Export limit exceeded: 50395 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (50395 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-87780 | 2026-10-10 | 8.8 High | ||
| The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it. | ||||
| CVE-2026-107323 | 2026-10-10 | 6.8 Medium | ||
| The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators. | ||||
| CVE-2026-104754 | 2026-10-10 | 3.5 Low | ||
| The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite. | ||||
| CVE-2026-102402 | 2026-10-10 | 6.4 Medium | ||
| The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttp_filter_taxonomy (meta of the attacker-chosen post)' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-105079 | 2026-10-10 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52. | ||||
| CVE-2026-79363 | 1 Cloudron | 1 Cloudron | 2026-10-10 | 5.9 Medium |
| Cloudron 9.1.7 and 9.2 contain a stored cross-site scripting (XSS) vulnerability in the Branding Footer feature. An authenticated administrator can store crafted HTML containing JavaScript event handlers in the Footer setting. The stored value is rendered without sufficient sanitization on the public login / OpenID interaction page and in the System Event Log, causing attacker-controlled JavaScript to execute in the Cloudron web origin when an affected page is viewed. | ||||
| CVE-2026-62049 | 2026-10-09 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1. | ||||
| CVE-2026-107845 | 1 Contao | 1 Contao | 2026-10-09 | 9.3 Critical |
| Contao is an Open Source CMS. From version 4.0.0 until 5.3.50 and 5.7.12, an unauthenticated visitor can submit a comment whose email or website metadata is rendered without sufficient attribute and URL encoding by listComments() in comments-bundle/contao/dca/tl_comments.php. When a backend user opens the Comments module, attacker-controlled script can execute in the Contao backend origin under that user's session. Unpublished comments remain visible to moderators, so moderation does not prevent exposure. This issue is fixed in versions 5.3.50 and 5.7.12. | ||||
| CVE-2026-97289 | 2026-10-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6. | ||||
| CVE-2026-96607 | 2026-10-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1. | ||||
| CVE-2026-95598 | 2026-10-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5. | ||||
| CVE-2026-94668 | 2026-10-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5. | ||||
| CVE-2026-94161 | 2026-10-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11. | ||||
| CVE-2026-94066 | 2026-10-09 | 7.1 High | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1. | ||||
| CVE-2026-62029 | 2026-10-09 | 6.5 Medium | ||
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3. | ||||
| CVE-2026-4264 | 1 Beetienda | 1 Ecommerce Platform | 2026-10-09 | N/A |
| Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser. | ||||
| CVE-2026-106155 | 1 Progress Software | 1 Telerik Report Server | 2026-10-09 | 8.9 High |
| In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session. | ||||
| CVE-2026-92085 | 2026-10-09 | 5.4 Medium | ||
| Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1. | ||||
| CVE-2025-7872 | 1 Portabilis | 1 I-diario | 2026-10-09 | 3.5 Low |
| A weakness has been identified in Portabilis i-Diario 1.5.0. This affects an unknown function of the file /justificativas-de-falta. Executing a manipulation of the argument Justificativa can lead to cross site scripting. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. This patch is called 821342cd8d952e8bd214cb16145da785a92f5681. Applying a patch is advised to resolve this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output". | ||||
| CVE-2025-7871 | 1 Portabilis | 1 I-diario | 2026-10-09 | 3.5 Low |
| A security flaw has been discovered in Portabilis i-Diario 1.5.0. The impacted element is an unknown function of the file /conteudos. Performing a manipulation of the argument filter[by_description] results in cross site scripting. The attack may be initiated remotely. The exploit has been released to the public and may be used for attacks. The patch is named d076c112b45e3b3e41cbe11de27949b491d922c2. It is recommended to apply a patch to fix this issue. The vendor confirms: "The searched term is now rendered escaped in the autocomplete widget, and the content tags are rendered through output-escaped templates, so an injected payload is displayed as inert text instead of being executed." | ||||