CVE-2026-58390

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

CVE-2026-111095

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible...

CVE-2026-111096

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible...

WordPress Quick Paypal Payments Cross-Site Script Vulnerability

WordPress versions prior to 6.0.4 have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'form' parameter, allowing stored cross-site scripts to be executed by authenticated attackers with contributor or higher privileges...

extendthemes colibri page builder cross-site scripting vulnerability

The extendthemes colibri page builder versions 1.0.390 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the comment parameter, which may lead to stored-cross-site scripting attacks. Unauthenticated attackers c...

Nexcess The Events Calendar: Cross-site Scripting Vulnerability

Nexcess The Events Calendar versions 6.18.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and could lead to storage-based cross-site scripting attacks...

SiteOrigin CSS Cross-Site Scripting Vulnerabilities

SiteOrigin CSS 1.6.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and output escaping. It involves a DOM-based cross-site scripting attack via the 'url commentauthorurl' parameter. Unauthenticated attackers can inject...

WordPress Dark Mode Cross-Site Script Vulnerability

WordPress Dark Mode 5.3.17 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input cleaning and insufficient output escaping through the 'icon-light' short-code attribute, which may lead to storage-based cross-site scripting attacks...

WordPress MapSVG Cross-Site Script Vulnerabilities

WordPress MapSVG versions 8.16.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and it may lead to stored-cross-site scripting attacks...

HivePress cross-site scripting vulnerability

HivePress versions 1.7.32 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of input parameters such as '' e.g., hpcustomlink' and inadequate escaping of output data. As a result, stored cross-site scripts allow unauthenticated attackers to...

WordPress Social Share Buttons Cross-site Script Vulnerabilities

Versions of WordPress Social Share Buttons prior to 1.30 have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'form containing shareurl' parameter, which may lead to stored cross-site scripting attacks. Attackers with...

Arcadia Technology Crafty Controller has a vulnerability related to improper output processing

The Arcadia Technology Crafty Controller 4.10.8 and earlier versions have a vulnerability in output processing. This vulnerability stems from improper output escaping in the Audit Logs component. A remote, unauthenticated attacker can execute a stored-xss attack through HTTP header injection...

Arcadia Technology Crafty Controller Cross-site Scripting Vulnerability

The Arcadia Technology Crafty Controller versions from 4.2.0 to 4.11.0 have a cross-site scripting vulnerability. This vulnerability stems from improper handling of the Webhook URL form field component inputs. It may allow remotely authenticated attackers to execute stored-xss attacks through...

Checkmk Input Validation Vulnerability

Versions of Checkmk prior to 2.5.0p15, 2.4.0p38, 2.3.0p51, and 2.2.0 contain a vulnerability related to input validation errors. This vulnerability stems from improper validation of the reseturl parameter during the Setup page. It may allow attackers to trick users into opening a specially crafte...

Actual WPeMatico RSS Feed Fetcher Cross-Site Script Vulnerability

The etruel WPeMatico RSS Feed Fetcher 2.9 and earlier versions had a cross-site scripting vulnerability. This vulnerability occurred because the plugin removed the WordPress wpfilterpostkses filter before calling wpinsertpost. Additionally, the imported RSS content was stored without any...

Softaculous GoSMTP Pro cross-site scripting vulnerability

Softaculous GoSMTP Pro versions 1.2.3 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, making it susceptible to storage-type cross-site scripting attacks via comment content within the email log text. In WordPres...

WordPress Gwolle Guestbook Cross-site Scripting Vulnerability

WordPress Gwolle Guestbook versions 5.1.1 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping of the 'permalink' parameter, allowing for reflected cross-site scripting. Unauthorized attackers can inject arbitrary web...

WordPress SureDash Cross-Site Script Vulnerability

WordPress SureDash versions 1.12.0 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping, resulting in stored-cross-site scripting. Attackers can inject arbitrary web scripts through the displayname parameter. This...

Franky Van Liedekerke – Events Made Easy: Cross-site Scripting Vulnerabilities

Franky Van Liedekerke Events Made Easy versions 3.2.22 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the eventlocationname parameter input and inadequate escaping of output data. It may lead to stored-cross-site scripting attacks,...

WordPress Premium Packages Cross-Site Script Vulnerabilities

WordPress Premium Packages 7.2.8 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient cleaning of the 'note' parameter input and inadequate escaping of output data. It results in a storage-type cross-site script attack. Attackers with...