CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

CVE-2026-77608

Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected cross-site scripting (XSS) vulnerability in the Special:SearchByProperty page. Prior to version 7.2.0 , the value parameter was reflected into rendered output and error messaging paths without sufficient ou...

CVE-2026-77608 Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when the value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Version 7.2.0...

Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...

GHSA-59XW-QV23-J3RC Semantic MediaWiki has reflected XSS in `Special:SearchByProperty` (`property` and `value` parameters)

Failure mode The value parameter was reflected back into rendered output and error messaging paths without enough output-context encoding. Remediation - The form value is escaped before it is placed back into the input field. - Derived error messages are also escaped before being rendered into...

CVE-2026-77606

Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected XSS vulnerability in Special:Ask when the headers=plain option is used. Table header text was emitted into elements via a raw HTML path , allowing user-controlled mainlabel content to become executable HTM...

EUVD-2026-83171

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

CVE-2026-77606 Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, when headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable...

GHSA-3JP5-3H47-28QF Semantic MediaWiki has reflected XSS in Special:Ask plain table headers

Failure mode When headers=plain, table header text was emitted into via a raw HTML path. User-controlled mainlabel content could therefore become executable HTML. Remediation - TableResultPrinter now applies output-context escaping before passing plain headers to the table renderer. - The fix is...

Syntecxhub_Web-Vulnerability-Scanner

Syntecxhub Web Vulnerability Scanner A Python-based web vulne...

WordPress Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin <= 2.15.22 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Jonah Burgess CryptoCat in WordPress Plugin BP Better Messages versions = 2.15.22...

WordPress Dictionary plugin <= 1.0 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Hassan Khan Yusufzai - Splint3r7 in WordPress Plugin Dictionary versions = 1.0...

WordPress ShopLentor – All-in-One WooCommerce Growth & Store Enhancement Plugin plugin <= 3.5.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin ShopLentor versions = 3.5.1...

WordPress EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin <= 4.6.5 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin EmbedPress versions = 4.6.5...

WordPress Newsletter – Send awesome emails from WordPress plugin <= 9.3.8 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Newsletter versions = 9.3.8...

WordPress Booking Calendar plugin <= 11.8.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Yuto Hyakumoto in WordPress Plugin Booking Calendar versions = 11.8.2...

CVE-2026-92249

The Qi Addons For Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 1.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary we...