On this page
Atomicorp WAF Rule 346755
Rule Summary
- Rule ID: 346755
- Status: Active
- Alert message: Atomicorp.com WAF Rules: Javascript method detected
- Observed CWEs: CWE-20 (15), CWE-22 (5), CWE-73 (1), CWE-74 (8), CWE-77 (2), CWE-78 (5), CWE-79 (1912), CWE-80 (22), CWE-83 (4), CWE-87 (11), CWE-89 (11), CWE-94 (332), CWE-95 (2), CWE-113 (1), CWE-116 (16), CWE-183 (1), CWE-184 (1), CWE-185 (1), CWE-200 (6), CWE-264 (3), CWE-269 (1), CWE-287 (2), CWE-290 (1), CWE-295 (2), CWE-306 (4), CWE-310 (2), CWE-327 (1), CWE-345 (3), CWE-352 (10), CWE-384 (1), CWE-425 (1), CWE-434 (13), CWE-436 (1), CWE-444 (1), CWE-489 (1), CWE-502 (5), CWE-521 (1), CWE-601 (6), CWE-610 (1), CWE-611 (2), CWE-625 (1), CWE-639 (2), CWE-640 (1), CWE-665 (1), CWE-693 (1), CWE-697 (1), CWE-732 (2), CWE-749 (1), CWE-798 (2), CWE-862 (2), CWE-863 (1), CWE-917 (1), CWE-918 (4), CWE-1004 (2), CWE-1188 (1), CWE-1321 (2), CWE-1336 (2)
- Phase: 2 (request body)
- Request surfaces: Request filename, Request cookies, Request argument names, Request arguments, JSON request data, SOAP request data
- Rule action: deny
- HTTP status: 403
- Public tags: application-multi, attack-xss, language-multi, platform-nodejs
- Logging: inherited from SecDefaultAction
Description
This rule detects behavior identified by its current alert as “Javascript method detected” in the request filename, request cookies, request argument names, request arguments, JSON request data, SOAP request data. It evaluates during the request body phase and denies matching traffic with HTTP status 403.
Selected Related CVEs
This is a selected list of documented research observations, not an exhaustive coverage matrix. Absence of a CVE does not imply absence of protection.
| CVE | Vulnerability | Product | CVSS | Severity |
|---|---|---|---|---|
| CVE-2011-10013 | Traq admincp/common.php Remote Code Execution | Issue Tracking System | 10.0 (v4.0) | Critical |
| CVE-2025-32432 | Craft CMS Image Transform Preauth RCE (CVE-2025-32432) | craft cms | 10.0 (v3.1) | Critical |
| CVE-2026-106102 | Quasar Framework: Stored/Reflected XSS via unescaped SSR meta tag rendering in getHead() | quasar | 10.0 (v3.1) | Critical |
| CVE-2026-40911 | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side | avideo | 10.0 (v3.1) | Critical |
| CVE-2016-9269 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 9.9 (v3.0) | Critical |
| CVE-2026-50551 | SiYuan: Stored XSS to RCE via Unsanitized Attribute View Asset Cell Content | siyuan | 9.9 (v3.1) | Critical |
| CVE-2026-54067 | SiYuan: Stored XSS to RCE via CSS-snippet <style> breakout in renderSnippet() | siyuan | 9.9 (v3.1) | Critical |
| CVE-2012-1259 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 9.8 (v3.1) | Critical |
| CVE-2012-5686 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 9.8 (v3.1) | Critical |
| CVE-2014-8684 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical |
| CVE-2014-8686 | Seagate Business NAS Unauthenticated Remote Command Execution | codeigniter | 9.8 (v3.0) | Critical |
| CVE-2014-8687 | Seagate Business NAS Unauthenticated Remote Command Execution | business nas firmware | 9.8 (v3.0) | Critical |
| CVE-2015-4664 | Xceedium Xsuite - Multiple Vulnerabilities | privileged access manager | 9.8 (v3.0) | Critical |
| CVE-2015-4667 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 9.8 (v3.0) | Critical |
| CVE-2016-5734 | phpMyAdmin Authenticated Remote Code Execution | phpmyadmin | 9.8 (v3.0) | Critical |
| CVE-2018-17440 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 9.8 (v3.0) | Critical |
| CVE-2018-6220 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6223 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6228 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2018-6229 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 9.8 (v3.0) | Critical |
