osTicket - Arbitrary File Read

Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. A remote attacker can submit a ticket containing crafted rich-text HTML that includes PHP filter expressions which are insufficientl...

CVE-2026-22849

CVE-2026-22849: Saleor lacks proper HTML sanitization in rich text fields Overview...

CVE-2026-88976

Plate (a rich-text editor with AI and shadcn/ui support) is vulnerable to a stored cross-site scripting (XSS) issue in its core HTML deserialization APIs. Prior to 53.3.11 , and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, supplied HTML strings are parsed in the active document...

CVE-2026-34212

CVE-2026-34212 Docmost accepted a javascript: URL inside an attachment node, preserved it through storage and rendering, and turned it back into a clickable anchor in the Docmost origin. Intro I identified, responsibly disclosed, and reproduced a High-severity stored XSS issue in Docmost , the...

CVE-2019-12836

CVE-2019-12836 Application JEditor v3.0.5 - WYSIWIG Editor for JIRA Simple yet powerful rich text editor for Jira. Import HTML emails, paste rich contents, create templates and prepopulate fields. Vendor of Product Bobronix Vendor Website http://bobronix.com/ CVE Reference...

CVE-2026-90561

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 are affected by a stored XSS in the content manager WYSIWYG preview component (PreviewWysiwyg.tsx). The component fails to strip [removed] tags from rich text, allowing an Author -role user to inject malicious scripts that execute when an E...

CVE-2026-90561 Strapi 4.x through 4.26.2 and 5.x before 5.48.1 Stored XSS via WYSIWYG

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

PT-2026-90832

Strapi versions 4.x through 4.26.2 and 5.x before 5.48.1 contain a stored cross-site scripting vulnerability in the content manager WYSIWYG preview component that fails to strip script tags from rich text. An Author-role user can store malicious script tags in rich text fields that execute in an...

Prototype Pollution

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Prototype Pollution via the mergeAttributes function. An attacker can inject malicious prototype properties by supplying crafted objects with a proto key, which can result in inherited...

CVE-2026-84701

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

EUVD-2026-69792

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701 NocoBase Rich Text Field Stored Cross-Site Scripting via API

NocoBase fails to sanitize rich text field values in the read renderer, allowing users with create permissions to store malicious HTML with event handlers. Attackers can write arbitrary markup through the collection API that executes in the browsers of all users viewing the affected record...

CVE-2026-84701

NocoBase is vulnerable to stored cross-site scripting (XSS) due to insufficient sanitization of rich text field values in the read renderer (specifically ReadPretty.tsx). An attacker with create permissions can inject arbitrary HTML with event handlers via the collection API, which then executes ...

WordPress Forminator Forms plugin <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability

Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field vulnerability discovered by daroo in WordPress Plugin Forminator versions = 1.57.0.1...

CVE-2026-18324

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324

Forminator Forms (a WordPress plugin for building contact, payment, and custom forms) is vulnerable to Stored Cross-Site Scripting (XSS) via its Rich-Text Textarea field in all versions up to and including 1.57.0.1 . The root cause is insufficient input sanitization and output escaping , allowing...

EUVD-2026-67405

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-18324 Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible...