1164552 matches found
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the SanitizeSvgJob process. An attacker can execute arbitrary JavaScript in the context of the application by replacing an existing SVG attachment with a malicious file containing script payloads. This occurs...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the call process of SelectView due to missing server-side validation of submitted option values. An attacker can execute arbitrary scripts in the context of users' browsers by submitting crafted HTML content,...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the caption process. An attacker can execute arbitrary JavaScript in the context of users' browsers by supplying crafted input that is rendered without proper sanitization. Details Cross-site scripting or XS...
CVE-2026-46594
A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...
WordPress SendPulse Email Marketing Newsletter plugin <= 2.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin SendPulse Email Marketing Newsletter versions = 2.2.5...
CVE-2026-46594 Reflected XSS in PHP Poll Script
A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...
CVE-2026-46594 Reflected XSS in PHP Poll Script
A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...
EUVD-2026-51527
A reflected cross-site scripting XSS vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a specially crafted URL that, when opened, results in arbitrary JavaScript execution in the victim's browser. This issue was fixed in version 4.1...
CVE-2026-14922
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize double-encoding flaw in the photo-comment pipeline. On write, wppadocomment sanitizes the comment with wppafilterhtml wpkses followed by wpstripalltags...
CVE-2026-14833
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image lightbox caption in the browser, allowing users with author-level access and above who lack the unfilteredhtml capability to store JavaScript that runs...
CVE-2026-14845
The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users...
CVE-2026-13609
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...
WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Coopernicus in WordPress Plugin WooCommerce Multilingual & Multicurrency versions = 5.5.6...
WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin SEO Plugin by Squirrly SEO versions = 14.2.0...
WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Abdullah Kareem "cyberkareem" in WordPress Plugin GiveWP versions = 4.16.5...
WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin Facebook for WordPress versions = 5.2.1...
WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin Facebook for WooCommerce versions = 3.7.5...
WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad in WordPress Plugin Rank Math SEO versions = 1.0.274.1...
CVE-2026-56670
ComfyUI is a modular diffusion model GUI, api and backend with a graph/nodes interface. Prior to 0.28.0, the /view endpoint served uploaded SVG files inline because image/svg+xml and related XML content types were absent from the dangerous-content-type handling, allowing stored cross-site scripti...
EUVD-2026-51438
The Frontend Admin by DynamiApps WordPress plugin before 3.29.9 decodes HTML entities in a submitted form field value after sanitizing it, which restores HTML tags that the sanitizer had neutralized. A double-encoded payload submitted by an unauthenticated visitor is therefore stored as a live ta...