CVE-2026-13362

The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via spformcode Post Meta in all versions up to, and including, 2.2.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-7623

The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'headingWrapper' parameter in all versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possibl...

CVE-2026-7623

CVE-2026-7623 - SureForms WordPress plugin : Affects SureForms – Contact Form, Payment Form & Other Custom Form Builder for WordPress, vulnerable in all versions up to and including 2.8.1. The issue is a Stored Cross-Site Scripting via the headingWrapper parameter caused by insufficient input san...

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Summary The @apostrophecms/seo package injects the Google Analytics Tracking ID seoGoogleTrackingId and Google Tag Manager ID seoGoogleTagManager directly into tag bodies using JavaScript template literals without any sanitization or validation. Any user with editor-level access the default role...

MAL-2026-11454 Malicious code in ai-backup-script (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 647eefd97b5d8a0eac0be938122ebe0120152f6ded442d7616b18707bd26ea65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-62324

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDangerousUrl to normalize javascript: href values before checking the scheme, allowing case variants, control-byte prefixes, and embedded tabs or...

CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-65841

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-65841

CVE-2026-65841 affects Jodit Editor prior to version 4.13.6, where the clean-html denyTags filter fails to normalize foreign SVG/MathML script node names, allowing a [removed] element nested inside SVG (or MathML) to survive and execute when content is loaded. The issue stems from insufficient no...

EUVD-2026-51622

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

NPM: Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

NPM: Jodit has cross-site scripting XSS via nested in SVG that bypasses clean-html sanitization vulnerability discovered by ? in WordPress Npm jodit versions 4.13.6...

CVE-2026-34495

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-18481

CVE-2026-18481 describes a stored cross-site scripting flaw in the AWS Ops Wheel project, affecting the participant_url handling. The issue, triggered by a crafted participant_url value with a dangerous URI scheme, could allow an authenticated remote user to steal session tokens and escalate to f...

MAL-2026-11422 Malicious code in asdk-plugin-alphagen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d3479f5a67e780468835828895609215d82aa5a273dfc152e4bae5a12f21a245 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

EUVD-2026-51590

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-34497

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-67350 Serendipity < 2.6.1 Open Redirect via exit.php

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious Base64-encoded url parameter when the Track Exits plugin is configured with commentredirection set to s9y...