CVE-2026-84931: Improper Neutralization of Input During Web Page Generation

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

EUVD-2026-71804

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...

CVE-2026-52772 YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...

CVE-2026-52772 YesWiki: Bazar form-field templates still apply `|raw('html')` to `field.label` / `field.hint` in attribute and label-body contexts — stored XSS in form renders (sibling class of commit `e6b66aa`)

YesWiki is a wiki system written in PHP. Prior to version 4.6.6, Bazar form-field templates still apply |raw'html' to field.label / field.hint in attribute and label-body contexts, resulting stored XSS in form renders. This issue has been patched in version 4.6.6...

WordPress Dear Flipbook plugin <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via '.df-element' Element Inner HTML vulnerability discovered by tipsen in WordPress Plugin DearFlip versions = 2.4.30...

CVE-2026-73848

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-53758

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization,...

CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

EUVD-2026-71626

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848 Emlog: Stored XSS via Tag Name in Article Editor

Emlog is an open source website building system. In versions 2.6.29 and prior, tag names in emlog are not HTML-encoded when rendered in the article editor. An attacker can create a tag containing ';alertdocument.domain;//. The addslashes function does not escape HTML entities, so ' is stored as-i...

CVE-2026-73848

Emlog , an open-source website building system, is affected by a stored XSS in versions 2.6.29 and prior . Tag names rendered in the article editor are not HTML-encoded. Because the application uses addslashes() instead of proper HTML entity encoding, a single quote (') stored in a tag name is de...

CVE-2026-53758

Emlog versions 2.6.29 and prior are affected by a stored cross-site scripting (XSS) vulnerability. Article content is processed by the Parsedown Markdown parser without enabling safe mode, allowing raw HTML—including [removed] tags—embedded in Markdown to pass through unescaped and rendered with ...

CVE-2026-53758 Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization,...

CVE-2026-53758 Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization,...

CVE-2026-53758 Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized

Emlog is an open source website building system. In versions 2.6.29 and prior, article content is processed by Parsedown without enabling safe mode, which means raw HTML including tags embedded in Markdown is passed through unescaped. The output is rendered with no additional sanitization,...

CVE-2026-19727

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

EUVD-2026-71213

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-19727

CVE-2026-19727 is an XSS (targeting HTML attributes) vulnerability in the Yordam Information Technology Consulting Library Information and Document Automation Program , caused by improper neutralization of input during web page generation. The issue affects versions before v22.2 and is rated CVSS...

CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...