CVE-2026-90438

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Paragraph Text RTE Field Submission in all versions up to, and including, 3.15.4 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-34212

CVE-2026-34212 Docmost aceptó una URL javascript: dentro de un nodo de adjunto, la preservó durante el almacenamiento y renderizado, y la devolvió a un ancla enlaceable en el origen de Docmost. Introducción Identifiqué, divulgué responsablemente y reproduje un problema de XSS almacenado de graved...

CVE-2026-96326

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-88602

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96326

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin, for versions up to and including 2.10.2 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the Rich Text Editor Field . This allows unauthenticated...

CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-96326 HT Contact Form – Drag & Drop Form Builder for WordPress <= 2.10.2 Unauthenticated Stored Cross-Site Scripting via Rich Text Editor Field

The HT Contact Form – Drag & Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Rich Text Editor Field in all versions up to, and including, 2.10.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2019-12836

CVE-2019-12836 Aplicación JEditor v3.0.5 - Editor WYSIWYG para JIRA Editor de texto enriquecido simple pero potente para Jira. Importa correos HTML, pega contenido enriquecido, crea plantillas y rellena campos predefinidos. Proveedor del Producto Bobronix Sitio web del proveedor...

EUVD-2026-86390

code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute...

CVE-2026-61823

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823

The code16 Sharp framework (a Laravel-based CMS/admin interface) is vulnerable to stored cross-site scripting (XSS) in versions prior to 9.22.5 . The root cause is that the rich-text editor's HTML sanitizer allows the srcdoc attribute on iframe elements. While the sanitizer HTML-encodes the inter...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823 code16 Sharp vulnerable to stored XSS via iframe srcdoc Attribute

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

CVE-2026-61823: Improper Neutralization of Input During Web Page Generation

code16 Sharp is a Laravel-based framework for building content-management and administrative interfaces. Versions before 9.22.5 contain a stored cross-site scripting vulnerability in the rich-text editor because the HTML sanitizer permits the srcdoc attribute on iframe elements. Although markup...

PT-2026-98242

Name of the Vulnerable Software and Affected Versions code16 Sharp versions prior to 9.22.5 Description A stored cross-site scripting issue exists in the rich-text editor because the HTML sanitizer allows the srcdoc attribute on iframe elements. While markup within srcdoc is HTML-encoded during...

CVE-2026-88976

Plate (a rich-text editor with AI and shadcn/ui support) is vulnerable to a stored cross-site scripting (XSS) issue in its core HTML deserialization APIs. Prior to 53.3.11 , and in the discontinued 54.0.0-beta.0 through 54.0.0-beta.1 builds, supplied HTML strings are parsed in the active document...

Prototype Pollution

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Prototype Pollution via the mergeAttributes function. An attacker can inject malicious prototype properties by supplying crafted objects with a proto key, which can result in inherited...

CVE-2026-73426

A flaw was found in Trix, a rich text editor. An attacker can exploit a cross-site scripting XSS vulnerability by crafting malicious HTML with a data-trix-serialized-attributes attribute. This attribute can bypass the DOMPurify sanitizer, allowing the execution of arbitrary JavaScript in a user's...

CVE-2026-73427

A flaw was found in Trix, a rich text editor. A remote attacker could exploit this vulnerability by convincing a victim to drag and drop a specially crafted JSON payload into an editor using the Level0InputController. This could bypass sanitization and allow the injection of executable JavaScript...