EUVD-2026-93781

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

CVE-2026-106033

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

PT-2026-107214

A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-site scripting XSS attack against a user of the affected client interface. Successful exploitation could allow an attacker to execute...

PT-2026-106853

A DOM-based Cross-Site Scripting XSS vulnerability exists in the Ansible Platform UI due to unvalidated input handling within the application's redirect route. Specifically, the application extracts a target destination from the next query parameter and directly assigns it to the browser's...

WordPress Post SMTP – Complete Email Delivery and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin Post SMTP versions = 4.0.1...

CVE-2026-102576 Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2026-102576

A domain-based cross-site scripting (XSS) vulnerability exists in Quay due to an unvalidated redirect_url on the sign-in page. A remote attacker can craft a malicious link to trick a user into logging in; because the application fails to validate the redirect destination, arbitrary scripts can be...

CVE-2026-102576 Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page

A flaw was found in Quay. A remote attacker could trick a user into logging in through a crafted link, resulting in cross-site scripting XSS. Because the application does not validate the redirect destination before navigating, this flaw allows the execution of arbitrary script in the context of...

CVE-2021-24891-Simulation

WordPress의 Elementor Website Builder 플러그인에서 발견된 CVE-2021-24891로 식별된 DOM 기반 교차 사이트 스크립팅XSS 취약점을 시뮬레이션하고 익스플로잇할 수 있는 실습형 컨테이너화된 랩 환경입니다. 📖 취약점 소개 이 랩은 WordPress용 Elementor 플러그인버전 3.4.8 이전의 DOM 기반 교차 사이트 스크립팅XSS 취약점을 시연합니다. 이 취약점은 Elementor 편집기의 클라이언트 측 코드가 URL의 해시...에서 데이터를 직접 읽고 적절한 삭제sanitization...

CVE-2024-30956

CVE-2024-30956 参照: https://www.lauyan.com/en/toweb-updates.htmliyFEw37D DOMベースのXSS TOWeb バージョン 5 例: http://127.0.0.1:8000/message.html?==gC+QHcpJ3Yz9CPpcyUThFIkV2chJWLN9ERngCdyVGbh5DdwlmcjNHP URL にアクセスすると、JS コードが実行されます。 補足: src には関連する HTML/JS コードのコピーが含まれています。TOWeb...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin All In One SEO Pack versions = 5.0.1.1...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin LearnPress versions = 4.4.7...

WordPress Ivory Search – WordPress Search Plugin plugin <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by @nacento in WordPress Plugin Ivory Search versions = 5.5.18...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.5...

WordPress Visitor Traffic Real Time Statistics plugin <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Visitors Traffic Real Time Statistics versions = 8.16...

CVE-2021-42558

CVE-2021-42558: MITRE Caldera의 다중 크로스 사이트 스크립팅 취약점 Caldera버전 =2.8.1에는 인증된 사용자와 인증되지 않은 공격자가 악용할 수 있는 여러 반사형, 저장형 및 자가 XSS 취약점이 포함되어 있습니다. 공급업체 공지: 이 취약점에 대한 공급업체의 공지는 여기에서 확인할 수 있습니다. 요구 사항: 이 취약점을 악용하려면 다음이 필요합니다: 일부 XSS는 유효한 사용자 자격 증명이 필요합니다 개념 증명: 자세한 내용과 악용 과정은 이 PDF에서 확인할 수 있습니다. 추가 정보: XSS ...

CVE-2026-97341

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

CVE-2026-97341 Visitor Traffic Real Time Statistics <= 8.16 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header

The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'X-Real-IP' HTTP Header in all versions up to, and including, 8.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...