CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-77615

Paella Player , a set of libraries for building multi-stream video players, contains a stored XSS vulnerability via closed captions cue text . The flaw is exploitable when a user views maliciously crafted caption data, with an impact spanning confidentiality and integrity in a changed scope (CVSS...

WordPress WP Recipe Maker plugin <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Saulo Rafael miquinho miquinho in WordPress Plugin WP Recipe Maker versions = 10.8.1...

CVE-2026-23499

CVE-2026-23499: Saleor vulnerable to stored XSS via Unrestricted File Upload Overview...

WordPress Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin <= 1.24.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Popup Maker versions = 1.24.0...

CVE-2025-67923

CVE-2025-67923 Exploitation Report JetEngine = 3.7.7 — Unauthenticated Stored Cross-Site Scripting via CCT REST API Date: March 11, 2026 CVSS Score: 7.1 High CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L Affected Plugin: JetEngine = 3.7.7 Plugin Slug: jet-engine Fixed In: 3.7.8 CVE:...

EUVD-2026-60598

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss, bypassing the page-content XSS safety gate...

GHSA-Q2J8-X8HF-63CH Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...

Grav: Single invalid UTF-8 byte disables every rule in Security::detectXss(), bypassing the page-content XSS safety gate

Vulnerability Details Component: getgrav/grav core File: system/src/Grav/Common/Security.php Function: detectXss all six entries in the $patterns array use the PCRE u modifier, invoked from Grav\Common\Data\Validation::checkSafety the save-time XSS gate for any non-security.xsswhitelist account's...

Grav: detectXss() misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS

Affected versions and vulnerable location - Confirmed on grav core at 78ebfc1 tag 2.0.13. - Detector: system/src/Grav/Common/Security.php:290, the onevents regex, run via patternMatches :315-330. - The onevents pattern at HEAD: "'??:\s\x00-\x20"'/|"^""|'^''on\sa-z+\s=iu - Sole save-time guard for...

EUVD-2026-60592

Grav: detectXss misses an event-handler attribute after an unpaired quote in an unquoted attribute value, giving stored XSS...

EUVD-2026-80782

@platejs/core HTML deserialization can trigger browser behavior during parsing...

CVE-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-82430

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

CVE-2026-76154

A stored cross-site scripting vulnerability in Grafana's Geomap panel (MapLibre base layer) allows a user with the Editor role to host a malicious style configuration , executing arbitrary JavaScript in another user's session and enabling privilege escalation to Org Admin . The CVSS v3.1 score is...

EUVD-2026-82419

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

CVE-2026-45143

Chamilo LMS versions 2.0.0 through at least 2.1.0 contain a stored XSS in the private messaging feature. The Message.content field is stored without server-side sanitization and rendered as HTML via v-html in MessageShow.vue and view_message.html.twig. An authenticated low-privilege user (e.g., a...

CVE-2026-45143 Chamilo LMS: Student-to-admin stored XSS in private messages via v-html

Chamilo LMS is an open-source learning management system. From 2.0.0 through at least 2.1.0, Chamilo LMS stores private Message.content without server-side sanitization and renders it as HTML in assets/vue/views/message/MessageShow.vue and public/main/template/default/message/viewmessage.html.twi...

CVE-2026-78071

DPCalendar Free 中通过位置标题触发的存储型 XSS DPCalendar Free ≤ 10.11.2 — 作者角色用户绕过内容审核，通过位置标题注入持久型 XSS，任何访客悬停时触发 -orange 摘要 $location-title 字段在 defaultlocations.php 中未经 htmlspecialchars 处理即被渲染。Joomla 服务端的 InputFilter::clean 会从字符串字段中剥离 ，但允许 " 通过，这使得作者（Author）角色用户能够突破 HTML 属性上下文。当任何访客将鼠标悬停在事件页面的位置信息区域时，注入的...

WordPress CSS & JavaScript Toolbox plugin <= 12.0.6 - Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting vulnerability discovered by Kyokito in WordPress Plugin CSS & JavaScript Toolbox versions = 12.0.6...