CVE-2026-17797

Google Chrome versions prior to 151.0.7922.72 are affected by a vulnerability involving an inappropriate implementation in CSS . This flaw allows a remote attacker to inject arbitrary scripts or HTML, resulting in a User Experience Scripting (UXSS) attack, via a crafted HTML page. The vulnerabili...

EUVD-2026-50746

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17797

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17761

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via malicious network traffic. Chromium security severity: Medium...

CVE-2026-17734

Inappropriate implementation in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66368

The Fluent Forms WordPress plugin before 6.2.6 does not sanitise and escape one of its form field configuration settings before outputting it inside an inline script when a form is rendered, which could allow users with a role as low as Contributor with delegated form-management permission, and...

PT-2026-66374

The Animation Addons for Elementor WordPress plugin before 2.7.0 does not sanitise uploaded SVG/SVGZ files, which it adds to the list of allowed upload types, allowing users with the upload files capability Author and above to upload files containing malicious JavaScript, leading to Stored...

PT-2026-66448

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...

PT-2026-66478

Name of the Vulnerable Software and Affected Versions IBM Sterling B2B Integrator versions 6.2.2.0 through 6.2.2.0 1 IBM Sterling File Gateway versions 6.2.2.0 through 6.2.2.0 1 Description An authenticated user can embed arbitrary JavaScript code in the Web UI. This cross-site scripting issue...

PT-2026-66533

Name of the Vulnerable Software and Affected Versions IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.7.2.1 through 9.7.2.11 IBM Engineering Requirements Management DOORS and DOORS Web Access versions 9.6.1.1 through 9.6.1.13 Description An issue exists where an...

CVE-2025-51684

The CleverTap Web SDK (version 1.15.1 ) is vulnerable to Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. Specifically, the renderCustomHtml() function in src/util/campaignRender/nativeDisplay.js fails to sanitize untrusted data received via window.po...

CVE-2025-65341

Ecommerce Fruits Bazar version 1.0 is vulnerable to Cross-Site Scripting (XSS) within the admin/edit_product.php endpoint. This flaw allows an attacker to inject malicious scripts into web pages viewed by other users. No specific remediation or patch information is currently available in the prov...

CVE-2025-65342

The code-projects Blood System 1.0 is vulnerable to Cross-Site Scripting (XSS) . The flaw exists in the /don.php page, specifically when processing the city field due to improper neutralization of input during web page generation. While technical details regarding the root cause and remediation a...

WordPress plugin Appointment Hour Booking cross-site scripting vulnerability

WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be installed to enhance functionality of the platform. The Appointment Hour Booking plugi...

PT-2026-66576

Name of the Vulnerable Software and Affected Versions CleverTap Web SDK version 1.15.1 Description Cross Site Scripting XSS occurs because the application fails to sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious...

PT-2026-66445

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CVE-2025-65341: Improper Neutralization of Input During Web Page Generation

Ecommerce Fruits Bazar 1.0 is vulnerable to Cross Site Scripting XSS in admin/editproduct.php...

CVE-2025-0152: Improper Neutralization of Input During Web Page Generation

IBM Engineering Requirements Management DOORS and DOORS Web Access 9.7.2.1 through 9.7.2.11, and 9.6.1.1 through 9.6.1.13 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended...

CVE-2025-36431: Improper Neutralization of Input During Web Page Generation

IBM Sterling B2B Integrator 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.2.0 through 6.2.2.01 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

CVE-2026-13344: Improper Neutralization of Input During Web Page Generation

The Essential Addons for Elementor WordPress plugin before 6.6.10 does not validate the HTML tag name of the Pricing Table widget title before outputting it, allowing users with Contributor-level access and above to inject JavaScript that will be executed Stored Cross-Site Scripting when the page...