CVE-2026-14190

CVE-2026-14190 concerns the Sina Extension for Elementor WordPress plugin (before 3.10.2). An unauthenticated AJAX handler reflects a value reconstructed from request input into the HTML response without escaping, enabling reflected XSS : unauthenticated attackers can trigger a crafted request to...

CVE-2026-12982

The Document Gallery WordPress plugin (before 5.1.1) is affected by a Reflected XSS in an unauthenticated AJAX action (dg_generate_gallery) caused by improper sanitisation/escaping of user input. Impact is XSS for unauthenticated users; remediation is to update to 5.1.1 or later (as stated in CVE...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

CVE-2026-65763

CVE-2026-65763 affects Phoca Maps (Phoca.cz) Joomla extension versions 1.0.0 through 6.0.9. The vulnerability is a reflected XSS caused by improper validation of user inputs, enabling an attacker to reflect malicious input in the response. Metrics indicate a CVSS 4.0 base with a 5.1 score (medium...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-63264 Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

CVE-2026-63264

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44227

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 6.0.0 and above, prior to 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability. An attacker who can induce an authenticated RT user to visit a crafted URL can execute arbitrary JavaScript in that user's...

EUVD-2026-45981

dataCycle is a data management system for centrally storing, managing, searching, finding, and distributing data. In dataCycle-CORE, the module handling core processing and framework rules, before and including version 25.07.3, any unauthenticated attacker can place arbitrary HTML into flash...

CVE-2026-12970

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

CVE-2026-57857 Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

EUVD-2026-45400

The Flow Payment plugin for WordPress flow.cl version 3.0.8 is vulnerable to reflected cross-site scripting on the WooCommerce checkout page. When the plugin handles an order cancellation, the errormessage GET parameter is passed directly to wcaddnotice in flowpayment-fl.php lines 57-58 without...

CVE-2026-9585 Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal

An unauthenticated reflected cross-site scripting XSS vulnerability exists in Sangoma Switchvox SMB Edition version 8.3 104997. The application fails to properly sanitize the portal parameter supplied to the invalidbrowser and invalidbrowserlogin handlers. User-supplied data is reflected into...

CVE-2026-12978 FunnelKit < 3.15.0.6 - Reflected XSS via Divi Optin Form

The FunnelKit WordPress plugin before 3.15.0.6 does not escape a user-supplied parameter before reflecting it into the HTML response of one of its page-builder AJAX actions, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against logged-in users who open a crafted pag...

EUVD-2026-44863

The Product Feed Manager For WooCommerce – Sell on 200+ Online Marketplaces plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 7.6.1 due to insufficient input sanitization and output escaping. This makes it possible...