EUVD-2026-50421

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

CVE-2026-54705

This CVE concerns MathLive web components (pre-0.110.0) where text-mode content in parts of Box.toMarkup (src/core/box.ts), xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, as well as through convertLatexToMarkup, convertLatexToMathMl, , , and the default identity Math...

CVE-2026-54705 mathlive's Lack of Escaping of HTML allows for XSS

MathLive provides web components for math display and input. Prior to 0.110.0, MathLive fails to escape text-mode content in \text and \mbox commands in Box.toMarkup at src/core/box.ts, in xmlEscape, scanText, and text-mode output in src/formats/atom-to-math-ml.ts, and through convertLatexToMarku...

GHSA-996F-334J-67G7 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the public bookingmessage view without escaping or...

EUVD-2026-43705

Easy!Appointments disablebookingmessage rendered as raw HTML on public booking page — Stored XSS...

CVE-2026-66490

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

EUVD-2026-50333

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

CVE-2026-66490

The Joomla Extension - balbooa.com (specifically Gridbox ) is vulnerable to Stored Cross-Site Scripting (XSS) in versions prior to 2.20.2 . The vulnerability is triggered via a comment avatar , where improper neutralization of input during web page generation allows an attacker to execute malicio...

CVE-2026-66490 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

CVE-2026-66490

Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...

laravel-threat-detection v1.6.1

Laravel Threat Detection Passive intrusion detection for Laravel — see every SQL injection, XSS, scanner, and bot probe hitting your app, logged with full context. It's an IDS, not a WAF: it never blocks, filters, or modifies a request. Drop it into any Laravel 10–13 app and it starts scanning...

EUVD-2026-50307

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

CVE-2026-65946 Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI < 9.11.0

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Ultimate Addons for Elementor versions = 1.45.2...

WordPress WP Compress plugin < 7.10.04 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Lubin Regnault in WordPress Plugin WP Compress versions 7.10.04...

Cross-site Scripting

nice-select2 is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper sanitization of content rendered from the element, allowing attackers to inject malicious payloads that are executed in a victim's browser when they view or interact with the affected page...

WordPress MPG plugin < 4.1.8 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by João Ramos Maciel in WordPress Plugin MPG versions 4.1.8...

Security Bulletin: IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by multiple vulnerabilities (CVE-2026-11712, CVE-2026-11595, CVE-2026-11708)

Summary IBM WebSphere Application Server shipped with IBM Tivoli System Automation Application Manager is affected by cross-sight scripting and path traversal vulnerabilities. Vulnerability Details CVEID:CVE-2026-11712 DESCRIPTION: IBM WebSphere Application Server 9.0, and 8.5 is affected by a...

CVE-2026-7436

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...