS issue exists due to a lack of escaping in the location custom field. This allows an attacker with sufficient privileges to...

CVE-2026-55095

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

EUVD-2026-63463

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-55095 OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inplace-edit dialog for a raw customfield project attribute. The dialog path resolves the project custom field by its raw identifier without...

CVE-2026-55095

In OpenProject ≤17.5.1, the inplace-edit dialog resolves project custom fields by raw identifier without enforcing the admin_only visibility scope, leaking hidden admin-only comment text to authenticated non-admin members. CVSS 5.3 MEDIUM. Fixed in 17.6.0. No public exploitation observed.