EUVD-2026-79945

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-81927 Concrete CMS before 9.5.3 is vulnerable to Stored XSS via SVG upload in "Reject" sanitization mode

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.filemanager.images.svgsanitization.action = reject, uploaded SVGs were checked...

CVE-2026-81927

Concrete CMS before 9.5.3 contained a stored XSS vulnerability in its SVG file handling. The flaw is triggered only when SVG sanitization is set to the non-default "reject" mode (concrete.file_manager.images.svg_sanitization.action = reject). In that mode, uploaded SVGs were checked against a sma...

dompurify: DOMPurify: Cross-Site Scripting via IN_PLACE sanitization

A flaw was found in DOMPurify. This cross-site scripting vulnerability occurs during INPLACE sanitization, where element-removal hooks fail to neutralize detached subtrees. A remote attacker can exploit this by supplying specially crafted HTML with event handlers. This allows the execution of...

golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting

A flaw was found in golang.org/x/net/html. A remote attacker could exploit this vulnerability by providing specially crafted HTML. When this arbitrary HTML is parsed and rendered, it can result in an unexpected HTML tree, bypassing input sanitization. This can be leveraged to execute Cross-Site...

golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass

A flaw was found in golang.org/x/net/html. When arbitrary HTML is parsed and then rendered, it can result in an unexpected HTML tree. This allows an attacker to bypass HTML sanitization mechanisms, leading to Cross-Site Scripting XSS attacks in applications. Such attacks can result in information...

EUVD-2026-78297

The Eventin – Event Calendar, Event Registration, Tickets & Booking AI Powered plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'etnsheduleobjective' scheduleslot Parameter in all versions up to, and including, 4.1.23 due to insufficient input sanitization and output escaping...

CVE-2026-15402

The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) WordPress plugin (slugged wp-event-solution ) is vulnerable to Stored Cross-Site Scripting (XSS) via the etn_shedule_objective schedule_slot parameter in versions up to and including 4.1.23 . The root cause is insuff...

CVE-2026-85657

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

CVE-2026-85575

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

CVE-2026-85575 The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengineproducttitleheadersize’ parameter in all versions up to, and including, 4.9.5 due to...

CVE-2026-85657

The PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.15.0 . The flaw resides in the Co-Authors, Multiple Authors, and Guest Authors Author Box functionality, where the profile_fields_user_email_value_prefix paramete...

CVE-2026-85575

The ShopEngine Elementor WooCommerce Builder Addon WordPress plugin (versions up to and including 4.9.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the shopengine_product_title_header_size parameter, caused by insufficient input sanitization and output escaping . Authenticated attack...

CVE-2026-85657 Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.15.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'profile_fields_user_email_value_prefix' Parameter

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

EUVD-2026-78244

The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘profilefieldsuseremailvalueprefix’ parameter in all versions up to, and including, 4.15.0 due to insufficient input sanitization...

PT-2026-91774

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine product title header size’ parameter in all versions up to, and including, 4.9.5 due to...

PT-2026-92023

The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-93124

Concrete CMS before 9.5.3 contained a stored cross-site scripting vulnerability in SVG file handling. When SVG processing was set to the non-default "Reject files containing potentially harmful elements" mode concrete.file manager.images.svg sanitization.action = reject, uploaded SVGs were checke...

CVE-2026-43791

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to read arbitrary files...

CVE-2026-43692

A validation issue was addressed with improved input sanitization. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. A remote user may cause an unexpected app termination or arbitrary code execution...