CVE-2026-19719 Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Contributor+ Stored XSS via Post Title

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

SUSE CVE-2026-83610

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createEntityReferencename accepts an invalid name and the ENTITYREFERENCENODE serializer...

SUSE CVE-2026-83614

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart...

SUSE CVE-2026-84118

Use-after-free in the JavaScript: GC component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2...

PT-2026-84796

Jenkins Customizable Header Plugin 295.v2544b ca 19b 97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...

PT-2026-84788

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

PT-2026-84772

In Stapler 1839.ved17667b a eb 5 through 2107.v8dfcb e8ed317 both inclusive, except 2088.2093.vd7c3e58008a 6, included in Jenkins 2.447 through 2.579 both inclusive, LTS 2.452.1 through 2.568.2 both inclusive, an HTTP endpoint serving dynamically generated JavaScript resources embeds the user's...

CVE-2026-84673: Improper Neutralization of Input During Web Page Generation

Jenkins Customizable Header Plugin 295.v2544bca19b97 and earlier allows overwriting the plugin's appearance configuration through Stapler data binding, allowing attackers to configure a custom SVG icon containing inline JavaScript, resulting in a stored cross-site scripting XSS vulnerability...

AppNitro MachForm 30 Cross Site Scripting

AppNitro MachForm version 30 suffers from a cross site scripting vulnerability. CVE-2026-78838 Description A reflected cross-site scripting XSS vulnerability in the griddatasource.php component of AppNitro MachForm v30 allows attackers to execute arbitrary Javascript in the context of the victim'...

CVE-2026-84665: Improper Neutralization of Input During Web Page Generation

Jenkins SonarQube Scanner Plugin 2.18.3 and earlier does not limit URL schemes for the dashboard links it creates based on SonarQube scanner results, allowing the javascript: scheme, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permissi...

Linux Distros Unpatched Vulnerability : CVE-2026-83616

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

Linux Distros Unpatched Vulnerability : CVE-2026-83609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg builder in...

Linux Distros Unpatched Vulnerability : CVE-2026-83611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and ...

PT-2026-84614

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

PT-2026-84613

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...

CVE-2026-19723: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-3850: Improper Neutralization of Input During Web Page Generation

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being rendered into...

Google Chrome Microsoft Edge DoS

The vulnerability of JavaScript script handlers in Google Chrome and Microsoft Edge browsers is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...

PT-2026-84642

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirect url parameter of the et pb contact form shortcode in all versions up to, and including, 4.27.6. This is due to the redirect url attribute being sanitized with esc attr instead of esc url before being render...

PT-2026-84666

Craft CMS versions from 5.0.0-RC1 before 5.10.11 contain a stored cross-site scripting vulnerability in the site name field that fails to sanitize input. Administrators can inject arbitrary JavaScript payloads in the site name that execute when other users view the control panel settings pages...