CVE-2026-112951

The ApostropheCMS Node.js content management system is vulnerable to stored XSS in versions prior to 4.34.0 . The root cause is a validation bypass in the color field, where TinyColor validation fails to require the entire value to match a color. This allows an authenticated user with edit rights...

CVE-2026-52307

CVE-2026-52307: 1CMS v5.6 Authenticated Stored XSS Vulnerability Introduction This repository contains the reproduction of CVE-2026-52307 , an authenticated stored cross-site scripting XSS vulnerability discovered in 1CMS v5.6 formerly ClassCMS. A proof-of-concept PoC is provided to demonstrate t...

CVE-2022-4556

CVE-2022-4556 - Stored XSS in SOGo Webmail v5.7.1 🧠 Summary A Stored Cross-Site Scripting XSS vulnerability was discovered in the fullName field of the Identity Preferences section in the SOGo web interface , affecting version 5.7.1. An authenticated attacker could inject a malicious script that...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112833

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

CVE-2026-111843

The CozyThemes Rootblox WordPress plugin is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 1.0.7 . An attacker could potentially execute malicious scripts in the contex...

EUVD-2026-105139

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7...

CVE-2026-111843 WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CozyThemes Rootblox rootblox allows Stored XSS.This issue affects Rootblox: from n/a through 1.0.7...

WordPress Rootblox plugin <= 1.0.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Peter Tang in WordPress Plugin Rootblox versions = 1.0.7...

EUVD-2026-105137

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112840 WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.9.5...

CVE-2026-112840

The WordPress SureCart plugin (versions through 4.9.5 ) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the improper neutralization of input during web page generation . This flaw allows an attacker to inject malicious scripts into the application. No specifi...

WordPress SureCart plugin <= 4.9.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin SureCart versions = 4.9.5...

CVE-2026-112945

Vite is a frontend tooling framework for JavaScript. Prior to 6.4.4, 7.3.7, 8.1.6, 8.2.4, and 8.3.3, applications using custom middleware are vulnerable when they pass an unchanged browser request URL to server.transformIndexHtml. getHtmlFilename uses the query-bearing request URL to resolve an...

CVE-2026-112833 WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

EUVD-2026-105038

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

CVE-2026-112833

The Castos Seriously Simple Podcasting plugin for WordPress (versions n/a through 3.17.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) . This vulnerability stems from the improper neutralization of input during web page generation. An attacker could potentially execute malicious scripts in...

WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Deva Parekh in WordPress Plugin Seriously Simple Podcasting versions = 3.17.0...

CVE-2024-42009-roundcube-xss

CVE-2024-42009 — Roundcube Webmail 1.6.6 Stored XSS PoC For authorised security testing, CTF environments, and educational research only. Using this tool against systems you do not own or have written permission to test is illegal under the Computer Misuse Act 1990 UK, the CFAA US, and equivalent...

CVE-2021-40492

CVE-2021-40492 CVE-2021-40492 Gibbon version 22 Reflected Cross Site Scripting XSS Vulnerabilities. https://vulners.com/cve/CVE-2021-40492 A reflected Cross Site Scripting vulnerability exists in multiple pages in version 22 of the Gibbon education application that allows for arbitrary execution ...