| CVE-2020-28188 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | tos | 9.8 (v3.1) | Critical |
| CVE-2020-35665 | TerraMaster TOS 4.2.06 or lower - Unauthenticated Remote Code Execution | terramaster operating system | 9.8 (v3.1) | Critical |
| CVE-2020-5847 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 9.8 (v3.1) | Critical |
| CVE-2021-26084 | Atlassian Confluence WebWork OGNL Injection | confluence data center | 9.8 (v3.1) | Critical |
| CVE-2022-29316 | Complete Online Job Search System 1.0 - Cross-Site Scripting | complete online job search system | 9.8 (v3.1) | Critical |
| CVE-2022-47966 | ManageEngine Endpoint Central Unauthenticated SAML RCE | manageengine access manager plus | 9.8 (v3.1) | Critical |
| CVE-2023-1719 | Bitrix Component - Cross-Site Scripting | bitrix24 | 9.8 (v3.1) | Critical |
| CVE-2024-2054 | Artica Proxy Unauthenticated PHP Deserialization Vulnerability | artica proxy | 9.8 (v3.1) | Critical |
| CVE-2024-23759 | Gambio Online Webshop unauthenticated PHP Deserialization Vulnerability | gambio | 9.8 (v3.1) | Critical |
| CVE-2024-31026 | Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability | - | 9.8 (v3.1) | Critical |
| CVE-2025-44136 | MapTiler Tileserver-php v2.0 - Unauthenticated XSS | tileserver php | 9.8 (v3.1) | Critical |
| CVE-2025-44148 | MailEnable Mail Service < v10 - Cross-Site Scripting | mailenable | 9.8 (v3.1) | Critical |
| CVE-2026-104252 | Vitess vttablet /twopcz reflected XSS | vitess | 9.8 (v3.1) | Critical |
| CVE-2026-67688 | ICS-Park Smart Park Management System v2.0 Arbitrary Code Execution Vulnerability | ICS-Park Smart Park Management System v2.0 | 9.8 (v3.1) | Critical |
| CVE-2020-20982 | shadoweb wdja v1.5.1 - Cross-Site Scripting | wdja cms | 9.6 (v3.1) | Critical |
| CVE-2021-32853 | Erxes <0.23.0 - Cross-Site Scripting | erxes | 9.6 (v3.1) | Critical |
| CVE-2023-1892 | Sidekiq < 7.0.8 - Cross-Site Scripting | sidekiq | 9.6 (v3.1) | Critical |
| CVE-2023-48974 | Axigen < 10.5.7 - Persistent Cross-Site Scripting | axigen mail server | 9.6 (v3.1) | Critical |
| CVE-2025-67744 | Mermaid XSS vulnerability leads to Remote Code Execution | deepchat | 9.6 (v3.1) | Critical |
| CVE-2026-47428 | Vitest browser mode serves unsanitized otelCarrier query parameter as inline script | vitest | 9.6 (v3.1) | Critical |
| CVE-2026-54694 | NationalSecurityAgency/skills-service has Stored XSS via User Registration Enabling Admin Account Takeover | skills-service | 9.6 (v3.1) | Critical |
| CVE-2026-55085 | Etherpad: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in etherpad-lite | etherpad | 9.6 (v3.1) | Critical |
| CVE-2026-88804 | Unauthenticated update of public UI settings leading to stored cross-site scripting in Rancher | Rancher | 9.6 (v3.1) | Critical |
| CVE-2026-47670 | DbGate - Remote Code Execution via Dynamic Import Bypass | dbgate | 9.4 (v4.0) | Critical |
| CVE-2026-56397 | SiYuan - Remote Code Execution via Malicious Bazaar Package Metadata and README | SiYuan | 9.4 (v4.0) | Critical |
| CVE-2026-61876 | LuCI DHCPv6 Lease Hostname Stored Cross-Site Scripting | luci | 9.4 (v4.0) | Critical |
| CVE-2026-73043 | SiYuan before v3.7.4 Remote Code Execution via Template Calculation | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73044 | SiYuan before v3.7.4 Stored Cross-Site Scripting via Column Width | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73050 | SiYuan before v3.7.4 Stored XSS via select option color | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73052 | SiYuan before v3.7.4 Stored XSS via Attribute-View Field Names | siyuan | 9.4 (v4.0) | Critical |
| CVE-2026-73053 | SiYuan before v3.7.4 Cross-Site Scripting via unicode2Emoji | siyuan | 9.4 (v4.0) | Critical |
| CVE-2013-10051 | InstantCMS 1.6 Remote PHP Code Execution | instantcms | 9.3 (v4.0) | Critical |
