1045756 matches found
EUVD-2026-55664
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
CVE-2026-72725
Discourse (open‑source discussion platform) has a Stored XSS issue in the staff action log: prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields, enabling stored XSS in the staff interface. The vulnerability is fixed in versions 2026.1.6, 2026.5.2, 2026.6...
CVE-2026-72725 Discourse: Stored XSS in staff action logs injects staff UI
Discourse is an open-source discussion platform. Prior to 2026.1.6, the staff action log model rendered unescaped previous and new value fields that could inject stored cross-site scripting into the staff interface. The issue is fixed in 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0...
CVE-2026-72720
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
CVE-2026-72720
CVE-2026-72720 affects the Discourse open‑source forum platform. The issue is an HTML injection vulnerability in PrettyText.format_for_email where cooked attribute values are reparsed as markup, enabling decoded attribute text from crafted Vimeo iframe sources, secure-upload URLs or dimensions, a...
WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Freeform Page Builder, Website Builder & Customizer <= 6.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Freeform Page Builder, Website Builder & Customizer plugin = 6.2.0 - Freeform Page Builder, Website Builder & Customizer = 6.2.0 - Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Navapon Premkasem 71C4 71C4 in WordPress Plugin Kirki versions = 6.2.0...
CVE-2026-18478
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
CVE-2026-63105 ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting XSS vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue,...
CVE-2026-63105
ReadyEcommerce
CVE-2026-18478
Magnolia CMS is vulnerable to Stored XSS in import functionality. An attacker with editor privileges can inject arbitrary HTML and JS into the name of uploaded image, which will be rendered/executed when opening uploaded image. The issue was fixed in version 6.3.10...
WordPress WpBookingly plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin WpBookingly versions = 1.3.2...
WordPress SureDash plugin <= 1.10.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin SureDash versions = 1.10.1...
WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Asim Alshaya in WordPress Plugin Smart Online Order for Clover versions = 1.6.1...
CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload
A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...
CVE-2026-72594 lobehub lobe-chat - Stored Cross-Site Scripting via Unrestricted SVG Avatar Upload
A stored cross-site scripting XSS vulnerability in lobehub/lobe-chat through v2.2.13 allows a low-privileged authenticated user to inject arbitrary JavaScript into the application by uploading a crafted SVG file as a user avatar...
EUVD-2026-55223
A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...
CVE-2026-72583 fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload
A stored cross-site scripting XSS vulnerability in fastschema through v0.15.1 allows a low-privileged authenticated user to upload an SVG file containing malicious JavaScript by bypassing the MIME type allow-list check...
CVE-2026-72576 Bludit - Stored Cross-Site Scripting via Malicious SVG Logo Upload
A stored cross-site scripting XSS vulnerability in Bludit 4.0.0-beta allows a low-privileged authenticated user Author role to inject arbitrary JavaScript by uploading a crafted SVG file as the site logo. A stored script tag in the SVG executes in the browser of any user who loads the logo...
CVE-2026-72570
CVE-2026-72570 affects the project cube-root/directory-serve up to version 1.3.7. The vulnerability is a stored XSS : uploading a file with a crafted filename containing HTML attribute-breaking characters allows the attacker to inject arbitrary JavaScript into the web interface. The root cause is...
