CVE-2026-9833

CVE-2026-9833 CVE ID: CVE-2026-9833 Vulnerability Type: Cross-Site Scripting XSS – Reflected XSS CWE: CWE-79 – Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' Severity: High CISA ADP CVSS v3.1: 7.1 Overview CVE-2026-9833 affects the Tag Groups – Advanced Way to...

CVE-2026-88824

The Master Blocks WordPress plugin before 1.5.0 does not have authorisation on one of its REST routes, allowing unauthenticated users to update its settings, including a value that is output unescaped in the admin area, leading to Stored XSS that executes in the session of any administrator...

EUVD-2026-80182

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-81926

Concrete CMS versions 9.4.0 through 9.5.2 contain a cross-site scripting (XSS) vulnerability in the location panel's duplicate-path confirmation dialog . When a page path collision occurs, the panel's check endpoint returns the submitted path unmodified in its JSON response, and client-side JavaS...

EUVD-2026-78089

In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint PUT /ccm/api/1.0/pages/cID did not enforce page-property, page-template, or page-type authorization. A user granted only content-editing rights on a page could therefore alter its properties, template, and type through the API...

CVE-2026-54181 backpack/crud: Stored XSS in the color column — the `@if($column['escaped'])` branches are inverted

backpack/crud provides Create, Read, Update & Delete CRUD functions for Backpack, a collection of Laravel packages that help users build custom administration panels. From 6.0.0 until 6.8.14 and 7.0.38, src/resources/views/crud/columns/color.blade.php inverts the escaped and raw rendering branche...

CVE-2026-85190

The Quick Index extension for Joomla (by regularlabs.com), versions prior to 5.0.5 , contains a privileged stored XSS vulnerability. The extension inserts configurable class values into generated HTML without escaping them for an HTML attribute context. A crafted value can close the intended clas...

PT-2026-91409

Name of the Vulnerable Software and Affected Versions NetworkManager-l2tp affected versions not specified Description A flaw exists where the plugin writes attacker-controlled VPN connection properties, specifically vpn.data and vpn.secrets values, unescaped into a generated ipsec.conf file...

PT-2026-90964

Name of the Vulnerable Software and Affected Versions YouTube Embed versions 10.0 through 10.3 Description The plugin fails to perform authorization checks on an AJAX action, relying solely on a nonce printed on front-end pages. Additionally, it does not escape stored data before rendering, which...

PT-2026-90581

Name of the Vulnerable Software and Affected Versions WP Highlight Box versions prior to 1.1 Description Users with the contributor role and above can perform Stored Cross-Site Scripting XSS attacks. This occurs because the plugin fails to escape certain shortcode attributes before they are outpu...

CVE-2026-89253 AVideo Stored XSS via donationLink in watch page button

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the user 'donationLink' profile field. User::setDonationLink objects/user.php stores the value and save validates it only with filtervar..., FILTERVALIDATEURL, which accepts...

EUVD-2026-75962

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

PT-2026-89781

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-88921 MISP: Unescaped HTML Injection in PDF Report Element Rendering

MISP contains an HTML injection vulnerability in the MISPElementHTMLFormatterTool component, which is responsible for rendering MISP element references attributes, objects, and tags into inline HTML during PDF report export via the convertmarkdowntopdf module. The attribute, objectAttribute,...

CVE-2026-78302

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

CVE-2026-78302 Joomla Extension - joomshaper.com - Unauthenticated Cross-Site Scripting (XSS) via Unescaped Output in Views and Admin Lists in SP Property < 4.1.4

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

EUVD-2026-75390

Joomla Extension - joomshaper.com - Unauthenticated Stored Cross-Site Scripting XSS via Unescaped Output in Views and Admin Lists in SP Property 4.1.4 - Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without...

CVE-2026-78302

SP Property (Joomla Extension by joomshaper.com) versions below 4.1.4 are affected by an unauthenticated Stored XSS vulnerability. Multiple template files across frontend views and administrator list tables rendered attributes and text values directly into HTML without contextual escaping , allow...

Prowler: Stored XSS in HTML reports through unescaped cloud resource tags

SummaryProwler's HTML output formatter inserts finding.resourcetags into the generated report without HTML escaping. A cloud principal who can create or edit a resource tag in an account that is later scanned can store HTML or JavaScript in that tag. When another user opens the generated Prowler...