| CVE-2014-125116 | HybridAuth install.php PHP Code Execution | HybridAuth | 9.3 (v4.0) | Critical |
| CVE-2024-58355 | Cal.com through 4.7.15 Cross-Site Scripting via booking questions | cal.diy | 9.3 (v4.0) | Critical |
| CVE-2025-25034 | SugarCRM REST Unserialize PHP Code Execution | SugarCRM | 9.3 (v4.0) | Critical |
| CVE-2025-71243 | SPIP Saisies Plugin Unauthenticated RCE | saisies | 9.3 (v4.0) | Critical |
| CVE-2026-100720 | Froxlor before 2.3.12 Stored XSS via SSL certificate issuer | froxlor | 9.3 (v4.0) | Critical |
| CVE-2026-105086 | WWBN AVideo 12.4 through 29.2.0 Stored XSS via Double-Encoded Video Title | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-105089 | WWBN AVideo through 29.2.0 Stored XSS via trailer1 in YouPHPFlix2 Templates | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-18872 | IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities | financial transaction manager | 9.3 (v3.1) | Critical |
| CVE-2026-27174 | MajorDoMo Console Eval Unauthenticated RCE | majordomo | 9.3 (v4.0) | Critical |
| CVE-2026-40872 | mailcow: dockerized vulnerable to stored XSS in autodiscover logs email address field | mailcow-dockerized | 9.3 (v4.0) | Critical |
| CVE-2026-42849 | authentik: Reflected XSS in SFE AutosubmitStage allows IDP account takeover | authentik | 9.3 (v3.1) | Critical |
| CVE-2026-45118 | MyBB: Contact page reflected XSS | mybb | 9.3 (v3.1) | Critical |
| CVE-2026-54527 | JupyterLab Git: Stored XSS leading to RCE | jupyterlab-git | 9.3 (v4.0) | Critical |
| CVE-2026-55486 | Goobi viewer: IIIF Auth 2.0 origin parameter unsanitized — CSP malformation and reflected XSS | goobi-viewer-core | 9.3 (v3.1) | Critical |
| CVE-2026-57858 | Cal.com Cal.diy 6.2.0 Stored XSS via BookingPageTagManager Analytics Tracking ID | Cal.com Self-Hosted (Cal.diy) | 9.3 (v4.0) | Critical |
| CVE-2026-58491 | Warpgate: Reflected XSS in SSO return endpoint via attacker-controlled next parameter | warpgate | 9.3 (v3.1) | Critical |
| CVE-2026-66394 | SiYuan before v3.7.3 Stored and Reflected XSS via SVG Sanitizer Bypass | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-66396 | SiYuan before v3.7.2 Stored XSS to RCE via title-img IAL | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-66418 | OpenClaw Dashboard v3.0.0 Stored XSS via Failed Login Username Field | openclaw agent dashboard | 9.3 (v4.0) | Critical |
| CVE-2026-74902 | SiYuan before v3.7.4 XSS-to-RCE via malicious filename upload | siyuan | 9.3 (v4.0) | Critical |
| CVE-2026-78997 | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) Cross-Site Scripting Vulnerability | UC Browser for Android (package com.UCMobile.intl, version 13.7.8.1314) | 9.3 (v3.1) | Critical |
| CVE-2026-88866 | WWBN AVideo LoginControl Stored XSS via User-Agent Header | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-88867 | WWBN AVideo Stored XSS via Category Name and Icon Class | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-88868 | AVideo LiveLinks Stored XSS via title and description fields | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-88869 | AVideo AD_Server Stored XSS via log.php label parameter | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89249 | AVideo YPTWallet Stored XSS via CryptoWallet Configuration | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89253 | AVideo Stored XSS via donationLink in watch page button | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89254 | AVideo CustomizeUser Stored XSS via field_name Parameter | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89255 | AVideo LoginControl Stored XSS via PGP Public Key | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-89256 | AVideo Bookmark Plugin Stored XSS via Chapter Names | AVideo | 9.3 (v4.0) | Critical |
| CVE-2026-27760 | OpenCATS Installer PHP Code Injection | OpenCATS | 9.2 (v4.0) | Critical |
