CVE-2026-17797

Google Chrome versions prior to 151.0.7922.72 are affected by a vulnerability involving an inappropriate implementation in CSS . This flaw allows a remote attacker to inject arbitrary scripts or HTML, resulting in a User Experience Scripting (UXSS) attack, via a crafted HTML page. The vulnerabili...

CVE-2026-8539

Script injection in SanitizerAPI in Google Chrome on Android prior to 148.0.7778.168 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-7939

An inappropriate implementation in the SanitizerAPI in Google Chrome and Microsoft Edge browsers prior to version 148.0.7778.96 allows a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. This vulnerability is caused by a lack of measures to protect the structure ...

CVE-2020-9322

The /users endpoint in Statamic Core before 2.11.8 allows XSS to add an administrator user. This can be exploited via CSRF. Stored XSS can occur via a JavaScript payload in a username during account registration. Reflected XSS can occur via the /users PATHINFO...

CVE-2025-5209 Ivory Search < 5.5.10 - Admin+ Stored XSS

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-3420 Official Integration for Billingo < 3.4.0 - ShopManager+ Stored XSS

The Official Integration for Billingo WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users with a role as low as Shop Manager to perform Stored Cross-Site Scripting attacks...