CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587

QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) flaw within the back-office Hotel Reservation System Book Now search functionality. The vulnerability occurs because the date_to and id_room_type parameters are copied into template variables without sufficien...

CVE-2026-103437

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-103437

The MediaWiki ReadingLists extension (versions 1.46 and 1.45 ) is vulnerable to a Reflected XSS flaw due to the improper neutralization of Script-Related HTML tags. This issue specifically allows JavaScript URL execution via imported metadata . The impact includes the potential for unauthorized s...

CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

EUVD-2026-90201

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-97253

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1...

CVE-2026-97253 WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-97253 WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

EUVD-2026-89915

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-97253

The Kreatura LayerSlider WordPress plugin (versions

WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Skalucy in WordPress Plugin WPFunnels versions = 3.13.1...

Browser-Extension-Included-SVM-in-XSS

XSS Guard ML Browser extension Manifest V3 phát hiện Reflecte...

CVE-2026-102459

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...

Lab-Reflected-XSS-with-some-SVG-markup-allowed-PRACTITIONER-LAB-Not-solved

Lab: Reflected XSS with some SVG markup allowed 📚 Studijní...

CVE-2026-102459

The EasyFlow .NET software developed by Digiwin is vulnerable to a Reflected Cross-site Scripting (XSS) vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript code within a user's browser by leveraging phishing attacks . No specific technical root cause, affected version...

EUVD-2026-89715

EasyFlow .NET developed by Digiwin has a Reflected Cross-site Scripting vulnerability. Unauthenticated remote attackers can execute arbitrary JavaScript codes in user's browser through phishing attacks...