ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

WordPress Visual Composer Website Builder plugin <= 45.16.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sungbyeongchan in WordPress Plugin Visual Composer Website Builder versions = 45.16.1...

CVE-2026-88058

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering SSR in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback...

EUVD-2026-75678

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for...

ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input

A flaw was found in ip-address, a JavaScript library for parsing and manipulating IPv4 and IPv6 addresses. This vulnerability allows a remote attacker to perform cross-site scripting XSS by providing untrusted input to the Address6 constructor. When an application renders the output of...

dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting XSS attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a .content. This oversight allows an attacke...

CVE-2026-84816

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-84819

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-81791

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

CVE-2026-81795

Unauthenticated Cross Site Scripting XSS in Page Visits Counter Lite = 1.2.3 versions...

CVE-2026-81782

Subscriber Cross Site Scripting XSS in WP Docs = 2.3.1 versions...

Security Bulletin: IBM i is Affected By Multiple Vulnerabilities in Navigator for i and Digital Certificate Manager for i.

Summary IBM Navigator for i and IBM Digital Certificate Manager DCM for i use Angular for frontend Graphical User Interfaces GUI. Angular is vulnerable to cross-site scripting XSS by permitting event-handler attributes in the i18n pipeline, allowing a lower-trust translation file to inject...

EUVD-2026-75534

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

EUVD-2026-75535

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-84819

Unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin WPAdverts affects versions ≤ 2.3.3 , as disclosed by researcher Ivaylo Atanassov via Patchstack. The flaw requires no authentication but does require user interaction, with a CVSS 3.1 score of 7.1 (HIGH) and changed ...

CVE-2026-84816

CVE-2026-84816 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress WPCS (Currency Switcher) plugin , affecting versions ≤ 1.3.2 . The flaw allows a remote, unauthenticated attacker to inject script via network access, requiring user interaction, with changed scope and ...

CVE-2026-84819 WordPress WPAdverts plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

CVE-2026-84816 WordPress WPCS plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-81795

CVE-2026-81795 affects the WordPress plugin Page Visits Counter – Lite in versions ≤ 1.2.3 , introducing an unauthenticated Cross Site Scripting (XSS) vulnerability. The flaw requires user interaction and has a CHANGED scope , meaning successful exploitation can impact the victim's browser sessio...