CVE-2026-18986

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...

EUVD-2026-69994

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Entity Browser allows Stored XSS. This issue affects Entity Browser versions: from 0.0.0 to 2.16.0...

CVE-2026-18986

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Drupal Entity Browser contrib module (versions 0.0.0 through 2.16.0 ). The root cause is insufficient sanitization of tab titles , allowing an attacker with sufficient privileges to inject malicious HTML with specific attributes on a...

CVE-2026-81167

Drupal Address Suggestion (a contributed module providing address autocomplete via configured providers) is affected by a cross-site scripting (XSS) vulnerability in versions 0.0.0 through 1.0.25 . The module fails to sufficiently sanitize address suggestion data returned by configured providers....

EUVD-2026-70008

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-81167 Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-81201 Monster Menus - Moderately critical - Cross-site Scripting - SA-CONTRIB-2026-116

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

CVE-2026-81201

Drupal Monster Menus (a contrib module for creating multisite page structures with granular permissions) is affected by a Stored XSS vulnerability in versions 0.0.0 through 9.5.3. The root cause is insufficient sanitization of HTML code in page names when rendered in the module's built-in tree br...

CVE-2026-81160

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Slick UI sub-module of the Drupal Slick Carousel contrib module. The root cause is insufficient validation of user input within Slick option sets that may contain HTML for carousel buttons, allowing attackers to inject malicious scri...

EUVD-2026-69996

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

CVE-2026-82883

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

EUVD-2026-69887

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-76986

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.form.AbstractSingleSelectChoice, the base class of DropDownChoice, writes the body of the default option — the entry shown when no choice is selected — into the markup as it is, while every...

CVE-2026-76983 Apache Wicket: XSS in AutoLabelTextResolver via FormComponent.setLabel

Improper neutralization of input during web page generation in Apache Wicket. The tag is provided by org.apache.wicket.markup.html.form.AutoLabelTextResolver, which is registered by default in every WebApplication. The resolver writes the label it finds into the markup as it is, and reads no...

CVE-2026-81760

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEngine: from n/a through 3.8.14.2...

CVE-2026-5800

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows Reflected XSS. This issue affects E-Commerce Platform: through 28082026. NOTE: The vendor was contacted early about this disclosu...

CVE-2026-5953

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. This issue affects Web Design: through 25082026...

CVE-2026-4378

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 before 4.6.001...

EUVD-2026-67740

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Stored XSS. This issue affects E-Commerce Pack: from 4.5.001 through 28082026. NOTE: The vendor was contacted early about this...

CVE-2026-4378

A Stored Cross-Site Scripting (XSS) vulnerability in Akilli Ticaret Software Technologies Ltd. 's E-Commerce Pack (versions 4.5.001 through 28082026) is caused by improper neutralization of input during web page generation . The CVSS 3.1 score is 5.4 (MEDIUM) with a changed scope, indicating a lo...