CVE-2026-59281 Spring Framework Cross-site Scripting via EscapedErrors

Spring MVC and WebFlux applications that obtain a data-binding Errors instance with HTML escaping enabled and then render field errors using the no-argument Errors.getFieldErrors or Errors.getFieldError accessors are vulnerable to arbitrary HTML/JavaScript code injection, potentially resulting in...

CVE-2026-59281

Spring Framework versions from 5.2.25.RELEASE through 7.0.8 are vulnerable to a reflected cross-site scripting (XSS) flaw in Spring MVC and WebFlux applications. The root cause involves data-binding Errors instances with HTML escaping enabled: when field errors are rendered using the no-argument ...

CVE-2022-2398

The WordPress Comments Fields WordPress plugin before 4.1 does not escape Field Error Message, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...