NPM: Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

NPM: Astro: Cross-site scripting via unescaped transition: directive values on hydrated islands vulnerability discovered by ? in WordPress Npm astro versions = 3.10.0, 7.0.4...

GHSA-7PW4-F3Q4-R2P2 Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands

Summary When a transition:persist, transition:scope, or transition:persist-props directive is applied to a client-hydrated client: component, Astro copied the directive value onto the rendered element without HTML-escaping it. If a developer reflects attacker-controlled input into one of these...

CVE-2026-51025

Cross Site Scripting vulnerability in fuint Member Marketing System =v1.0 allows a remote attacker to execute arbitrary code via the ClientMessageController.java file...

EUVD-2026-42334

Mistune: XSS via unescaped class option in Admonition directive...

CVE-2026-12900 Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-12900

CVE-2026-12900 affects the WordPress plugin set Spectra Gutenberg Blocks (Website Builder for the Block Editor). The vulnerability is a Stored Cross-Site Scripting via the uagb/image block in all versions up to and including 2.19.28, caused by insufficient input sanitization and output escaping. ...

GHSA-4G3V-8H47-V7G6 Astro: Reflected XSS via unescaped View Transition animation properties

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

Astro: Reflected XSS via unescaped View Transition animation properties

Summary Astro's server-side View Transition CSS generator interpolates animation properties into an inline element without escaping them for the CSS and HTML contexts. An attacker-controlled value passed to an animation property such as duration can contain a sequence, terminate the generated sty...

CVE-2026-44230

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44229

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the content parameter of the /templates endpoint. An attacker can execute arbitrary JavaScript code in the browsers of users who view the affected template by injecting malicious scripts. Details Cross-site...

WordPress Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin <= 6.6.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Essential Addons for Elementor versions = 6.6.11...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44230

RT (Request Tracker) contains a reflected Cross‑Site Scripting (XSS) vulnerability in search results/chart rendering. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 are affected if an authenticated user is induced to visit a crafted URL, enabling arbitrary ...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44230

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

EUVD-2026-46080

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-44229 RT: Cross-Site Scripting via inline-served uploaded content

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.0 and 6.0.0 and above, prior to both 5.0.10 and 6.0.3 contain a Cross-Site Scripting XSS vulnerability where uploaded content is served inline rather than as an attachment. An authenticated user who can upload...

CVE-2026-44229

CVE-2026-44229 (RT) affects the Request Tracker project: versions 5.0.0 and 6.0.0 and above, up to but not including 5.0.10 and 6.0.3, contain an XSS vulnerability where uploaded content is served inline instead of as an attachment. An authenticated user who can upload content can inject JavaScri...