CVE-2026-15234

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

CVE-2026-15234

The CVE-2026-15234 vulnerability affects the WordPress plugin Codeless Page Builder (≤ 1.1.4). The underlying issue is that a shortcode attribute is not sanitized/validated before being used as an HTML tag name during content rendering. This allows users with contributor-level access and above to...

CVE-2026-15234

The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when rendering content, allowing users with contributor-level access and above to inject arbitrary HTML and JavaScript that executes in the session of a...

CVE-2026-34497 FMS Employee Vulnerable to HTML Injection

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-34497 FMS Employee Vulnerable to HTML Injection

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-34497

CVE-2026-34497 affects Johnson Controls FM Systems Employee prior to 2025.3.1, with an improper neutralization of Script-Related HTML tags in a web page that enables basic XSS. The CVSS 4.0 vector: AV:N/AC:L/PR:H/UI:P/VI:N/VO:N/SA:N/SI:N/VM:N, base score 4.8 (MEDIUM). No exploitation details are ...

EUVD-2026-51337

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can cra...

SUSE CVE-2026-52807

Gogs is an open source self-hosted Git service. Prior to 0.14.3, in newform.tmpl, milestone names are rendered with Go's default auto-escaping .Name, which converts to etc. This prevents direct HTML injection. However, when the browser renders the DOM, the text content of the element contains the...

SUSE-SU-2026:3414-1 Security update for ImageMagick

This update for ImageMagick fixes the following issues: - CVE-2026-62343: heap buffer overwrite in morphology operation when an invalid kernel is provided bsc1272575. - CVE-2026-62363: heap buffer overwrite in fx operation when processing a crafted argument bsc1272582. - CVE-2026-62946: integer...

CVE-2026-17739

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

CVE-2026-17878

In Google Chrome/Chromium, CVE-2026-17878 is due to an inappropriate implementation in the CSS component, enabling UXSS via a crafted HTML page. Affected versions are before 151.0.7922.72, with the issue classified as Medium severity. Upstream reference: Chromium issue 522781838. Remediation is t...

GHSA-FM7P-GW32-828P mathlive's Lack of Escaping of HTML allows for XSS

Summary Despite the 0.104.0 patch escaping attribute-bearing constructs \htmlData, \href, text-content reflection was missed. The \text, \mbox commands accept arbitrary characters in their body and emit them raw and unescaped into both the HTML markup and the MathML output, leading to XSS. Detail...

GHSA-996F-334J-67G7 Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS

Summary Easy!Appointments allows administrators to define a custom "booking disabled" message through the booking settings page. That value is stored in the disablebookingmessage setting via a rich-text editor and later passed directly to the public bookingmessage view without escaping or...

CVE-2026-48060

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

CVE-2026-48060

Litestar (Python ASGI framework) is affected when using a template engine with CSRF protection configured inline with the templating docs. Prior to version 2.20.0, the csrftoken contents could be injected into rendered HTML due to a lack of escaping, enabling HTML injection and potential XSS. The...

CVE-2026-48060 Litestar: HTML Injection Through CSRF Token

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

CVE-2026-66921

Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-node-name attribute and the body of a generated element. Because the node-reference tokenizer rejected only square brackets, a crafted node name coul...

CVE-2026-66918 DOM-Based Cross-Site Scripting via Unsanitized SVG Node Icons

Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document. When rendering a graph node, the vulnerable code assigns the SVG icon markup directly to the innerHTML property of a live SVG element. An attacker...

EUVD-2026-49055

NoteGen before 0.32.0 renders AI chat responses with markdown-it configured with html:true and injects the result into the DOM via dangerouslySetInnerHTML in chat-preview, without HTML sanitization and with CSP set to null. Attacker-controlled content that reaches the model prompt for example a...