CVE-2026-78000

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

CVE-2026-78000 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

EUVD-2026-70446

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

CVE-2026-85158

AVideo through commit c91b5975d is affected by a reflected cross-site scripting (XSS) vulnerability in videoEmbeded.php . The root cause is that the link parameter is echoed inside an HTML comment with zero escaping , allowing an attacker to close the comment with --> and inject arbitrary Java...

CVE-2026-85159

AVideo (through commit c91b5975d) contains a reflected cross-site scripting vulnerability in userLogin.php . The root cause lies in the isSafeRedirectURL function, which validates only the URL protocol but does not sanitize HTML characters in the cancelUri parameter. Because this parameter is ech...

EUVD-2026-70394

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...

EUVD-2026-70393

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85158 AVideo Reflected XSS via videoEmbeded.php link parameter

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in videoEmbeded.php that echoes the link parameter inside an HTML comment with zero escaping. Attackers can close the comment with -- and inject arbitrary JavaScript that executes when victims visit the crafte...

CVE-2026-85159 AVideo Reflected XSS via cancelUri in userLogin.php

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative...

Bludit CMS 3.20.0 Cross Site Scripting

Bludit CMS version 3.20.0 suffers from a cross site scripting vulnerability in the search plugin. Exploit Title: Bludit CMS 3.20.0 - Reflected Cross-Site Scripting Date: 2026-08-11 Exploit Author: Ranjit Kumar Singh Vendor Homepage: https://www.bludit.com/ Software Link:...

DRUPAL-CONTRIB-2026-125

This module enables you to add an extra layer of verification for user registration. The module doesn't sufficiently filter user-supplied input before output, resulting in an unauthenticated reflected Cross-site Scripting XSS vulnerability...

CVE-2026-81770 WordPress Interactive Geo Maps plugin <= 1.6.30 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

CVE-2026-81770

CVE-2026-81770 affects the WordPress Interactive Geo Maps plugin in versions ≤ 1.6.30 . The vulnerability is an unauthenticated Reflected Cross-Site Scripting (XSS) , meaning no prior login is required to exploit it, though user interaction is needed (CVSS 3.1: 7.1 HIGH , vector AV:N/AC:L/PR:N/UI...

CVE-2026-82883

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-82883 WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

EUVD-2026-69887

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Marcus Login With Ajax allows Reflected XSS. This issue affects Login With Ajax: from n/a through 4.5.1...

CVE-2026-82883

CVE-2026-82883 is a Reflected Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Login With Ajax by Marcus , affecting versions from n/a through 4.5.1 . The root cause is improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts th...

CVE-2026-19723

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

EUVD-2026-69834

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...

CVE-2026-19723 Social Media Share Buttons & Social Sharing Icons < 3.0.1 - Reflected XSS via Pin It Share Handler

The Social Media Share Buttons & Social Sharing Icons WordPress plugin before 3.0.1 does not properly escape a value taken from the incoming request before outputting it in an inline JavaScript event handler, leading to Reflected Cross-Site Scripting which is triggered when a user interacts with...