CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Tipo de vulnerabilidad: Cross-Site Scripting XSS – XSS reflejado CWE: CWE-79 – Neutralización incorrecta de entrada durante la generación de páginas web 'Cross-site Scripting' Severidad: Alta CISA ADP CVSS v3.1: 7.1 Resumen CVE-2026-9833 afecta al plugin de...

CVE-2026-88824

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

EUVD-2026-80182

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-81926

Concrete CMS versions 9.4.0 through 9.5.2 contain a cross-site scripting (XSS) vulnerability in the location panel's duplicate-path confirmation dialog . When a page path collision occurs, the panel's check endpoint returns the submitted path unmodified in its JSON response, and client-side JavaS...

EUVD-2026-78089

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-85190

The Quick Index extension for Joomla (by regularlabs.com), versions prior to 5.0.5 , contains a privileged stored XSS vulnerability. The extension inserts configurable class values into generated HTML without escaping them for an HTML attribute context. A crafted value can close the intended clas...

PT-2026-91409

A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties vpn.data and vpn.secrets values unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN profile containing a...

PT-2026-90964

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web...

PT-2026-90581

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

EUVD-2026-75962

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

PT-2026-89781

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-78302

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

EUVD-2026-75390

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

CVE-2026-78302

SP Property (Joomla Extension by joomshaper.com) versions below 4.1.4 are affected by an unauthenticated Stored XSS vulnerability. Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping , allow...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...