CVE-2026-84437 OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

CVE-2026-84437

A cross-site scripting (XSS) vulnerability affects OpenCart 4.1.0.3 and 4.1.0.4 , specifically in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Manipulating the address_1 argument allows a remote, authenticated (low-privilege) attacker to inject scrip...

CVE-2026-84437 OpenCart Autocomplete Workflow address.php cross site scripting

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

SUSE CVE-2026-83607

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElementtagName stores an unvalidated element name and XMLSerializer.serializeToString...

CVE-2026-84695 BookStack before 26.05.4 Stored XSS via Drawing Upload

BookStack before 26.05.4 contains a stored cross-site scripting vulnerability in the drawing upload endpoint that accepts unvalidated base64 content and stores it without content inspection. Attackers with editor permissions can upload SVG files containing scripts that execute in administrator...

CVE-2026-83562: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-84781: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

CVE-2026-81288: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

PT-2026-84689

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

PT-2026-84690

Name of the Vulnerable Software and Affected Versions TrustedSite versions prior to 1.2.6 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update TrustedSite to a version...

CVE-2026-82884: Improper Neutralization of Input During Web Page Generation

The All in One SEO WordPress plugin before 5.0.0.1 does not sanitise and escape some content stored in posts before rendering it back in the post editor, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks that trigger when a higher privilege...

PT-2026-84585

Name of the Vulnerable Software and Affected Versions OpenCart versions 4.1.0.3 through 4.1.0.4 Description An issue exists in the Autocomplete Workflow component within the file catalog/controller/account/address.php. Remote manipulation of the address 1 argument allows for cross site scripting,...

PT-2026-84705

Name of the Vulnerable Software and Affected Versions Gallery PhotoBlocks versions prior to 1.3.5 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update Gallery PhotoBlocks to version...

PT-2026-84591

A vulnerability was determined in OpenCart 4.1.0.3/4.1.0.4. This affects an unknown function of the file catalog/controller/account/edit.php of the component Autocomplete Workflow. This manipulation of the argument firstname causes cross site scripting. The attack can be initiated remotely. The...

PT-2026-84643

Name of the Vulnerable Software and Affected Versions Login With Ajax versions prior to 4.5.2 Description Improper Neutralization of Input During Web Page Generation leads to a Reflected Cross-site Scripting XSS issue. This occurs when an application includes untrusted data in a web page without...

CVE-2026-84437: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in OpenCart 4.1.0.3/4.1.0.4. The impacted element is an unknown function of the file catalog/controller/account/address.php of the component Autocomplete Workflow. The manipulation of the argument address1 results in cross site scripting. It is possible to launch the...

PT-2026-84695

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

PT-2026-84693

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-83547: Improper Neutralization of Input During Web Page Generation

The Xpro Addons WordPress plugin before 1.7.4 does not properly escape some of its widgets' settings before outputting them within HTML attributes, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19719: Improper Neutralization of Input During Web Page Generation

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not escape the post title before outputting it in an inline JavaScript event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks which are triggered when...