CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2026-18311 CVE-2026-18311

Readwise Reader for Android contains a cross-site scripting vulnerability due to missing HTML sanitization in its processing of imported document metadata. Attacker-controlled fields such as the author meta tag are inserted into a WebView via innerHTML, enabling stored XSS that executes on synced...

CVE-2026-18312 CVE-2026-18312

Readwise Reader for Android constructs URLs in its WebView using attacker-controlled metadata without proper encoding or escaping. The application interpolates untrusted values directly into URL strings and inserts them into the DOM via innerHTML. Because the interpolation occurs without HTML or...

CVE-2023-4771

CKEditor cross-site scripting vulnerability in AJAX sample CVE-2023-4771 PoC CKEditor 4 Cross-site scripting XSS vulnerability in AJAX sample This document describes how to perform an XSS vulnerability CVE-2023-4771 using CKEditor. Make sure the following is done with great caution to follow...

Tiny-XSS-Payloads

Tiny-XSS-Payloads A collection of short XSS payloads that can be used in different contexts. The DEMO available here: https://tinyxss.terjanq.me Current Payloads root@kitploit: ... -- root@kitploit: root@kitploit: root@kitploit: root@kitploit: root@kitploit: root@kitploit: root@kitploit:...

openclaw-dashboard

OpenClaw Agent Dashboard A beautiful, secure, real-time monitoring dashboard for OpenClaw agents. Track sessions, monitor API usage, view costs, manage memory files, and keep tabs on system health — all in one place. 📸 Screenshots Overview| Sessions| Costs ---|---|--- | | Rate Limits| Live Feed|...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84280

The Fancy Product Designer plugin for WordPress (versions up to and including 6.5.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization and output escaping within the Shortcode Order 'elements[].title' parameter. An unauthenticated attacker c...

EUVD-2026-86576

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2026-84280 Fancy Product Designer <= 6.5.2 - Unauthenticated Stored Cross-Site Scripting via Shortcode Order 'elements[].title' Parameter

The Fancy Product Designer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Order 'elements.title' Parameter in all versions up to, and including, 6.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers ...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

CVE-2026-93405

The Mailspring email client is vulnerable to Stored XSS in the attachment quick preview feature in versions prior to 1.17.0 . The application fails to sanitize HTML generated from Markdown, DOCX, and XLSX attachments converted via Snarkdown, Mammoth, and SheetJS, inserting the result into the pre...

CVE-2026-40179-PoC

CVE-2026-40179 — Prometheus stored XSS via remotewrite A minimal, dependency-light proof of concept for CVE-2026-40179 GHSA-vffh-x6r8-xx99: stored cross-site scripting in the Prometheus web UI, delivered through an unauthenticated remotewrite endpoint. The vulnerability Prometheus 3.x renders...

CVE-2026-9806

CVE-2026-9806 CVE-2026-9806 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting CTI Transmute versions prior to the patched release.The flaw exists in the notification panel, where notification messages containing user-controlled convert names are rendered in the notification bell...

cve-2026-41200-stig-manager-oidc-reflected-xss

CVE-2026-41200 — STIG Manager OIDC Reflected XSS PoC Conceptual Proof of Concept for the reflected Cross-Site Scripting XSS vulnerability in STIG Manager versions 1.5.10 through 1.6.7. Vulnerability Summary A reflected XSS vulnerability exists in the STIG Manager Web App OIDC authentication error...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

Appsmith-1.98-Stored-XSS-Exploit

CVE-2026-7299 - Appsmith 1.98 Stored XSS SQL Autocomplete innerHTML Sink Automated exploit for a stored cross-site scripting vulnerability in Appsmith's SQL query editor. A workspace Developer can inject arbitrary JavaScript via database table names that execute in any other workspace member's...

CVE-2026-94373

MISP contains a DOM-based cross-site scripting XSS vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string...

CVE-2026-94373 MISP DOM-based Cross-Site Scripting via innerHTML in Contextual Menu

MISP contains a DOM-based cross-site scripting XSS vulnerability in the contextual menu JavaScript component. The ContextualMenu class populates HTML elements by assigning user-controllable values to the innerHTML property. Because innerHTML parses and renders HTML markup, any untrusted string...