CVE-2025-51684

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2025-51684

CVE-2025-51684 affects CleverTap Web SDK v1.15.1. The issue is a Cross Site Scripting (XSS) weakness where untrusted data received via window.postMessage is not sanitized before injecting into the DOM by renderCustomHtml, enabling arbitrary JavaScript execution in the hosting site context. Exploi...

PT-2026-66576

Name of the Vulnerable Software and Affected Versions CleverTap Web SDK version 1.15.1 Description Cross Site Scripting XSS occurs because the application fails to sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious...

EUVD-2025-210564

CleverTap Web SDK v1.15.1 is vulnerable to Cross Site Scripting XSS. The application does not sanitize untrusted data received via window.postMessage before injecting it into the page DOM. An attacker can craft a malicious message that, when processed by renderCustomHtml, results in execution of...

CVE-2026-64795

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

CVE-2026-64795

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

EUVD-2026-47808

Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers...

PT-2026-63506

Name of the Vulnerable Software and Affected Versions Regular Labs extensions affected versions not specified Description Cross-site scripting XSS is possible through tag-provided custom HTML, module content or title overrides, and decoded modal or tooltip values. This allows a content author to...

ClickFix Server

This creates a Web Server which hosts a ClickFix type exploit. When a user visits the site they are given instructions on pasting our payload into a run dialog. When using a custom html page, please use INSERTPAYLOADHERE as the spot to put the generated payload in. Module Options msf use...

CVE-2026-2300 BJ Lazy Load <= 1.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom HTML Block

The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the filterimages function in all versions up to, and including, 1.0.9. This is due to the use of regex-based HTML processing pregreplace that does not properly handle HTML attribute boundaries when replacing sr...

CVE-2026-4805 Woostify <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lity.js Library via data-lity Attribute in Custom HTML Block

The Woostify plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.5.0 This is due to insufficient input sanitization and output escaping in the bundled Lity.js lightbox library, where user-controlled input from the href attribute is concatenated...

Cross-site Scripting (XSS)

Overview clevertap-web-sdk is a Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handleCustomHtmlPreviewPostMessageEvent function due to insufficient origin validation using the includes method. An attacker can execute arbitrary scripts in the context of the...

CVE-2026-3041

The vulnerability CVE-2026-3041 affects BaykeShop (up to version 1.3.20), specifically the Article Sidebar Module’s file at src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html. The issue arises from a manipulation of the argument sidebar.content in the Article Sidebar Module, en...

CVE-2026-3041 xingfuggz BaykeShop Article Sidebar custom.html cross site scripting

A security vulnerability has been detected in xingfuggz BaykeShop up to 1.3.20. Impacted is an unknown function of the file src/baykeshop/contrib/article/templates/baykeshop/sidebar/custom.html of the component Article Sidebar Module. Such manipulation of the argument sidebar.content leads to cro...

EUVD-2021-25584

Malware in sbrugna...

Linux Distros Unpatched Vulnerability : CVE-2021-39202

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets edito...

CVE-2018-15530

Cross-site scripting XSS in the web interface of the Xerox ColorQube 8580 allows remote persistent injection of custom HTML / JavaScript code...

CVE-2024-11188

The Formidable Forms – Contact Form Plugin, Survey, Quiz, Payment, Calculator Form & Custom Form Builder plugin for WordPress is vulnerable to POST-Based Reflected Cross-Site Scripting via the Custom HTML Form parameters in all versions up to, and including, 6.16.1.2 due to insufficient input...

WordPress Formidable Forms plugin <= 6.16.1.2 - Reflected Cross-Site Scripting via Custom HTML Form Parameter vulnerability

Reflected Cross-Site Scripting via Custom HTML Form Parameter vulnerability discovered by mikemyers in WordPress Plugin Formidable Forms versions = 6.16.1.2...

BIT-WORDPRESS-2021-39202

WordPress is a free and open-source content management system written in PHP and paired with a MySQL or MariaDB database. In affected versions the widgets editor introduced in WordPress 5.8 beta 1 has improper handling of HTML input in the Custom HTML feature. This leads to stored XSS in the cust...