| CVE-2026-84189 | LibreNMS before 26.7.0 Stored XSS via Oxidized API | librenms | 9.2 (v4.0) | Critical |
| CVE-2026-89243 | WWBN AVideo Stored XSS via UserGroups setGroup_name | AVideo | 9.2 (v4.0) | Critical |
| CVE-2014-7236 | TWiki Debugenableplugins Remote Code Execution | twiki | 9.1 (v3.1) | Critical |
| CVE-2021-21479 | SCIMono <0.0.19 - Remote Code Execution | scimono | 9.1 (v3.1) | Critical |
| CVE-2021-26855 | Microsoft Exchange ProxyLogon RCE | exchange server | 9.1 (v3.1) | Critical |
| CVE-2024-4180 | The Events Calendar < 6.4.0.1 - Cross-site Scripting | the events calendar | 9.1 (v3.1) | Critical |
| CVE-2026-41201 | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS Version 2 | ci4ms | 9.1 (v3.1) | Critical |
| CVE-2008-4687 | Mantis manage_proj_page PHP Code Execution | mantis | 9.0 (v2.0) | High |
| CVE-2019-7671 | Prima Access Control 2.3.35 - 'HwName' Persistent Cross-Site Scripting | flexair | 9.0 (v3.1) | Critical |
| CVE-2023-34192 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | collaboration | 9.0 (v3.1) | Critical |
| CVE-2026-34448 | SiYuan: Stored XSS in Attribute View gallery/kanban cover rendering allows arbitrary command execution in the desktop cl | siyuan | 9.0 (v3.1) | Critical |
| CVE-2026-34563 | CI4MS: Backup Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM Blind XSS | ci4ms | 9.0 (v3.1) | Critical |
| CVE-2026-42556 | Postiz stored XSS in public preview page | postiz | 9.0 (v3.1) | Critical |
| CVE-2026-44977 | countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context | countly-server | 9.0 (v3.1) | Critical |
| CVE-2026-55562 | Cronicle: Stored XSS in admin Activity Log via account full_name field | Cronicle | 9.0 (v3.1) | Critical |
| CVE-2026-55570 | SiYuan: Stored XSS results to Electron RCE in SiYuan marketplace via unescaped data-obj attribute (Bypass for CVE-2026 | siyuan | 9.0 (v3.1) | Critical |
| CVE-2025-1302 | JSONPath Plus < 10.3.0 - Remote Code Execution | jsonpath-plus | 8.9 (v4.0) | High |
| CVE-2026-39328 | ChurchCRM has Stored XSS in Social Profile Fields | churchcrm | 8.9 (v3.1) | High |
| CVE-2026-40873 | mailcow: dockerized vulnerable to stored XSS in Quarantine attachment filenames | mailcow-dockerized | 8.9 (v4.0) | High |
| CVE-2026-43984 | Tautulli has stored XSS in logFile via guest-controlled log_js_errors input | Tautulli | 8.9 (v3.1) | High |
| CVE-2016-8526 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 8.8 (v3.0) | High |
| CVE-2016-9315 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 8.8 (v3.0) | High |
| CVE-2018-1213 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 8.8 (v3.0) | High |
| CVE-2018-17442 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 8.8 (v3.0) | High |
| CVE-2018-6224 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.8 (v3.0) | High |
| CVE-2019-10867 | Pimcore Unserialize RCE | pimcore | 8.8 (v3.0) | High |
| CVE-2019-9055 | CMS Made Simple Authenticated RCE via object injection | cms made simple | 8.8 (v3.0) | High |
| CVE-2020-7991 | Adive Framework 2.0.8 - Cross-Site Request Forgery (Change Admin Password) | framework | 8.8 (v3.1) | High |
| CVE-2021-20086 | Odoo Apps - Cross-Site Scripting via Prototype Pollution | jquery-bbq | 8.8 (v3.1) | High |
| CVE-2023-23492 | Login with Phone Number - Cross-Site Scripting | login with phone number | 8.8 (v3.1) | High |
| CVE-2024-28741 | NorthStar C2 XSS to Agent RCE | EginDemirbilek NorthStar C2 v1 | 8.8 (v3.1) | High |
| CVE-2025-11307 | WP Google Maps < 9.0.48 - Cross-Site Scripting | wp-google-maps | 8.8 (v3.1) | High |
| CVE-2025-56798 | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier Cross-Site Request Forgery Vulnerability | Lime Technology, Inc.'s Unraid OS version 6.12.14 and earlier | 8.8 (v3.1) | High |
