CVE-2026-108168 WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

CVE-2026-108168

The Custom Query Blocks plugin for WordPress (versions ≤ 5.6.0 ) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw is caused by Improper Neutralization of Input During Web Page Generation within the post-type-archive-mapping component. This allows an attacker to execute malicio...

EUVD-2026-97295

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0...

WordPress Custom Query Blocks plugin <= 5.6.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by V1T in WordPress Plugin Custom Query Blocks versions = 5.6.0...

CVE-2026-108815 idcCMS member_deal.php cross site scripting

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

CVE-2026-108815

A vulnerability exists in idcCMS 1.70 affecting an unknown function within the admin/member_deal.php file. This flaw allows for remote cross-site scripting (XSS) . The exploit has been disclosed to the public and may be used. Specific remediation steps or detailed root cause analysis are not prov...

EUVD-2026-97294

A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/memberdeal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used...

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Erik Debye in WordPress Plugin Paid Videochat Turnkey Site versions = 7.5.12...

CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

UBUNTU-CVE-2026-48212

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-48212

An Stored XSS vulnerability exists in OTRS (versions 7.0.X, 8.0.X, 2023.X, 2024.X, 2025.X, and 2026.X before 2026.7.X). An administrator can inject arbitrary JavaScript into the content of an OTRS Custom Page . The application stores this malicious script, which is then executed in the browser of...

CVE-2026-48212 Stored XSS in external pages

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

EUVD-2026-97264

An OTRS administrator can enter arbitrary JavaScript into the content of an OTRS Custom Page, which is stored by the application and subsequently executed in the browser of users accessing that page. This issue affects OTRS: 7.0.X 8.0.X 2023.X 2024.X 2025.X 2026.X before 2026.7.X...

CVE-2026-108802

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...

CVE-2025-15703

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

EUVD-2025-211060

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703 WP Job Openings < 4.0.0 - Admin+ Stored XSS

The HireZoot WordPress plugin before 4.0.0 does not sanitise and escape one of its job specification settings before it is reflected back into an admin-area settings page, allowing users with the HireZoot WordPress plugin before 4.0.0's management capability Administrator by default to store a...

CVE-2025-15703

The HireZoot WordPress plugin versions prior to 4.0.0 is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape one of the job specification settings before it is reflected on an admin-area settings page. This allows users with management cap...

EUVD-2026-97234

A weakness has been identified in yproject RuoYi up to 4.8.3. This affects the function renderDrawer of the file /system/dict/data/add of the component Dictionary Data Drawer Preview. Executing a manipulation of the argument cssClass can lead to cross site scripting. The attack may be performed...