PT-2026-88377

🚨 CVE-2026-75683 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires use...

PT-2026-88347

🚨 CVE-2026-75635 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires use...

PT-2026-88372

🚨 CVE-2026-75677 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires use...

PT-2026-88407

🚨 CVE-2026-75722 Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires use...

PT-2026-88731

Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. Chromium security severity: Low...

CVE-2026-3853

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

EUVD-2026-71886

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

CVE-2026-3853

The Divi theme for WordPress (versions ≤ 4.27.6 ) is affected by a DOM-Based Stored Cross-Site Scripting vulnerability in the image_src attribute of the et_pb_video_slider_item shortcode. The root cause is that image_src is absent from the $url_options whitelist, so it never receives esc_url_raw(...

CVE-2026-3853 Divi <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which only contains...

PT-2026-86328

The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image src attribute of the et pb video slider item shortcode in all versions up to, and including, 4.27.6. This is due to the image src field not being included in the $url options whitelist which only...

WordPress Divi plugin <= 4.27.6 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter vulnerability

Authenticated Contributor+ DOM-Based Stored Cross-Site Scripting via Video Slider 'imagesrc' Shortcode Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Theme Divi versions = 4.27.6...

CVE-2026-27086

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

CVE-2026-27086

CVE-2026-27086 affects the WordPress WoodMart theme by Xtemos , versions before 8.3.8 . The vulnerability is a DOM-Based Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.5 (Medium) , with a changed scope and low impact on co...

EUVD-2026-70980

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

The vulnerability of the Element.setAttribute() method in the XML Document Access and Management Module XMLDOM allows a attacker to perform cross-site scripting (XSS) attacks.

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

Divi < 4.27.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

Description The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which onl...

The vulnerability of the DOMHandler.startElement() method in the lib/dom-parser.js file of the XML document access and manipulation module XMLDOM allows a attacker to trigger a denial-of-service attack.

The vulnerability of the DOMHandler.startElement method in the lib/dom-parser.js file of the XML document access and manipulation module called XMLDOM is related to algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...