Lucene search
+L

11564 matches found

NVD
NVD
added 2026/09/04 10:17 a.m.5 views

CVE-2026-27086

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

6.5CVSS0.0013EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/04 9:22 a.m.24 views

CVE-2026-27086

CVE-2026-27086 affects the WordPress WoodMart theme by Xtemos , versions before 8.3.8 . The vulnerability is a DOM-Based Cross-Site Scripting (XSS) caused by improper neutralization of input during web page generation. The CVSS 3.1 score is 6.5 (Medium) , with a changed scope and low impact on co...

6.5CVSS5.2AI score0.0013EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/04 9:22 a.m.6 views

EUVD-2026-70980

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

6.5CVSS5.2AI score0.0013EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/04 9:22 a.m.37 views

CVE-2026-27086 WordPress WoodMart theme < 8.3.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Xtemos WoodMart allows DOM-Based XSS. This issue affects WoodMart: from n/a before 8.3.8...

6.5CVSS0.0013EPSS
SaveExploits0References1
BDU FSTEC
BDU FSTEC
added 2026/09/04 12:00 a.m.7 views

The vulnerability of the Element.setAttribute() method in the XML Document Access and Management Module XMLDOM allows a attacker to perform cross-site scripting (XSS) attacks.

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

7.8CVSS4.9AI score0.00348EPSS
SaveExploits0References9Affected Software3
WPVulnDB
WPVulnDB
added 2026/09/04 12:00 a.m.5 views

Divi < 4.27.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter

Description The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which onl...

6.4CVSS6AI score0.00165EPSS
SaveExploits0References1
BDU FSTEC
BDU FSTEC
added 2026/09/04 12:00 a.m.11 views

The vulnerability of the DOMHandler.startElement() method in the lib/dom-parser.js file of the XML document access and manipulation module XMLDOM allows a attacker to trigger a denial-of-service attack.

The vulnerability of the DOMHandler.startElement method in the lib/dom-parser.js file of the XML document access and manipulation module called XMLDOM is related to algorithmic complexity. Exploiting this vulnerability could allow a malicious actor to cause service failures remotely...

7.8CVSS5.3AI score0.00344EPSS
SaveExploits0References9Affected Software3
EUVD
EUVD
added 2026/09/03 9:19 p.m.19 views

EUVD-2026-52275

SiYuan: Full-content disclosure of publish-disabled documents via getHeadingTransaction endpoints publish mode: reader-reachable rendered DOM with no publish-access check...

9.2CVSS5.9AI score0.00245EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/03 8:18 p.m.25 views

CVE-2026-85061 MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes removes attributes from the same collection, shifting indexes and skipping an adjacent dangerous...

10CVSS5.7AI score
SaveExploits0References6
Github Security Blog
Github Security Blog
added 2026/09/03 7:52 p.m.11 views

Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

5.4CVSS5.8AI score0.00185EPSS
SaveExploits0References5Affected Software1
EUVD
EUVD
added 2026/09/03 7:52 p.m.11 views

EUVD-2026-57321

Material for MkDocs: DOM XSS in search suggestions via query parameter...

5.4CVSS5.8AI score0.00185EPSS
SaveExploits0References4
OSV
OSV
added 2026/09/03 7:52 p.m.10 views

GHSA-XVG9-69GF-FJRF Material for MkDocs: DOM XSS in search suggestions via query parameter

Impact Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scripting vulnerability in the optional search.suggest feature. A crafted q URL parameter could execute JavaScript in the documentation site's origin after user interaction. Patches The issue is fixed in Material for...

5.4CVSS5.8AI score0.00185EPSS
SaveExploits0References5
NVD
NVD
added 2026/09/03 5:17 p.m.9 views

CVE-2026-85302

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

6.5CVSS0.0013EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/03 4:42 p.m.9 views

EUVD-2026-70559

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

6.5CVSS5.9AI score0.0013EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/03 4:42 p.m.32 views

CVE-2026-85302 WordPress WPKoi Templates for Elementor plugin <= 3.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPKoi WordPress Themes WPKoi Templates for Elementor allows DOM-Based XSS. This issue affects WPKoi Templates for Elementor: from n/a through 3.7.2...

6.5CVSS0.0013EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:42 p.m.11 views

CVE-2026-85302

A DOM-Based XSS vulnerability exists in the WPKoi Templates for Elementor WordPress plugin, affecting versions from n/a through 3.7.2 . The flaw stems from improper neutralization of input during web page generation. Exploitation requires low privileges and user interaction , with a changed scope...

6.5CVSS5.9AI score0.0013EPSS
SaveExploits0References1
Positive Technologies
Positive Technologies
added 2026/09/03 12:00 a.m.14 views

PT-2026-85245

Name of the Vulnerable Software and Affected Versions MapLibre GL JS versions prior to 6.4.1 Description The DOM.sanitize function in src/util/dom.ts incorrectly iterates through elem.attributes as a live NamedNodeMap. Because removeAttributes modifies the same collection during iteration, indexe...

10CVSS5.8AI score0.00309EPSS
SaveExploits0References15
Github Security Blog
Github Security Blog
added 2026/09/02 2:38 p.m.9 views

Livewire DOM-based cross-site scripting during client-side state handling

Impact In Livewire v3 ≤ 3.8.2 and v4 ≤ 4.3.3, a vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the origin of an affected application in specific scenarios. The issue stems from how certain client-side component state is handled. This vulnerability does not affec...

5.1CVSS6AI score0.005EPSS
SaveExploits0References7Affected Software1
NVD
NVD
added 2026/09/02 6:17 a.m.7 views

CVE-2025-15664

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's before-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser ...

6.8CVSS0.0029EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/02 6:17 a.m.9 views

CVE-2025-15663

The Ultimate Before After Image Slider & Gallery WordPress plugin before 4.7.19 does not properly escape the slider's after-label value before its bundled client-side script re-injects it into the DOM, allowing users with the Author role and above to store a payload that executes in the browser o...

6.8CVSS0.0029EPSS
SaveExploits0References1
Rows per page
Query Builder