1124601 matches found
EUVD-2026-49329
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescaped style attribute interpolation. Attackers with editor permissions can inject onload handlers that execute arbitrary...
CVE-2026-66394
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...
CVE-2026-66394 SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...
CVE-2026-66394
Affected software: SiYuan prior to v3.7.3. Vulnerability: stored and reflected XSS via SVG sanitization bypassing the HTML parser-based cleaner, allowing authenticated attackers to run scripts. Trigger/context: scripts can be executed in the application origin when served as image/svg+xml by hidi...
EUVD-2026-49327
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...
CVE-2026-66394 SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...
CVE-2026-66394 SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the HTML parser-based cleaner. Attackers can hide script tags within desc, style, or noscript elements which the HTML...
CVE-2026-66448
Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...
CVE-2026-66475
Shop manager Cross Site Scripting XSS in Checkout Field Editor for WooCommerce Checkout Manager = 3.0.5 versions...
CVE-2026-66445
Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...
CVE-2026-66433
Contributor Cross Site Scripting XSS in Location Weather = 3.0.6 versions...
CVE-2026-65562
Contributor Cross Site Scripting XSS in BetterDocs = 4.6.2 versions...
CVE-2026-65557
Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...
CVE-2026-65561
Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...
CVE-2026-65563
Author Cross Site Scripting XSS in Orbit Fox by ThemeIsle = 3.0.7 versions...
CVE-2026-59559
Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...
CVE-2026-59556
Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...
CVE-2026-59553
Unauthenticated Cross Site Scripting XSS in Product Feed Manager = 7.6.1 versions...