CVE-2026-104083 | Medium | 6.1 | 2026-10-09 | SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing… |
CVE-2026-94066 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affect… |
CVE-2026-94063 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS… |
CVE-2026-92085 | Medium | 5.4 | 2026-10-09 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Indus… |
CVE-2026-94061 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club al… |
CVE-2026-94060 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue… |
CVE-2026-94059 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue… |
CVE-2026-94058 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue af… |
CVE-2026-62029 | Medium | 6.5 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This… |
CVE-2026-105870 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-… |
CVE-2026-105318 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows… |
CVE-2026-62039 | Medium | 6.5 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Sto… |
CVE-2026-96761 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XS… |
CVE-2026-96607 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows… |
CVE-2026-96553 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows… |
CVE-2026-96332 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected… |
CVE-2026-95609 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assis… |
CVE-2026-95608 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Ref… |
CVE-2026-95598 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflect… |
CVE-2026-95596 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builde… |
CVE-2026-95591 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking… |
CVE-2026-94668 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system… |
CVE-2026-94667 | Medium | 6.5 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This… |
CVE-2026-94665 | Medium | 6.5 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allo… |
CVE-2026-94661 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This iss… |
CVE-2026-94641 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue a… |
CVE-2026-94632 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blocks… |
CVE-2026-94415 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This iss… |
CVE-2026-94170 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share all… |
CVE-2026-94167 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflecte… |
CVE-2026-94166 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.T… |
CVE-2026-94161 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflec… |
CVE-2026-94159 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS… |
CVE-2026-94158 | High | 7.1 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Refl… |
CVE-2026-62049 | Medium | 6.5 | 2026-10-09 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stor… |
CVE-2026-4264 | | | 2026-10-09 | Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper… |
CVE-2026-106155 | High | 8.9 | 2026-10-09 | In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authent… |
CVE-2026-81929 | High | 7.2 | 2026-10-09 | The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions… |
CVE-2026-107889 | Medium | 5.5 | 2026-10-09 | A flaw was found in the login theme rendering component of Keycloak. The issue occurs because the security filter responsible for cleaning user input can be by… |
CVE-2026-107801 | Medium | 5.4 | 2026-10-08 | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by uploading attachments wi… |
CVE-2026-107800 | Medium | 5.4 | 2026-10-08 | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script into private short messages beca… |
CVE-2026-107799 | Medium | 5.4 | 2026-10-08 | Jivejdon through 5.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject script by posting unsanitized forum mes… |
CVE-2026-107798 | Medium | 5.4 | 2026-10-08 | jivejdon from commit 595d8d22 through commit ee67a65e contains a stored cross-site scripting vulnerability in the default-enabled TextStyle filter that inserts… |
CVE-2026-107797 | Medium | 6.1 | 2026-10-08 | Jivejdon through 5.0 contains a reflected cross-site scripting vulnerability in application/message/postThread.jsp that allows attackers to inject script via t… |
CVE-2026-107796 | Medium | 6.1 | 2026-10-08 | Jivejdon from commit 5489372d through commit ee67a65e contains a reflected cross-site scripting vulnerability in application/query/taggedThreadList.jsp that al… |
CVE-2026-105269 | Medium | 6.8 | 2026-10-08 | Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could… |
CVE-2026-78407 | Medium | 5.4 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 are vulnerable to cross-site scripting. This vulnerability… |
CVE-2026-17189 | High | 8.2 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 is vulnerable to cross-site scripting. This vulnerability a… |
CVE-2026-11936 | Medium | 4.9 | 2026-10-08 | IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 local management interface in certain configurations is vul… |
CVE-2026-107397 | Medium | 4.4 | 2026-10-08 | Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content… |
CVE-2026-84244 | Critical | 9.3 | 2026-10-08 | IBM Guardium Data Protection 12.2 IBM Security Guardium Data Protection is vulnerable to stored cross-site scripting (XSS) in the Quick Search results grid. An… |
CVE-2026-107393 | Medium | 6.1 | 2026-10-08 | FreeScout is a self-hosted help desk and shared mailbox. Prior to 1.8.235, when APP_CLOUDFLARE_IS_USED is enabled, FreeScout trusts an unvalidated CF-Connectin… |
CVE-2026-40804 | High | 7.1 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This iss… |
