EUVD-2026-48273

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65904 DOMPurify through 3.3.3 Cross-Site Scripting via IN_PLACE mode

DOMPurify through 3.3.3 fails to sanitize DOM elements passed via INPLACE mode when the element originates from a different window/realm e.g., an iframe's contentDocument. A cross-realm instanceof check in the private isNode function returns false for foreign-realm nodes, causing DOMPurify to...

CVE-2026-65901

DOMPurify 3.4.6 has a cross-site scripting vulnerability in IN_PLACE mode where attacker-controlled nodeName on live non-form nodes can cause scripts to execute when the sanitized tree is inserted into a live document. Attackers can supply hostile live DOM objects with real script children whose ...

CVE-2026-65475 WordPress Modula Image Gallery plugin 2.14.25-2.14.30 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30...

CVE-2026-65605 SiYuan before v3.7.2 Stored XSS to RCE via Attribute View

SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View database cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced...

CVE-2026-65527

The CVE-2026-65527 entry covers a Cross Site Scripting (XSS) vulnerability in the WordPress LIQUID SPEECH BALLOON plugin, affected versions

CVE-2026-57384

CVE-2026-57384 describes a Cross Site Scripting (XSS) vulnerability in the WordPress WishList Member X plugin, affecting versions

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-15794 Grid/List View for WooCommerce <= 3.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'position' Shortcode Attribute

The Grid/List View for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'position' Shortcode Attribute in all versions up to, and including, 3.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

PT-2026-64179

Name of the Vulnerable Software and Affected Versions Cal.com versions prior to 4.7.16 Description Cross-site scripting XSS occurs on the publicly accessible single booking view endpoint '/booking/'. The application uses React's dangerouslySetInnerHTML to render booking question form field labels...

MiracleLinux 9 : php:8.3 (AXSA:2026-1333:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1333:01 advisory. PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions CVE-2026-7258 PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting...

PT-2026-63994

DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper...

CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

CVE-2026-64795

CVE-2026-64795 concerns Joomla extensions by Regular Labs. The issue is: XSS through tag-provided inputs (custom HTML, module/content/title overrides, and decoded modal/tooltip values) that could allow a content author to inject JavaScript executed in visitors’ browsers. Affected products are Reg...

n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact The Resource Locator passes the workflow-persisted cachedResultUrl to window.open without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. Patches The issue has been fixed in n8n versions...

GHSA-9WCP-9R3J-383Q n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

Impact The Resource Locator passes the workflow-persisted cachedResultUrl to window.open without scheme validation. When a victim opens the crafted workflow and interact with external links, the JavaScript payload runs in the victim's browser. Patches The issue has been fixed in n8n versions...

NPM: n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`

NPM: n8n: Stored DOM XSS via Resource Locator cachedResultUrl vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview

NPM: n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview vulnerability discovered by ? in WordPress Npm n8n versions 1.123.64...