9791 matches found
CVE-2026-66296: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation XSS vulnerability in lud oaskit allows reflected cross-site scripting via the default HTML error handler. Oaskit.ErrorHandler.Default.formatreason/4 and Oaskit.ErrorHandler.Default.reasontohtml/1 in lib/oaskit/errorhandler/default.ex...
CVE-2026-17571
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-18344 Responsive Thumbnail Slider < 1.1.53 - Reflected Cross-Site Scripting via 'id' Parameter
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and excluding, 1.1.53. This is due to insufficient input sanitization and output escaping in the responsivethumbnailimagemanagement function, which...
CVE-2026-17571: Improper Neutralization of Input During Web Page Generation
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'param' in all versions up to, and including, 6.2.8 due to insufficient input sanitization and output escaping. This makes it possibl...
CVE-2026-13725: Improper Neutralization of Input During Web Page Generation
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJAX actions and reflects unsanitised user input in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against...
PT-2026-66865
Name of the Vulnerable Software and Affected Versions FS Inc S3150-8T2F Switch version 2.2.0D Build 118101 Description A reflected cross-site scripting XSS issue exists in the '/logo.asp' endpoint. This allows an attacker to execute arbitrary Javascript within the victim's browser session by usin...
CVE-2026-8167
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026...
CVE-2026-44387
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-14870
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2026-44387: Improper Neutralization of Input During Web Page Generation
ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...
CVE-2026-65764
Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...
CVE-2026-15928
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...
UBUNTU-CVE-2026-15928
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...
CVE-2026-15928
XMLRPC-C Library versions 1.07–1.67.01 are vulnerable to a reflected XSS in the error page component. The CVE entry specifies a reflected cross-site scripting vulnerability with NETWORK attack vector, no privileges required, and user interaction needed. Impact is HIGH on confidentiality (both vul...
PT-2026-64995
Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.3 Description Stored and reflected cross-site scripting issues exist in SVG sanitization. Authenticated attackers can bypass the HTML parser-based cleaner by hiding script tags within desc, style, or noscript...
CVE-2026-8308
Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...
CVE-2026-55730 Loytec LWEB802: Reflected Cross-Site Scripting in LWEB802
Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...
CVE-2026-15346: Improper Neutralization of Input During Web Page Generation
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'categoryid' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
CVE-2026-55730: Improper Neutralization of Input During Web Page Generation
Reflected Cross-Site Scripting CWE-79 in LWEB802 in Loytec LWEB-802 before 5.0.8 on all platforms allows an unauthenticated remote attacker to execute arbitrary JavaScript in a victim's browser and perform actions with the victim's privileges via a crafted link containing a malicious project or...
