EUVD-2026-109809

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-116217

RosarioSIS versions prior to 12.9.2 are vulnerable to a reflected cross-site scripting (XSS) flaw in the modules/Food_Service/MenuReports.php component. The root cause is the failure to properly escape the menu_id and modname parameters. An unauthenticated attacker can craft a malicious Modules.p...

WordPress MailPoet plugin < 5.14.2 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Mruk in WordPress Plugin MailPoet versions 5.14.2...

CVE-2026-4316

Reflected Cross-Site Scripting XSS in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject...

CVE-2026-114709

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-103377

A reflected Cross-Site Scripting XSS vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation ...

CVE-2026-114709 WordPress Ad Inserter plugin <= 2.8.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

EUVD-2026-109720

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-114709

The Igor Funa Ad Inserter plugin for WordPress (versions up to and including 2.8.18 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . This flaw stems from the Improper Neutralization of Input During Web Page Generation , allowing an attacker to inject malicious scripts into web pages. The...

CVE-2026-4316 Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio

Reflected Cross-Site Scripting XSS in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject...

EUVD-2026-109708

Reflected Cross-Site Scripting XSS in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without any proper sanitization. Successfull explotation of this vulnerability could allow an attacker to inject...

CVE-2026-4316

Gym Management Software IsMyGym by Zuinq Studio is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability. The flaw exists in the reservation endpoint , where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation allows an attacker ...

CVE-2026-103377 Reflected cross-site scripting in the video library of the Regional Parliament of Castile-La Mancha

A reflected Cross-Site Scripting XSS vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation ...

EUVD-2026-109684

A reflected Cross-Site Scripting XSS vulnerability has been identified in the web application of the Castile-La Mancha Regional Parliament’s video library. The application embeds user-supplied content into the page without properly sanitising it before it is rendered by the browser. Exploitation ...

CVE-2026-103377

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web application of the Castile-La Mancha Regional Parliament’s video library . The root cause is the application's failure to properly sanitize user-supplied content before rendering it in the browser. A remote attacker could expl...

WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting

The Ajax Load More WordPress plugin 7.8.4 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting attack which could be used against high privilege users such as administrators. id: CVE-2026-6495 info: name: WordPress Ajax Load...

WordPress weMail < 2.1.3 - Cross-Site Scripting

The weMail plugin for WordPress 2.1.3 is vulnerable to reflected cross-site scripting. The plugin does not properly escape a user-supplied parameter before reflecting it into an HTML attribute on a non-nonce-protected AJAX response. id: CVE-2026-8089 info: name: WordPress weMail 2.1.3 - Cross-Sit...

Lyrion Music Server <= 9.2.0 - Cross-Site Scripting

Lyrion Music Server 9.2.0 contains a reflected XSS caused by improper sanitization of the search parameter in the server.log endpoint, letting unauthenticated attackers execute arbitrary script in users' browsers. id: CVE-2026-50230 info: name: Lyrion Music Server = 9.2.0 - Cross-Site Scripting...

YesWiki Reflected XSS via File Upload

YesWiki is a wiki system written in PHP. Prior to version 4.5.4, YesWiki is vulnerable to reflected XSS in the file upload form. This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on by the victim to perform arbitrary actions. This issue has been...

WordPress Link Library < 7.9.4 - Cross-Site Scripting

Link Library WordPress plugin 7.9.4 contains a reflected XSS caused by unsanitised and unescaped parameter reflected in response, letting unauthenticated attackers execute scripts via user interaction. id: CVE-2026-16535 info: name: WordPress Link Library 7.9.4 - Cross-Site Scripting author:...