Cross-site Scripting (XSS)

Overview drupal/core is an an open source content management platform powering millions of websites and applications. Affected versions of this package are vulnerable to Cross-site Scripting XSS via a Link field. An attacker with edit access via core web services, or a contrib or custom module...

PT-2025-14265

Name of the Vulnerable Software and Affected Versions Mashi Simple Map No Api versions 1.9 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inje...

PT-2025-14183 · Maksym Marko · Mx Time Zone Clocks

Name of the Vulnerable Software and Affected Versions: Maksym Marko MX Time Zone Clocks versions n/a through 5.1.1 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This means that an...

PT-2025-14138

Name of the Vulnerable Software and Affected Versions HMH Footer Builder For Elementor versions 1.0 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker...

PT-2025-14034

Name of the Vulnerable Software and Affected Versions Kento WordPress Stats versions 1.1 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-14197

Name of the Vulnerable Software and Affected Versions devscred Design Blocks versions 1.2.2 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-14251

Name of the Vulnerable Software and Affected Versions Ajay WebberZone Snippetz versions n/a through 2.1.0 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting', which allows Stored XSS. This means that an attacker can...

PT-2025-14194

Name of the Vulnerable Software and Affected Versions BuddyPress Members Only versions 3.5.3 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables an attacker to inject...

PT-2025-14041

Name of the Vulnerable Software and Affected Versions Google Font Fix versions n/a through 2.3.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers to inject...

PT-2025-13691

Name of the Vulnerable Software and Affected Versions Themeix Churel versions 1.0.0 through 1.0.8 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing DOM-Based XSS. This enables potential attackers to inject...

PT-2025-13662

Name of the Vulnerable Software and Affected Versions JetSearch versions 3.5.7 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows DOM-Based XSS in JetSearch. This enables potential attackers...

PT-2025-13737

Name of the Vulnerable Software and Affected Versions Kibru Demeke Ethiopian Calendar versions n/a through 1.1.1 Description The issue is related to improper neutralization of input during web page generation, which allows for Stored Cross-site Scripting XSS. This means that an attacker can injec...

PT-2025-13768

Name of the Vulnerable Software and Affected Versions Useinfluence versions n/a through 1.0.8 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can inject...

PT-2025-13750

Name of the Vulnerable Software and Affected Versions Cal.com versions n/a through 1.0.0 Description The issue is related to Improper Neutralization of Script-Related HTML Tags in a Web Page, also known as Basic XSS, allowing Stored XSS. This means that an attacker can inject malicious scripts in...

PT-2025-13760

Name of the Vulnerable Software and Affected Versions owenr88 Simple Contact Forms versions 1.6.4 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Stored XSS. This enables potential attackers ...

PT-2025-13753

Name of the Vulnerable Software and Affected Versions flomei Simple-Audioplayer versions n/a through 1.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means that an attacker can...

PT-2025-13756

Name of the Vulnerable Software and Affected Versions Gingerplugins Notification Bar, Sticky Notification Bar, Sticky Welcome Bar for any theme versions n/a through 1.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site...

PT-2025-13707

Name of the Vulnerable Software and Affected Versions Checklist versions 1.1.9 and earlier Description The issue is related to improper neutralization of input during web page generation, which allows for stored Cross-site Scripting XSS. This means that an attacker can inject malicious scripts in...

Duplicate Advisory: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f7jh-m6wp-jm7f. This link is maintained to preserve external references. Original Description A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when a...

GHSA-HP88-HFJW-2HG4 Duplicate Advisory: HAL Cross Site Scripting (XSS) vulnerability of user input when storing it in a data store

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-f7jh-m6wp-jm7f. This link is maintained to preserve external references. Original Description A flaw was found in the JBoss EAP Management Console, where a stored Cross-site scripting vulnerability occurs when a...