CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103588 QloApps through 1.7.0 Reflected XSS via exceptions field

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

CVE-2026-103588

QloApps versions through 1.7.0 are susceptible to a reflected cross-site scripting (XSS) vulnerability located in the exceptions field of the back-office Transplant a module form. An attacker can craft a malicious link containing a JavaScript payload within the exceptions parameter . If an authen...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587 QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

CVE-2026-103587

QloApps versions through 1.7.0 are vulnerable to a reflected cross-site scripting (XSS) flaw within the back-office Hotel Reservation System Book Now search functionality. The vulnerability occurs because the date_to and id_room_type parameters are copied into template variables without sufficien...

CVE-2026-103437

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-103437

The MediaWiki ReadingLists extension (versions 1.46 and 1.45 ) is vulnerable to a Reflected XSS flaw due to the improper neutralization of Script-Related HTML tags. This issue specifically allows JavaScript URL execution via imported metadata . The impact includes the potential for unauthorized s...

CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

EUVD-2026-90201

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-103437 ReadingLists imported metadata permits JavaScript URL XSS

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in The Wikimedia Foundation MediaWiki ReadingLists extension allows Reflected XSS. This issue affects MediaWiki ReadingLists extension: 1.46 and 1.45...

CVE-2026-97253

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-100507 WordPress If-So Dynamic Content Personalization plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in If-So Dynamic Content If-So Dynamic Content Personalization if-so allows Reflected XSS.This issue affects If-So Dynamic Content Personalization: from n/a through 1.10.1...

CVE-2026-97253 WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-97253

The Kreatura LayerSlider WordPress plugin (versions

EUVD-2026-89915

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

CVE-2026-97253 WordPress LayerSlider plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Kreatura LayerSlider allows Reflected XSS. This issue affects LayerSlider: from n/a through 8.4.0...

WordPress WPFunnels plugin <= 3.13.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Skalucy in WordPress Plugin WPFunnels versions = 3.13.1...