CVE-2026-39200

CVE-2026-39200 — Reflected Cross-Site Scripting XSS in Toko Online RotI Summary A reflected Cross-Site Scripting XSS vulnerability was identified in the produk request parameter of the Toko Online RotI web application. The application fails to HTML-encode user-supplied input before reflecting it...

CVE-2026-111021 Persian WooCommerce SMS 7.2.0 - 7.3.1 - Reflected XSS via 'pwsms_mobiles' Parameter

The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a parameter before reflecting it back into an HTML attribute, leading to Reflected Cross-Site Scripting that is executed in the browser session of a logged-in privileged user who is trick...

CVE-2026-102786

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...

EUVD-2026-109070

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...

CVE-2026-102786 Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...

CVE-2026-102786

The Joomla Extension - phoca.cz (specifically Phoca Gallery ) versions 4.5.0 through 6.1.5 is vulnerable to an authenticated stored cross-site scripting (XSS) . The issue is caused by HTML attribute injection , allowing an attacker to execute malicious scripts in the context of other users' brows...

PT-2026-122136

Joomla Extension - phoca.cz - Authenticated stored cross-site scripting through HTML attribute injection in Phoca Gallery 4.5.0 - 6.1.5...

ApostropheCMS: Stored XSS Via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form "string" style field with a CSS "property" and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

EUVD-2026-105171

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization...

GHSA-7JG5-FRGC-C67W ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...

Cross-site Scripting (XSS)

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

CVE-2026-112958

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-112958

The ApostropheCMS Node.js content management system is vulnerable to Stored XSS in versions prior to 4.34.0 . The root cause is a lack of HTML-attribute encoding within the wrapper serializer for project-defined free-form widget style fields. An editor can inject an unescaped quote into an inline...

CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

CVE-2026-112958 ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization

ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, a project-defined free-form widget style field can carry an editor-controlled quote into an inline style attribute because the wrapper serializer does not apply HTML-attribute encoding. The quote can terminate the...

PT-2026-118490

Name of the Vulnerable Software and Affected Versions ApostropheCMS versions prior to 4.34.0 Description A project-defined free-form widget style field allows an editor-controlled quote to be inserted into an inline style attribute because the wrapper serializer fails to apply HTML-attribute...

CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filterrule.volt and natrule.volt without quote-safe encoding. The response layer uses ENTNOQUOTES, so ...

CVE-2026-58391 OPNsense: Stored XSS in Firewall Rules/NAT pages via a HTML-attribute breakout

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descriptions into HTML title attributes in filterrule.volt and natrule.volt without quote-safe encoding. The response layer uses ENTNOQUOTES, so ...