CVE-2026-95807 FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-103422

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2025-57298

Stored XSS via Unsafe Markdown Rendering in Kotaemon Summary Kotaemon is an open-source RAG Retrieval-Augmented Generation based document QA system that provides a web interface for querying uploaded documents such as PDF, Word, and Excel files. A stored cross-site scripting XSS vulnerability...

CVE-2025-63589

CVE-2025-63589 Reflected XSS in CMSimpleXH index.php path handling Discovered: October 6, 2025 Products: CMSimpleXH open-source flat-file CMS Affected versions: 1.8 CVEs: CVE-2025-63589 Authentication required: None unauthenticated Attack type: Reflected Cross-Site Scripting XSS Estimated CVSS...

CVE-2025-65300

CVE-2025-65300 Description CVE-2025-65300: Stored Cross-Site Scripting XSS Vulnerability in Coohom SaaS Platform Disclosure Date: 2025-10-28 Last Updated: 2025-10-28 Reporter: Phisit Pupiw Vendor: Coohom CWE: CWE-79 – Cross-Site Scripting Summary A stored Cross-Site Scripting XSS vulnerability wa...

CVE-2019-19393

Rittal CMC PU III – Stored XSS PoC Application: Rittal CMC PU III Web management Devices: CMC PU III 7030.000 Software Revision: From V3.11.002 to V3.15.704 Hardware Revision: From V3.00 to V6.01 Attack type: Stored XSS Solution: Update to Software Revision V3.17.10 or later Summary: Web...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422

The AnyComment plugin for WordPress (versions up to and including 0.3.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw stems from insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and a lack of output escaping in the AnyCommentSubscripti...

EUVD-2026-100779

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103422 AnyComment <= 0.3.6 - Unauthenticated Stored Cross-Site Scripting via 'email' Parameter

The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in...

CVE-2026-103425

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2022-28078

CVE-2022-28077 Home Owners Collection Management System 1.0 - Reflected XSS Exploit Title: Home Owners Collection Management System 1.0 - Reflected XSS Date: 2022-05-06 CVE: CVE-2022-28078 Exploit Author: Abdulaziz Saad @b4zb0z Vendor Homepage: https://www.sourcecodester.com/ Software Link:...

Jenkins Gitlab Hook <=1.4.2 - Cross-Site Scripting

Jenkins Gitlab Hook 1.4.2 and earlier does not escape project names in the buildnow endpoint, resulting in a reflected cross-site scripting vulnerability. id: CVE-2020-2096 info: name: Jenkins Gitlab Hook =1.4.3 to mitigate this vulnerability. reference: -...

CVE-2026-103425

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.7.29 . The flaw stems from insufficient input sanitization and output escaping regarding the 'id' parameter (specifically via a shortcode attribute). This allows authentic...

EUVD-2026-100763

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2026-103425 Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

CVE-2025-63588

CVE-2025-63588 Reflected Cross-Site Scripting XSS in CMSimpleXH cmsimplexh path handling Estimated CVSS v3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N → 6.1 Medium Assigned CVE: CVE-2025-63588 Products: CMSimpleXH - 1.8 Vendor: CMSimpleXH - https://www.cmsimple-xh.org/ Summary A reflected Cross-Site...

CVE-2025-63848

CVE-2025-63848 swish-prolog cve Stored cross site scripting xss vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook. Impact One click Account takeover. Mitigation Upgrade to the latest version to mitigate the ATO...

PT-2026-113621

The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-113623

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...