EUVD-2026-86396

Mediawiki EmbedVideo Extension has stored XSS via malformed src url with $wgEmbedVideoRequireConsent disabled...

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

CVE-2026-81429

The Export & Import WPBakery Page Builder WordPress plugin through version 1.0.2 is affected by a CSRF to Stored XSS vulnerability discovered by Suhayb Ahmed (cyboltx). The plugin's template-import feature performs no CSRF check and fails to sanitise imported data before storing and echoing it ba...

EUVD-2026-76066

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the CustomizeUser plugin where the fieldname parameter is stored raw without sanitization. Administrators can inject malicious scripts via the add.json.php endpoint that execute...

CVE-2026-88867

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-88867

WWBN AVideo (up to commit c3edcc274c389816d434acadac07ee78eaf330c1 ) is affected by a stored cross-site scripting (XSS) vulnerability. The endpoint objects/categoryAddNew.json.php passes the POST parameters name and iconClass into Category::setName() and Category::setIconClass() without sanitizat...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-88867 WWBN AVideo Stored XSS via Category Name and Icon Class

WWBN AVideo, in versions up to and including commit c3edcc274c389816d434acadac07ee78eaf330c1, contains a stored cross-site scripting vulnerability. objects/categoryAddNew.json.php passes the POST parameters name and iconClass to Category::setName and Category::setIconClass, which store the values...

CVE-2026-84477 AVideo Stored XSS via Live Schedule Title Description

AVideo Liveschedule::setTitle and setDescription store POST input without sanitization, allowing users with streaming permission to inject malicious scripts. Unauthenticated attackers can access remindMe.php to execute stored XSS payloads in victim browsers without requiring authentication...

CVE-2026-82881 Aix-DB through 1.2.4 Stored Cross-Site Scripting via Markdown

Aix-DB through 1.2.4 renders markdown with raw HTML enabled into v-html bindings without sanitization, allowing stored cross-site scripting attacks. Attackers can inject malicious HTML and JavaScript through markdown content in chat responses, skill descriptions, or knowledge messages that execut...

CVE-2026-47665

Penpot , an open-source design and prototyping platform, is affected by a stored cross-site scripting vulnerability in versions up to and including 2.14.3 . Comment content on shared files is stored as raw text and rendered via innerHTML without sanitization; the backend applies only a length che...

CVE-2026-47665 Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML

Penpot is an open-source design and prototyping platform. In versions up to and including 2.14.3, Penpot is vulnerable to stored cross-site scripting through file comments, whose content is stored as raw text and rendered into the page with innerHTML without any sanitization. Because the backend...

Sakai Conversations has a Stored XSS Issue

Summary The Sakai Conversations tool stores topic and post messages without HTML sanitization, and the frontend renders them using LitElement's unsafeHTML directive, resulting in stored cross-site scripting XSS. Any authenticated user with access to a site that has the Conversations tool enabled...

CVE-2026-15002

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

CVE-2026-15002

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bmwoocommercecsseditorcontent' POST parameter. This is due to the CssEditor::handlesave method being wired to the WordPress 'init' hook by...

PT-2026-73087

The Platnosci Online Blue Media Autopay plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 5.0.0 via the 'bm woocommerce css editor content' POST parameter. This is due to the Css Editor::handle save method being wired to the WordPress 'init' hook ...

CVE-2026-72743

SQLBot 1.10.0 contains a stored XSS in the SQText dashboard component that renders TinyMCE output via v-html without sanitization. If an attacker can modify the dashboard text widget, they can inject arbitrary HTML/JavaScript that executes for all dashboard viewers. The issue is fixed in commit c...

CVE-2026-71286

The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input...

CVE-2026-71249: Improper Neutralization of Input During Web Page Generation

299Ko's public contact form plugin/contact/controllers/ContactController.php, home sets raw POST field values name, firstname, email, message into the page template with no sanitization. The template engine's variable output function common/Template.php, showvar echoes values with no...

CVE-2026-71286: Improper Neutralization of Special Elements Used in a Template Engine

The render-template component of ember-dynamic-render-template addon/components/render-template.js passes its property directly into Ember/Glimmer's compileTemplate from @ember/template-compilation with no sanitization, allow-listing, or validation of the input...