PT-2026-104283

YesWiki before 4.5.3 contains multiple reflected cross-site scripting vulnerabilities that allow remote attackers to inject JavaScript through unsanitized parameters such as incomingurl, id, file, tags, and template. Attackers can lure authenticated or unauthenticated users into opening crafted...

MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

SummaryThe OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

PYSEC-2026-4093 MCP Atlassian: Reflected XSS in OAuth Setup Callback Handler

Summary The OAuth 2.0 setup wizard's local callback HTTP server reflects the error query parameter directly into an HTML response without any sanitization or encoding. An attacker can craft a malicious callback URL containing JavaScript in the error parameter that executes in the victim's browser...

WordPress Five Star Restaurant Reviews plugin < 2.3.14 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by V1T in WordPress Plugin Five Star Restaurant Reviews versions 2.3.14...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.3...

BIT-RABBITMQ-2026-67237 RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint

RabbitMQ is a messaging and streaming broker. From 4.2.0 until 4.2.8 and 4.3.2, settokenauth/2 inserted a bearer token from the Authorization header or accesstoken cookie into OAuth bootstrap JavaScript without escaping, allowing attacker-controlled token content to execute JavaScript in the...

CVE-2026-89427

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-103664

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103662

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

EUVD-2026-90578

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664 MISP Reflected Cross-Site Scripting via Unsanitized Analyst Data Seed Parameter

MISP contains a reflected cross-site scripting XSS vulnerability in the analyst data notes panel. The seed path parameter, supplied by the user via the URL, was passed directly into inline JavaScript within the rendered HTML response without any sanitization or type enforcement. An attacker who c...

CVE-2026-103664

MISP is vulnerable to reflected cross-site scripting (XSS) in the analyst data notes panel. The root cause is the lack of sanitization or type enforcement on the seed path parameter supplied via the URL, which is passed directly into inline JavaScript within the HTML response. An authenticated at...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

EUVD-2026-90577

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-103662

A reflected cross-site scripting (XSS) vulnerability exists in the MISP legacy taxonomy tag management confirmation forms (specifically the add tag and disable tag forms). The flaw is caused by the application echoing a user-supplied tag name value from the request into the rendered HTML output w...

CVE-2026-103662 MISP Reflected XSS in Taxonomy Tag Confirmation Forms

MISP contains a reflected cross-site scripting XSS vulnerability in the legacy taxonomy tag management confirmation forms add tag and disable tag. The affected forms echoed a user-supplied tag name value from the request unescaped into the rendered HTML output. An attacker who can induce a site...

CVE-2026-89427

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.8.18 . The root cause is insufficient input sanitization and output escaping of the 's' Search Parameter . An unauthenticated attacker can inject...

CVE-2026-89427 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...