CVE-2026-107380 | Medium | 5.4 | 2026-10-08 | savg-sanitizer is a PHP SVG/XML sanitizer. Prior to 1.0.0, svg-sanitizer's isHrefSafeValue() validates an SVG href after XML DTD entity expansion, but saveXML(… |
CVE-2026-107303 | High | 7.6 | 2026-10-08 | JHipster is a development platform to quickly generate, develop, and deploy modern web applications and microservice architectures. Prior to generator-jhipster… |
CVE-2026-104078 | High | 7.8 | 2026-10-08 | Obsidian Desktop before 1.14.0 contains a filter bypass vulnerability in the bundled MathJax 3.2.2 Safe component that allows attackers to execute arbitrary co… |
CVE-2026-104077 | High | 7.8 | 2026-10-08 | Obsidian Desktop before 1.14.0 contains a remote code execution vulnerability that allows attackers to craft malicious Markdown notes exploiting insufficient s… |
CVE-2026-13258 | Medium | 5.4 | 2026-10-08 | IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site… |
CVE-2026-105831 | Medium | 4.3 | 2026-10-08 | EspoCRM before 10.0.6 contains a stored HTML injection vulnerability that allows unauthenticated attackers to inject HTML by submitting crafted Lead Capture pu… |
CVE-2026-27420 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This is… |
CVE-2026-14990 | Critical | 9.3 | 2026-10-08 | IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary Ja… |
CVE-2026-62127 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allo… |
CVE-2026-105890 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks… |
CVE-2026-105887 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This… |
CVE-2026-105079 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-m… |
CVE-2026-105078 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows… |
CVE-2026-103070 | Medium | 6.5 | 2026-10-08 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-op… |
CVE-2026-103647 | High | 8.0 | 2026-10-08 | Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to r… |
CVE-2026-89191 | Medium | 6.8 | 2026-10-08 | Unsanitised input in
the "template name" field of SQLView KRIS's Workflow Template feature
is rendered in "onclick" attributes on the main dashboard without
pr… |
CVE-2026-104646 | Medium | 6.8 | 2026-10-08 | The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through i… |
CVE-2026-103309 | High | 7.5 | 2026-10-08 | The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in transl… |
CVE-2023-5648 | | | 2026-10-08 | In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attacker… |
CVE-2026-94154 | Medium | 6.1 | 2026-10-08 | The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to… |
CVE-2026-95595 | High | 7.1 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Fontsplugin Disable and Remove Google Fonts | GDPR & DSGV… |
CVE-2026-94670 | High | 7.1 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms allows Reflected XSS.
This issue affects E… |
CVE-2026-94662 | High | 7.1 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free… |
CVE-2026-107272 | Medium | 4.7 | 2026-10-07 | Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP ser… |
CVE-2025-70519 | Medium | 6.1 | 2026-10-07 | The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization… |
CVE-2026-102258 | Medium | 6.1 | 2026-10-07 | Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific con… |
CVE-2026-97294 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assis… |
CVE-2026-105884 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored… |
CVE-2026-105875 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Prime Slider – Addons For Elementor bdthemes-pri… |
CVE-2026-105873 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-p… |
CVE-2026-105871 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-p… |
CVE-2026-104393 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons… |
CVE-2026-104391 | Medium | 6.5 | 2026-10-07 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allow… |
CVE-2026-93684 | Medium | 5.4 | 2026-10-07 | An SQL user using Impala up to and including version 4.5.2 with only SELECT permission can put JavaScript in a table alias and make it run in another user's br… |
CVE-2026-89417 | High | 7.2 | 2026-10-07 | The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comm… |
CVE-2025-64392 | | | 2026-10-07 | This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link. |
CVE-2026-87971 | High | 7.1 | 2026-10-07 | The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an a… |
CVE-2026-105316 | High | 7.1 | 2026-10-07 | The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated… |
CVE-2026-104653 | Medium | 6.8 | 2026-10-07 | The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outpu… |
CVE-2026-104652 | Medium | 6.8 | 2026-10-07 | The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allow… |
CVE-2026-102173 | High | 7.2 | 2026-10-07 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in… |
CVE-2026-14911 | | | 2026-10-07 | Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, m… |
CVE-2026-96594 | Medium | 6.1 | 2026-10-06 | The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/media/{filepath}` wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the respo… |
CVE-2026-79816 | Medium | 6.3 | 2026-10-06 | A vulnerability in a client interface of HPE Networking ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a DOM-based cross-si… |
CVE-2026-79799 | High | 8.8 | 2026-10-06 | A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct a stored cross-site… |
CVE-2026-105111 | Medium | 4.7 | 2026-10-06 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL.
This only happens when you're usi… |
CVE-2026-103667 | Medium | 5.4 | 2026-10-06 | Gitea's container registry served blob downloads with a `Content-Type` taken from the media type declared in pushed image manifests, without a `Content-Disposi… |