CVE-2026-103527

Thelia v2.6.0 is vulnerable to reflected Cross-Site Scripting (XSS) due to improper escaping of double quotes in the “next” parameter within the Smarty templates (address.html and address-update.html ). An authenticated user can be tricked into visiting a malicious link containing attacker-contro...

EUVD-2026-97479

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

WordPress Marin theme <= 0.1.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Theme Marin versions = 0.1.1...

EulerOS 2.0 SP11 : xmlrpc-c (EulerOS-SA-2026-4387)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

CVE-2025-71432: Improper Neutralization of Input During Web Page Generation

Frappe ERPNext before 14.92.1 and 15.x before 15.83.0 contains a reflected cross-site scripting vulnerability due to missing input validation on a certain page, allowing arbitrary JavaScript to execute in authenticated sessions. Remote attackers can lure a logged-in user into opening a crafted UR...

CVE-2026-109327: Improper Neutralization of Input During Web Page Generation

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

EulerOS 2.0 SP13 : xmlrpc-c (EulerOS-SA-2026-4115)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

EulerOS 2.0 SP13 : xmlrpc-c (EulerOS-SA-2026-4206)

According to the versions of the xmlrpc-c packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page...

TencentOS Server 3: xmlrpc-c (TSSA-2026:1119)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1119 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:...

PT-2026-110613

Name of the Vulnerable Software and Affected Versions Thelia version 2.6.0 Description Reflected Cross-Site Scripting XSS occurs because Smarty templates address.html and address-update.html do not properly escape double quotes in the next parameter. This allows an attacker to execute arbitrary...

CVE-2026-103527: Improper Neutralization of Input During Web Page Generation

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

CVE-2026-91829

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

EUVD-2026-96793

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

CVE-2026-91829 Subscribe to Comments < 2.3.3 - Reflected XSS via 'ref' Parameter

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

CVE-2026-91829

The Subscribe to Comments WordPress plugin (versions before 2.3.3 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to properly validate a parameter—specifically identified in some records as the 'ref' parameter —before reflecting it into a link target. This al...

reflector

reflector Descripción La extensión de Burp Suite es capaz de encontrar XSS reflejado en la página en tiempo real mientras se navega por el sitio web e incluye algunas características como: Resaltado de la reflexión en la pestaña de respuesta. Prueba de qué símbolos están permitidos en esta...

CVE-2026-91829: Improper Neutralization of Input During Web Page Generation

The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who clicks it, including administrators...

CVE-2026-57742

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...

CVE-2026-57742

The Kids Planet WordPress theme (versions n/a through 2.2.14.2 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79) within the ThemeREX Group theme. This flaw allows an attacker to refle...

EUVD-2026-96424

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeREX Group Kids Planet allows Reflected XSS. This issue affects Kids Planet: from n/a through 2.2.14.2...