PT-2026-83073

The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ai1wm backups path' parameter in all versions up to, and including, 2.84. This is due to insufficient input sanitization and output escaping on user-supplied attributes...

PT-2026-83132

Name of the Vulnerable Software and Affected Versions Akilli Ticaret Software Technologies Ltd. E-Commerce Pack versions 4.5.001 through 28082026 Description Improper neutralization of input during web page generation allows for Stored Cross-Site Scripting XSS, a condition where malicious scripts...

EUVD-2026-67902

WordPress plugin Bit Assist before 1.7.2 is affected by Stored Cross-Site Scripting in Call-To-Action feature. An authenticated attacker with the privileged role admin can exploit this to redirect user to malicious site or control the account...

EUVD-2026-67768

xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. The input is stored in the database without HTML sanitization and rendered in Smarty templates without output escaping, resulting...

EUVD-2026-67900

WordPress plugin Spiffy Plugin before 5.0.9 is affected by Stored Cross-Site Scripting in Event Title field. An authenticated attacker with the lowest privileged role contributor can exploit this to redirect user to malicious site or control the account...

CVE-2026-78616 Dimension Stored XSS via Trusted CA Certificate Configuration

A Stored Cross-Site Scripting XSS vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate...

CVE-2026-78616

A Stored XSS vulnerability in WatchGuard Dimension 's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate. The CVSS 4.0 score is 4.8 (MEDIUM) , ref...

CVE-2026-78195

...

CVE-2026-78047

CVE-2026-78047 is a stored cross-site scripting (XSS) vulnerability in WatchGuard Dimension's task scheduling feature (also referenced as "Scheduled Report Task" in the CNA record). A low-privileged authenticated administrator can inject arbitrary HTML or JavaScript into the scheduling fields, an...

CVE-2026-78047 Dimension Stored XSS in Scheduled Report Task

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

CVE-2023-37191

CVE-2023-37191 — Issabel PBX 4.0.0-6: Stored Cross-Site Scripting XSS Übersicht...

CVE-2023-37190

CVE-2023-37190 — Issabel-PBX 4.0.0-6: Cross-Site Scripting XSS persistente 📋 Panoramica...

CVE-2023-37189

CVE-2023-37189 — Issabel PBX 4.0.0-6 Cross-Site Scripting XSS Memorizzato Panoramica...

CVE-2026-81931

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81731

Frappe 15.11.0 through 16.32.0 stores and renders the workspace card description without XSS filtering. The description field of the Workspace Link doctype is declared with "ignorexssfilter": 1 in frappe/desk/doctype/workspacelink/workspacelink.json, and sanitizecontent in...

CVE-2026-59316

Spring Authorization Server's default consent page renders user-controlled values without HTML entity encoding. When using the DefaultConsentPage, an attacker can craft an OAuth2 authorization request containing a malicious value that is stored server-side and later rendered unencoded in the...

CVE-2026-53579

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the book note type, whose content is stored without sanitization and later rendered as HTML, allowing an...

CVE-2026-53578

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter sanitizes HTML only for text notes and excludes the mindMap note type, whose JSON content is stored without sanitization, allowing an attacker-supplied impo...

CVE-2026-48996

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the default-on "Safe import" filter does not sanitize note titles, and the GeoMap note view interpolates a marker note's title into raw HTML that is rendered as innerHTML, allowing an...

CVE-2026-81731

Frappe versions 15.11.0 through 16.32.0 contain a stored XSS in the Workspace Link doctype's description field. The field is declared with ignore_xss_filter: 1 , causing _sanitize_content() to skip HTML filtering. The unfiltered value is later interpolated into a Bootstrap popover via LinksWidget...