CVE-2024-42009

CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...

CVE-2026-108495

The SureForms WordPress plugin (versions n/a through 2.12.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored on the server and subsequently exe...

WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin SureForms versions = 2.12.7...

CVE-2025-55580

CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

CVE-2026-67165

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-102562

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...

CVE-2026-102007

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...

CVE-2026-27472-and-CVE-2026-27474

CVE-2026-27472 and CVE-2026-27474 CVSS-B 5.3 MEDIUM and CVSS-B 4.8 MEDIUM Blind SSRF in SPIP 4.4.8 Syndication Feature and stored XSS Explanations and more on my website PoC 1. Log in as an administrator. 2. Make sure that in the Site content configuration, Sites referencing and syndication is on...

CVE-2026-102007

The Bit integrations plugin for WordPress (versions up to and including 2.10.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping within the 'field mapped to notification_content' parameter (e.g., payload_text). This flaw a...

CVE-2026-102562

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 11.1.0 . The root cause is insufficient input sanitization and output escaping within the acym_cleanVar() sanitizer, which only strips complete HTML tags, combined with Subscribe...

CVE-2026-102007 Bit integrations <= 2.10.6 - Unauthenticated Stored Cross-Site Scripting via 'notification_content' Field via Public Bit Assist Webhook Callback

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notificationcontent attacker-chosen key, e.g. payloadtext' parameter in all versions up to, and including, 2.10.6...

CVE-2026-66418-OpenClaw-Dashboard-v3.0.0-Stored-XSS-via-Failed-Login-Username-Field

Security Advisory: Unauthenticated Stored Cross-Site Scripting Leading To Administrator Account Takeover openclaw-dashboard Title: OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field Assigned CVE ID: CVE-2026-66418 Target Repository:...

CVE-2025-56605

CVE-2025-56605 XSS Cross-Site Scripting Vulnerability CVE-2025-56605 — Reflected XSS in Event Management System 1.0 Description: A reflected Cross-Site Scripting XSS vulnerability exists in register.php of PuneethReddyHC/event-management 1.0. The mobile POST parameter is improperly validated and...

CVE-2026-67165 HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-103418

Firefox for iOS is vulnerable to a Universal XSS flaw because the browser directly interpolates the page’s HTML language attribute into translation JavaScript. This allows an attacker to execute code within the browser's privileged content world and bypass the page’s Content Security Policy . Thi...

CVE-2026-103418 Universal XSS via the HTML language attribute in Translation Services

Firefox for iOS directly interpolated the page’s HTML language attribute into translation JavaScript, allowing attacker-controlled markup to execute code in Firefox’s privileged content world and bypass the page’s Content Security Policy. This vulnerability was fixed in Firefox for iOS 157.1...

CVE-2023-43326

mooSocial: XSS CVE-2023-43326 A reflected cross-site scripting XSS vulnerability exisits in multiple url of mooSocial v3.1.8 which allows attackers to steal user's session cookies and impersonate their account via a crafted URL. Note: XXS Also works when these URLs are used in Referer Header. The...

CVE-2025-51859

CVE-2025-51859 Vulnerability description Chaindesk, a web application for constructing AI Agents, is vulnerable to Stored Cross-Site Scripting XSS in its agent chat component. An attacker can achieve arbitrary client-side script execution by crafting an AI agent whose system prompt instructs the...

CVE-2026-52658

CVE-2026-52658 — AureusERP Stored XSS Chatter Change-Tracking CWE-79 · CVSS 8.7 High · AureusERP ≤ v1.4.0 / master Chatter renders the change-tracking oldvalue / newvalue fields as raw HTML !! !!, no sanitization. An authenticated user editing a record stores JavaScript that fires for every viewe...