CVE-2026-88261

Improper input validation vulnerability in bizwell xClick allows Stored XSS. This issue affects xClick: R2, R3, and R3.1...

CVE-2026-85575

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin (versions up to and including 4.9.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the shopengine_product_title_header_size parameter, caused by insufficient input sanitization and output escaping . Authenticated attack...

CVE-2026-85657

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.15.0 . The flaw resides in the Co-Authors, Multiple Authors, and Guest Authors Author Box functionality, where the profile_fields_user_email_value_prefix paramete...

EUVD-2026-78205

Concrete CMS before 9.5.3 applied only trim to the YouTube block's stored width and height values and printed them into iframe HTML attributes without escaping or integer casting, resulting in stored cross-site scripting. A user with editblock permission could inject an event handler that execute...

EUVD-2026-78202

Concrete CMS 8.3.0 to 9.5.2 stored calendar event names without sanitization and rendered them without HTML escaping in the workflow approval and deletion notifications shown in the dashboard "Waiting For Me" block. A registered user permitted to add events to a calendar governed by an approval...

EUVD-2026-78161

Concrete CMS 9.0.0 through 9.5.3 is vulnerable to stored XSS via the custom page alias name customAliasName because the Edit Alias dialog applied only trim to the submitted value and performed no input neutralization. An authenticated user holding canWrite editor permission on a page could store ...

PT-2026-91775

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profile fields user email value prefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input...

PT-2026-91774

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine product title header size’ parameter in all versions up to, and including, 4.9.5 due to...

CVE-2026-81900

Concrete CMS before 9.5.3 is affected by a stored cross-site scripting vulnerability in the YouTube block (vWidth/vHeight). The root cause is that only trim() was applied to the stored width and height values before printing them into iframe HTML attributes , without escaping or integer casting. ...

CVE-2026-18116

Concrete CMS versions 8.3.0 through 9.5.2 are affected by a Stored XSS in calendar event names. Event names were stored without sanitization and rendered without HTML escaping in the workflow approval/deletion notifications within the dashboard "Waiting For Me" block. A registered user with permi...

CVE-2026-18117

Concrete CMS 9.0.0 through 9.5.3 contains a stored XSS vulnerability in the custom page alias name (customAliasName) field. The root cause is that the Edit Alias dialog applied only trim() to the submitted value without performing input neutralization. An authenticated user with canWrite (editor)...

CVE-2026-7884

IBM Cognos Analytics (versions 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2) is vulnerable to a stored cross-site scripting (CWE-79) in the user account management panel. A non-privileged user can inject malicious JavaScript into their given name and surname fields; when an administra...

EUVD-2026-78138

IBM Cognos Analytics 12.1.0 through 12.1.3 FP1, and 12.0.4 through 12.0.4 FP2 allows a non-privileged user to edit their given name and surname to include malicious JavaScript code. When an administrator later accesses the user account management panel and views that user's permissions, the...

EUVD-2026-78089

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-81901

Concrete CMS versions 9.2.0 through 9.5.2 are affected by a stored cross-site scripting (XSS) vulnerability in the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID} ). The endpoint did not enforce page-property, page-template, or page-type authorization, allowing a user with only conten...

EUVD-2026-78076

Concrete CMS versions 9.0.0 to 9.5.2 stored the Page Container icon value submitted through the dashboard without validating it against the set of known container icons. The unvalidated value was later concatenated into the src attribute of an img tag by a helper that did not encode attribute...

CVE-2026-81903

Concrete CMS versions 9.0.0 to 9.5.2 are affected by a stored XSS in the Page Container icon field. The unvalidated icon value was concatenated into the src attribute of an tag by a helper that did not encode attribute output, allowing a user with delegated access to the Page Containers dashboar...

CVE-2026-18119

Concrete CMS versions below 9.5.3 are vulnerable to a stored cross-site scripting (XSS) flaw. The root cause is unsanitized custom style values in the Block Design dialog that are written into page CSS via a DOM sink . An editor-level user can inject a payload that executes script in an administr...

EUVD-2026-77805

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...

CVE-2026-18119 Concrete CMS below 9.5.3 is vulnerable to Stored XSS via unsanitized inline block custom style values

Concrete CMS below 9.5.3 did not sanitize custom style values in the Block Design dialog before writing them into page CSS via a DOM sink, permitting stored cross-site scripting. An editor-level user could execute script in an administrator's session and escalate privileges. The Concrete CMS...