CVE-2026-85492 All in One SEO <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting via URL Pathname

The All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic Schema, Local SEO, Sitemap & SEO Insights plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via URL Pathname in all versions up to, and including, 5.0.1.1 due to insufficient input sanitization and output...

CVE-2026-85492

The All in One SEO plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.0.1.1 . The root cause is insufficient input sanitization and output escaping involving the URL Pathname . An unauthenticated attacker can inject arbitrary web scrip...

CVE-2026-59670

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “nomListaValidacion” parameter is affected – endpoint...

CVE-2026-59669

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

CVE-2026-59673

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) vulnerability. Specifically, the "nomTipoCli" parameter at the "/es/clientypes/update/109441" endpoint is affected. Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim...

CVE-2026-59671

The Repasat application is affected by a Cross-Site Scripting (XSS) vulnerability. The specific affected endpoint is “/es/datatables/getemployeetypesdatatable” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within the victim’s browser. No specific ...

EUVD-2026-91319

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

CVE-2026-59669

The Repasat application is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-79). The issue exists in the "name" parameter of the endpoint “/es/attachmenttypes/update/203336” . Successful exploitation could allow an attacker to trick a user into executing arbitrary code within their browser. N...

CVE-2026-59669 Multiple vulnerabilities in the Repasat application

Cross-Site Scripting vulnerability in the Repasat application. Successful exploitation of this vulnerability could allow an attacker to trick a user into executing arbitrary code in the victim’s browser. The “name” parameter is affected – endpoint “/es/attachmenttypes/update/203336”...

WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by neurotx in WordPress Plugin FiboSearch versions = 1.34.1...

CVE-2026-100182 Download Monitor <= 5.2.10 - Unauthenticated Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor

The Download Monitor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Cross-Origin postMessage to Admin Editor in all versions up to, and including, 5.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

WordPress WP Statistics plugin <= 14.16.14 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by b1ue0cean in WordPress Plugin WP Statistics versions = 14.16.14...

CVE-2026-93367

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

CVE-2026-93367 Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

CVE-2026-93367 Visitors Traffic Real Time Statistics Pro <= 11.22 - Unauthenticated Stored Cross-Site Scripting via ahcpro_track_visitor (page_title)

The Visitors Traffic Real Time Statistics Pro plugin for WordPress is vulnerable to unauthenticated stored Cross-Site Scripting in all versions up to, and including, 11.22 via the pagetitle parameter of the ahcprotrackvisitor AJAX action. The action is registered for logged-out callers...

CVE-2026-93367

The Visitors Traffic Real Time Statistics Pro plugin for WordPress (versions up to and including 11.22 ) is vulnerable to unauthenticated stored Cross-Site Scripting (XSS) . The root cause is the lack of sanitization on the page_title parameter within the ahcpro_track_visitor AJAX action, which i...

twitter-server Cross-Site Scripting

twitter-server before 20.12.0 is vulnerable to cross-site scripting in some configurations. The vulnerability exists in the administration panel of twitter-server in the histograms component via server/handler/HistogramQueryHandler.scala. id: CVE-2020-35774 info: name: twitter-server Cross-Site...

Zoho manageengine - Cross-Site Scripting

Zoho manageengine is vulnerable to reflected cross-site scripting. This impacts Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 via the...

SUSE CVE-2019-7621

Kibana versions before 6.8.6 and 7.5.1 contain a cross site scripting XSS flaw in the coordinate and region map visualizations. An attacker with the ability to create coordinate map visualizations could create a malicious visualization. If another Kibana user views that visualization or a dashboa...

EUVD-2026-91067

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in CWE-79 - Cross-site Scripting CAPEC-63 allows Cross-Site Scripting XSS. This issue affects CAPEC-63: before 3.0b63...