CVE-2026-65946

Joomla Extension - rolandd.com - XSS vectors in AJAX endpoint handlers RO CSVI 9.11.0...

EUVD-2025-210531

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...

CVE-2026-59729 Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

Astro is a web framework for content-driven websites. Versions prior to 7.0.6 are vulnerable to XSS through unescaped spread attribute names in renderHTMLElement. The fix for CVE-2026-54298 GHSA-jrpj-wcv7-9fh9 added an INVALIDATTRNAMECHAR guard to addAttribute so that spread-prop attribute names...

CVE-2026-66475

CVE-2026-66475 affects the WordPress plugin “Checkout Field Editor for WooCommerce – Checkout Manager” up to version ≤ 3.0.5. The connected documents describe a Cross Site Scripting (XSS) vulnerability impacting shop manager workflows, but do not provide technical details about the root cause, af...

CVE-2026-65561

CVE-2026-65561 concerns the WordPress WordPress Social Login and Register plugin (versions

CVE-2026-65561 WordPress WordPress Social Login and Register plugin <= 7.8.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-59559 WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg = 1.5.1 versions...

CVE-2026-59559

The CVE concerns a Cross-Site Scripting (XSS) vulnerability in the WordPress plugin “RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg”, version

CVE-2026-17496 NoteGen chat preview XSS via unsanitized AI/skill HTML rendering

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...

GHSA-H8FP-F39C-Q6MH React Router: RSCErrorHandler Missing Protocol Validation (XSS)

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the unstable RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect...

React Router: RSCErrorHandler Missing Protocol Validation (XSS)

This is a follow up to https://github.com/remix-run/react-router/security/advisories/GHSA-8646-j5j9-6r62. React Router was alerted of a code path in the unstable RSC error handling path in which redirects from untrusted sources could still result in an XSS vector via attacker-supplied redirect...

Security Bulletin: The Network Threat Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Network Threat Analytics App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2024-5569 DESCRIPTION: A Denia...

Improper Check for Unusual or Exceptional Conditions

Overview dompurify is a DOM-only XSS sanitizer for HTML, MathML and SVG. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions in the INPLACE process when DOM elements are passed from a different window or realm, such as an iframe's...

CVE-2026-65901

DOMPurify 3.4.6 has a cross-site scripting vulnerability in IN_PLACE mode where attacker-controlled nodeName on live non-form nodes can cause scripts to execute when the sanitized tree is inserted into a live document. Attackers can supply hostile live DOM objects with real script children whose ...

CVE-2026-65527

The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions

CVE-2026-57384

CVE-2026-57384 describes a Cross Site Scripting (XSS) vulnerability in the WordPress WishList Member X plugin, affecting versions

GHSA-CJ75-F6XR-R4G7 Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...

CVE-2026-60028

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page...

CVE-2026-9833 Tag Groups < 2.2.0 - Reflected XSS via 'tag_groups_task' Parameter

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

PT-2026-61809

Name of the Vulnerable Software and Affected Versions Astro versions prior to 7.0.6 Description A cross-site scripting XSS issue exists when the software is used with an SSR runtime that exposes a global HTMLElement such as Deno, Bun with a DOM shim, or jsdom/happy-dom in Node and a class extendi...