CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894 phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Stored XSS via iframe data: URI

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

EUVD-2026-103325

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894

phpMyFAQ 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability that allows authenticated content authors to inject JavaScript by embedding iframes with data:text/html sources in FAQ or News content. Attackers can bypass the hostless media-host...

CVE-2026-111894

The software phpMyFAQ (versions 3.2.1 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is a failure in the FaqHelper::cleanUpContent() function, which allows authenticated content authors to bypass the hostless media-host al...

CVE-2026-109701

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

CVE-2026-109701 WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

EUVD-2026-103285

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

CVE-2026-109701 WordPress PAYCOMET for WooCommerce plugin <= 5.45 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

CVE-2026-109701

The PAYCOMET for WooCommerce WordPress plugin (versions ≤ 5.45 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) issue. The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to execute malicious scripts in a user's browser...

NSquared Simply Schedule Appointments Cross-site Script Vulnerability

NSquared Simply Schedule Appointments 1.6.12.35 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and it may lead to storage-type cross-site scripting attacks...

Automatic1111 Stable Diffusion web UI cross-site scripting vulnerability

Automatic1111 Stable Diffusion’s web UI versions prior to 1.10.1 have a security vulnerability. This vulnerability stems from an incorrect operation of the readmetadatafromsafetensors function in the Extra-Networks Card Builder component, specifically in the modules/sdmodels.py file. This incorre...

Hrisikesh Pal Blood_Bank_Management_System Cross-site Scripting Vulnerability

Hrisikesh Pal BloodBankManagementSystem 1.0.0 has a security vulnerability. This vulnerability stems from incorrect handling of parameters in the Search field within the file/abs.php, which may lead to cross-site scripting attacks...

Automatic1111 Stable Diffusion web UI cross-site scripting vulnerability

Automatic1111 Stable Diffusion’s web UI versions prior to 1.10.1 have a security vulnerability. This vulnerability stems from an incorrect handling of the parameter filename in the createitemhtml function within the Card Builder component. This could lead to cross-site scripting attacks...

TheWebShop Bootstrap Shortcodes Development Workflow Cross-site Script Vulnerabilities

TheWebShop Bootstrap Shortcodes Development Workflow: Versions prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability occurred when the ID attribute of the bstcontent shortcode was output into HTML attributes without proper quotation marks, and spaces were not encoded...

ThemeGrill eStore Cross-Site Scripting Vulnerability

ThemeGrill eStore versions 1.6.13 and earlier have a cross-site scripting vulnerability. This vulnerability arises from improper input during web page generation, which may lead to reflection-type cross-site scripting attacks...

WordPress Tutor LMS plugin <= 4.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by jydae in WordPress Plugin Tutor LMS versions = 4.1.2...

WordPress Quiz Maker plugin <= 6.7.1.91 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Taegyeong Yun in WordPress Plugin Quiz Maker versions = 6.7.1.91...

CVE-2026-111110

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-109983

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...