EUVD-2026-72389

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. \x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handle...

CVE-2026-86431

league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and

PT-2026-86797

league/commonmark thephpleague/commonmark versions = 2.7.0 and 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte e.g. x0Conclick="alert1" bypasses the AttributesHelper::filterAttributes 'on' event-handler...

CVE-2026-85601

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601 Grav Admin before 2.0.20 Cross-Site Scripting via marked.js

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-85601

Grav Admin versions before 2.0.20 contain a cross-site scripting (XSS) vulnerability in the MarkdownEditor and MarkdownModal components. The root cause is unsanitized output from marked.parse() being injected into the DOM via Svelte's {@html} directive. Attackers can exploit this by injecting jav...

CVE-2026-85601: Improper Neutralization of Input During Web Page Generation

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

PT-2026-85501

Grav Admin before 2.0.20 fails to sanitize output from marked.parse before injecting it into the DOM via Svelte's @html directive in MarkdownEditor and MarkdownModal components. Attackers can inject javascript: URI schemes in plugin or theme changelogs to execute arbitrary code in authenticated...

CVE-2026-3850 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being rendered into...

CVE-2026-3850

The Divi theme for WordPress (versions up to and including 4.27.6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) via the redirect_url parameter of the et_pb_contact_form shortcode. The root cause is twofold: the redirect_url attribute is sanitized with esc_attr() instead of esc_url() befo...

CVE-2026-3850 Divi <= 4.27.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being rendered into...

PT-2026-84642

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirect url parameter of the et pb contact form shortcode in all versions up to, and including, 4.27.6. This is due to the redirect url attribute being sanitized with esc attr instead of esc url before being render...

CVE-2026-3850: Improper Neutralization of Input During Web Page Generation

The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being rendered into...

Divi < 4.27.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Contact Form 'redirect_url' Shortcode Parameter

Description The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the redirecturl parameter of the etpbcontactform shortcode in all versions up to, and including, 4.27.6. This is due to the redirecturl attribute being sanitized with escattr instead of escurl before being...

GHSA-R52F-R9V5-66XR Snipe-IT vulnerable to stored XSS via Markdown custom field

Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...

Snipe-IT vulnerable to stored XSS via Markdown custom field

Impact CommonMark is configured with htmlinput = 'escape', which blocks raw HTML injection. However, javascript: URIs in Markdown hyperlinks are not sanitized. A user with assets.edit permission can inject a malicious link into any markdown-textarea custom field. Any user who opens the asset deta...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-49436

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...

CVE-2026-49436 LinkAce vulnerable to stored XSS via 'javascript:' URI in Bulk Link API

LinkAce is a self-hosted archive to collect website links. Prior to version 2.5.7, the Bulk Link API endpoint POST /api/v2/bulk/links accepts URLs without any format validation, allowing an authenticated user to store a javascript: URI. The stored URI is later rendered verbatim as an href in Blad...