CVE-2026-15782

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

EUVD-2026-46159

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...

CVE-2026-11767 CRT Addons for Elementor < 1.6.7 - Unauthenticated Stored XSS via Contact Form

The Free Builder for Elementor WordPress plugin before 1.6.7 does not sanitise submitted contact form field values before storing them and outputting them in the admin dashboard, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks that execute when a logged-in...

CVE-2026-11767

The CVE-2026-11767 entry describes a Stored XSS vulnerability in The Free Builder for Elementor WordPress plugin, affecting versions before 1.6.7. The issue arises from insufficient sanitization of submitted contact form field values, which are stored and later output in the admin dashboard, enab...

EUVD-2026-46155

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

CVE-2026-15782 WPForms <= 2.0.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via OptinMonster Integration data-sitekey Attribute in Post Content in all versions up to, and including, 2.0.0.1 due to...

CVE-2026-15782

CVE-2026-15782 describes a stored XSS in WPForms – AI Form Builder for WordPress (WordPress plugin) up to version 2.0.0.1, caused by insufficient input sanitization and output escaping. The vulnerability affects pages containing content with OptinMonster integration data-sitekey attributes, and c...

CVE-2026-15156

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

CVE-2023-37508

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

EUVD-2023-60603

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

CVE-2023-37508 HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting XSS which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present...

CVE-2023-37508

Technical details (affected products, versions, impact, remediation) are not publicly available in the provided documents; monitor for updates.

EUVD-2026-46149

The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Reading Progress Global Color Settings in all versions up to, and including, 6.6.11 due to insufficient input sanitization and output escaping. This mak...

EUVD-2026-46114

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-46139

Cross Site Scripting vulnerability in fuint Member Marketing System =v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file...

PT-2026-63255

Name of the Vulnerable Software and Affected Versions SourceCodester Class and Exam Timetabling System version 1.0 Description Cross site scripting occurs when manipulating the day argument within the /BSIS.php endpoint. This issue allows a remote attacker to execute malicious scripts in the...

PT-2026-61973

Name of the Vulnerable Software and Affected Versions SolarWinds Serv-U affected versions not specified Description SolarWinds Serv-U contains a stored cross-site scripting XSS flaw. This issue allows an authenticated attacker to inject malicious scripts that are stored on the server, which can...

AlmaLinux 8 : nodejs:22 (ALSA-2026:41947)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:41947 advisory. ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input CVE-2026-42338 undici: undici: Denial of Service due to...

CVE-2026-52475

CVE-2026-52475 affects aiflowy

XSSer Penetration Testing Tool 1.9

XSSer is an open source penetration testing tool that automates the process of detecting and exploiting XSS injections against different applications. It contains several options to try to bypass certain filters, and various special techniques of code injection. 12 additions, 12 modifications, 10...