CVE-2026-14190

The Sina Extension for Elementor WordPress plugin (versions before 3.10.2 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape values reconstructed from request input within an unauthenticated AJAX handler before they are reflected into the HTML ...

CVE-2026-13726 Multiple Page Generator Plugin – MPG < 4.1.8 - Reflected XSS via mpg_shortcode

The MPG WordPress plugin before 4.1.8 does not sanitise and escape a parameter before reflecting it back in the response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting against a victim who is induced to send a crafted request...

CVE-2026-12982

The Document Gallery WordPress plugin, in versions prior to 5.1.1 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The issue arises because the plugin fails to properly sanitise and escape user input before reflecting it in the response of an unauthenticated AJAX action . Specifica...

AZL-94010 CVE-2026-15928 affecting package xmlrpc-c 1.60.04-4

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-15928

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

CVE-2026-66395: Improper Neutralization of Input During Web Page Generation

SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by crafting a malicious siyuan:// deep link. Attackers can inject HTML payloads via the plugin name parameter that execute with...

CVE-2026-12982: Improper Neutralization of Input During Web Page Generation

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

PT-2026-64835

The Document Gallery WordPress plugin before 5.1.1 does not properly sanitise and escape user input before reflecting it back in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against unauthenticated users...

CVE-2026-59727: Improper Neutralization of Input During Web Page Generation

Astro is a web framework for content-driven websites. In versions 3.10.0 through 7.0.3, when a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without...

CVE-2026-15928: Improper Neutralization of Input During Web Page Generation

XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting XSS vulnerability in the error page component...

PT-2026-64844

The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of...

CVE-2026-65764: Improper Neutralization of Input During Web Page Generation

Joomla Extension - phoca.cz - Reflected XSS vulnerability in Phoca Commander 5.0.0-6.1.1 - Improper validation of user inputs lead to a reflective XSS vulnerability...

OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

GHSA-VQXV-6XRH-49CP OpenAM Reflected XSS in the OAuth2/OIDC `wap` consent page

Description The OAuth2/OIDC consent page rendered for display=wap authorize requests reflected several request-derived values into the HTML response without escaping. An attacker who induces a user with an active OpenAM session to follow a crafted authorize link can execute arbitrary JavaScript i...

CVE-2026-8308: Improper Neutralization of Input During Web Page Generation

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Polen Media Software and Information Services Website Template allows Reflected XSS. This issue affects Website Template: before v2...

CVE-2026-65763

CVE-2026-65763 affects Phoca Maps (Phoca.cz) Joomla extension versions 1.0.0 through 6.0.9. The vulnerability is a reflected XSS caused by improper validation of user inputs, enabling an attacker to reflect malicious input in the response. Metrics indicate a CVSS 4.0 base with a 5.1 score (medium...

CVE-2026-9066

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...

CVE-2026-9066 WP Compress < 7.10.04 - Reflected XSS via test_zone

The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress...