PT-2026-63355

n8n before 1.123.64, 2.x before 2.29.8, and before 2.30.1 contains a DOM-based cross-site scripting vulnerability in the HTML preview, which renders execution output into an iframe srcdoc without the sandbox attribute. A sanitizer bypass allows injected script to execute same-origin as the editor...

Plone 2.5.5 < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20170117)

The version of Plone installed on the remote host is 2.5.5 prior to 4.3.12, or 5.0.x prior to 5.0.7. It is, therefore, affected by the following vulnerabilities: - Cross-site scripting XSS vulnerability in the managefindResult component in the search feature in Zope ZMI in Plone allows remote...

Plone 3.3.x < 4.3.12 / 5.0.x < 5.0.7 Multiple Vulnerabilities (HF 20160830)

The version of Plone installed on the remote host is 3.3.x prior to 4.3.12, or 5.0.x 5.0.7. It is, therefore, affected by the following vulnerabilities: - Directory traversal vulnerability in Plone CMS allows remote administrators to read arbitrary files via a .. dot dot in the path parameter in ...

Plone 4.3.x < 5.2.5 Multiple Vulnerabilities (HF 20210518)

The version of Plone installed on the remote host is 4.3.x prior to 5.2.5. It is, therefore, affected by the following vulnerabilities: - Plone CMS has a stored Cross-Site Scripting XSS vulnerability in the user fullname property and the file upload functionality. CVE-2021-3313 -...

CVE-2026-16485

A vulnerability has been found in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /class.php. Such manipulation of the argument day leads to cross site scripting. The attack can be launched remotely. The exploit has been...

GHSA-CJ75-F6XR-R4G7 Rails HTML Sanitizers: Possible XSS vulnerability with certain configurations

Summary There is a possible cross-site scripting vulnerability in rails-html-sanitizer when the sanitizer is configured to allow an SVG reference element such as . See related GHSA-9wjq-cp2p-hrgf in Loofah, whose SVG local-reference logic rails-html-sanitizer mirrors. - Versions affected: = 1.0.3...

CVE-2026-47687 FOGProject has stored XSS via unescaped option label in selectForm() accessible from unauthenticated inventory endpoint

FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the selectForm helper in fogpage.class.php renders labels using raw, unescaped user input. An unauthenticated attacker who knows any registered host's MAC address...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

CVE-2026-55081 DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the scope query parameter into the generated HTML document without sufficient sanitization. A crafted scope value could be rendered a...

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx() Utility

NPM: Hono: Server-Side XSS via JSX Escaping Bypass in cx Utility vulnerability discovered by ? in WordPress Npm hono versions = 4.0.0, 4.12.27...

CVE-2026-64823 Home Assistant Core < 2026.5.4 XSS via Shelly media_player.py thumb URI

Home Assistant Core before 2026.5.4 contains a cross-site scripting vulnerability in the Shelly integration's asyncgetmediaimage method that allows attackers controlling a Shelly device's thumb field to serve arbitrary HTML content by supplying a data URI with a text/html content type without...

GHSA-8WHX-365G-H9VV Loofah `allowed_uri?` does not detect `javascript:` URIs split by named whitespace character references

Summary Loofah::HTML5::Scrub.alloweduri? does not correctly reject javascript: URIs when the scheme is split or prefixed by the HTML5 named character references tab or line feed. This is a bypass of the fix for GHSA-46fp-8f5p-pf2m, which handled the equivalent numeric character references , , but...

CVE-2026-15156

CVE-2026-15156 affects the WordPress plugin “Essential Addons for Elementor – Popular Elementor Templates & Widgets” up to version 6.6.11. Root cause: insufficient input sanitization and output escaping leading to a Stored Cross-Site Scripting (XSS) vulnerability. Impact: authenticated users with...

NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement (incomplete fix for CVE-2026-54298)

NPM: Astro: XSS via unescaped spread attribute names in renderHTMLElement incomplete fix for CVE-2026-54298 vulnerability discovered by ? in WordPress Npm astro versions 7.0.6...

GHSA-G97X-GVCM-X72H Mistune: XSS via unescaped class option in Admonition directive

In src/mistune/directives/admonition.py, the renderadmonition function concatenates the :class: option directly into the HTML class attribute without escaping lines 63-68. This allows attribute injection and XSS even when HTMLRendererescape=True is used. The directive name parameter is safe...

GHSA-8C25-4J27-2RV3 Mistune: XSS via percent-encoded javascript URI bypass in safe_url()

Summary An XSS vulnerability in Mistune allows bypassing of safeurl protections via percent-encoded javascript URIs. Details The vulnerability exists in HTMLRenderer.safeurl in Mistune. The function is intended to block harmful URL schemes such as "javascript:" by checking the prefix of the...

CVE-2026-12900

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the uagb/image block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-44230 RT: Reflected Cross-Site Scripting in search results chart

RT is an open source, enterprise-grade issue and ticket tracking system. Versions 5.0.4 up to but not including 5.0.10, and 6.0.0 up to but not including 6.0.3 contain a reflected Cross-Site Scripting XSS vulnerability where an attacker who can induce an authenticated RT user to visit a crafted U...

CVE-2026-60028

Joomla Extension - themexpert.com - Authenticated stored XSS in Quix Page Builder 6.2.1 - The Joomla extension Quix Page Builder Pro is vulnerable to an authenticated stored XSS vulnerability. Authenticated builder user could inject scripts, fires for any visitor or admin viewing the page...

CVE-2026-60029

The CVE concerns Joomla extension Quix Page Builder Pro (thethemexpert) with an authenticated stored XSS flaw. The issue allows an authenticated builder user to break out of id/class fields that render to public pages. Affected version(s) are Quix Page Builder Pro before 6.2.1; remediation is upg...