WordPress Import and export users and customers plugin <= 2.4.5 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Luca Laytynher LyT in WordPress Plugin Import and export users and customers versions = 2.4.5...

WordPress Kirki – Freeform Page Builder, Website Builder & Customizer plugin <= 6.2.0 - Authenticated (Custom+) Stored Cross-Site Scripting vulnerability

Authenticated Custom+ Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin Kirki versions = 6.2.0...

Groundhogg cross-site scripting vulnerability

Groundhogg versions 4.5.14 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'ref' parameter, which may lead to stored-cross-site scripting attacks. Unauthenticated attackers can inject any web script into...

Mayer Balint GYM One Cross-site Scripting Vulnerability

Mayer Balint GYM versions prior to 1.4.1 have a cross-site scripting vulnerability. This vulnerability arises from the fact that the admin/users/index.php file does not encode the stored firstname, lastname, and email fields using HTML. This may lead to a stored-cross-site scripting attack...

Kitae Park Mang Board Cross-site Scripting Vulnerability

Kitae Park Mang Board 2.4.0 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'datatype' parameter input and inadequate escaping of output, allowing for storage-type cross-site scripting attacks. Unauthenticated attackers ca...

Aureus ERP cross-site scripting vulnerability

Aureus ERP versions 1.6.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from the fact that holiday names are rendered as HtmlString without proper escaping in the HolidayAction.php file. This can lead to storage-type cross-site scripting attacks. Authenticated...

WordPress Social Share Buttons Cross-site Script Vulnerabilities

Versions of WordPress Social Share Buttons prior to 1.31 have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and it may lead to stored-xss attacks...

WordPress YITH WooCommerce Compare: Cross-site Script Vulnerability

WordPress YITH WooCommerce Compare 3.15.0 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation, which may lead to storage-based cross-site scripting attacks...

PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability

A stored cross-site scripting XSS vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a JavaScript payload using the web interface. The security risk posed by this issue is minimized when the management interface is restricted t...

CVE-2026-110626

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

CVE-2026-110625

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

CVE-2026-110627

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-89069 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer Ad Hoc module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89069 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer Ad Hoc module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...

CVE-2026-89069

Progress MOVEit Transfer contains a Stored Cross-Site Scripting (XSS) vulnerability within the Ad Hoc module caused by improper neutralization of input during web page generation. This issue affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . The vulnerability carries a ...

freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL

A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...

CVE-2026-107870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

EUVD-2026-101255

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-110627

ClipBucket versions v5 through 5.5.3-#206 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the admin_area/index.php component. The root cause is the improper neutralization of input in the val parameter when mode=add_todo is used. An attacker can leverage this to inje...