WordPress Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin <= 8.10.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sorra in WordPress Plugin Directorist versions = 8.10.2.1...

WordPress PO/MO Editor plugin <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by sermsak in WordPress Plugin PO/MO Editor versions = 1.4.2...

WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Spy0x7 in WordPress Plugin Cryptocurrency Donation Box – Bitcoin & Crypto Donations versions = 2.2.13...

WordPress Document Gallery plugin <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by 刀 妖 in WordPress Plugin Document Gallery versions = 5.1.1...

WordPress Social Share Buttons & Analytics Plugin – GetSocial.io plugin <= 4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Alz in WordPress Plugin Social Share Buttons & Analytics Plugin – GetSocial.io versions = 4.5...

WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Theme XStore versions 9.7.9...

CVE-2026-104250 unstructured: Stored XSS via unescaped HTML generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250 unstructured: Stored XSS via unescaped HTML generation

The unstructured library provides open-source components for ingesting and pre-processing images and text documents, such as PDFs, HTML, Word docs, and many more. Prior to 0.24.1, partitionhtmlhtmlparserversion="v2" and the VLM partitioner can preserve untrusted document tags, attributes, text, a...

CVE-2026-104250

The unstructured library is vulnerable to Stored XSS prior to version 0.24.1 . The root cause is that the to_html() path in unstructured/documents/ontology.py fails to escape output or reject unsafe URL schemes when using partition_html(html_parser_version="v2") or the VLM partitioner . This allo...

CVE-2025-60503

CVE-2025-60503 — Stored Cross-Site Scripting XSS in UltimatePOS UltimateFosters v4.8 Publication date: 2025-10-30 CVE ID: CVE-2025-60503 RESERVED Researcher: Vivien Lebas Vendor: UltimateFosters Product: UltimatePOS Affected version: 4.8 Vulnerability type: Stored Cross-Site Scripting XSS Severit...

CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562 Cronicle: Stored XSS in admin Activity Log via account full_name field

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.119, the administrator Activity Log in htdocs/js/pages/admin/Activity.js concatenates the attacker-controlled item.user.fullname value into HTML without applying encodeentities and inserts the result...

CVE-2026-55562

Cronicle, a multi-server task scheduler and runner, contains a Stored XSS vulnerability in the administrator Activity Log prior to version 0.9.119 . The flaw exists in htdocs/js/pages/admin/Activity.js, where the item.user.full_name value is concatenated into HTML without proper encoding. Attacke...

AZL-108042 CVE-2026-49264 affecting package python-oauthlib 3.2.2-3

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

DEBIAN-CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...

CVE-2024-34321

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint...

CVE-2024-34326

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting XSS vulnerability via the PageTitle/Alert/MsgType parameter in the errorHandler.aspx endpoint...

CVE-2026-49264

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enablejsonp=Tru...