| CVE-2025-66918 | edoc-doctor-appointment-system Cross-Site Scripting Vulnerability | edoc-doctor-appointment-system | 8.8 (v3.1) | High |
| CVE-2026-12968 | Product Addons – WowAddons < 1.6.15 - Unauthenticated Stored XSS via Arbitrary SVG Upload | Product Addons and Product Options With Custom Fields | 8.8 (v3.1) | High |
| CVE-2026-41473 | CyberPanel < 2.4.5 Unauthenticated API Access via AI Scanner Endpoints | cyberpanel | 8.8 (v4.0) | High |
| CVE-2026-55237 | AutoGPT SignUp Page has DOM-Based XSS and Open Redirect | AutoGPT | 8.8 (v3.1) | High |
| CVE-2026-56840 | PraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous to | PraisonAI | 8.8 (v3.1) | High |
| CVE-2026-70650 | GetSimple CMS: Authenticated Stored XSS in backup viewer (backup-edit.php) via output decoding of page meta fields and c | GetSimpleCMS-CE | 8.8 (v4.0) | High |
| CVE-2026-8071 | Spam protection, Honeypot, Anti-Spam by CleanTalk < 6.79 - Unauthenticated Stored XSS via Comment Shortcode Bypass | Anti-Spam by CleanTalk. Spam protection | 8.8 (v3.1) | High |
| CVE-2025-12716 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.7 (v3.1) | High |
| CVE-2025-62722 | LinkAce: Stored XSS Vulnerability in Link Title Field Through Social Media Sharing Feature | linkace | 8.7 (v4.0) | High |
| CVE-2026-109960 | Froxlor 2.0.0 before 2.3.14 Stored XSS via Customer Theme Value | froxlor | 8.7 (v4.0) | High |
| CVE-2026-12496 | Loytec LINX firmware: Unauthenticated stored XSS in OPC XML-DA server | LIP-ME20xC | 8.7 (v4.0) | High |
| CVE-2026-13323 | open vsx Cross-site Scripting Vulnerability | open vsx | 8.7 (v3.1) | High |
| CVE-2026-15217 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.7 (v3.1) | High |
| CVE-2026-28445 | Typebot: Stored XSS via Rating Block Custom Icon Bypasses isUnsafe Sandbox in Builder Preview | typebot.io | 8.7 (v3.1) | High |
| CVE-2026-28737 | Gitea 3D file viewer allows stored XSS through glTF extensionsRequired | Gitea Open Source Git Server | 8.7 (v3.1) | High |
| CVE-2026-35574 | ChurchCRM has a Stored XSS in Person Profile - Add a Note | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-35576 | ChurchCRM has Stored Cross-Site Scripting (XSS) in Person Properties via PrintView.php | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-39332 | ChurchCRM has Reflected Cross-Site Scripting (XSS) in GeoPage.php | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-39333 | ChurchCRM has Reflected XSS in DateStart/DateEnd parameters in FindFundRaiser.php | churchcrm | 8.7 (v3.1) | High |
| CVE-2026-40262 | Note Mark has Stored XSS via Unrestricted Asset Upload | note-mark | 8.7 (v3.1) | High |
| CVE-2026-42197 | RELATE Vulnerable to Stored XSS via Unprivileged User Profile | relate | 8.7 (v3.1) | High |
| CVE-2026-44667 | Faction: Stored XSS in Remediation Verification Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High |
| CVE-2026-44669 | Faction: Stored XSS in Assessment Attachment Filename Preview Rendering | faction | 8.7 (v3.1) | High |
| CVE-2026-44729 | Twenty: Stored Cross-Site Scripting via Unsanitized File Serving (Missing Content-Type/Content-Disposition Headers) | twenty | 8.7 (v3.1) | High |
| CVE-2026-45115 | MyBB: Buddy/ignore list username XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-45116 | MyBB: Profile field type confusion XSS | mybb | 8.7 (v3.1) | High |
| CVE-2026-45270 | CI4MS: Stored XSS in Pages Module Content via Broken html_purify Validation Rule | ci4ms | 8.7 (v3.1) | High |
| CVE-2026-46518 | OpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics | openemr | 8.7 (v3.1) | High |
| CVE-2026-47665 | Penpot: Stored XSS via comment content, innerHTML renders unsanitized HTML | penpot | 8.7 (v3.1) | High |
| CVE-2026-47743 | Shopper: Multiple data integrity and disclosure issues in admin Livewire components | shopper | 8.7 (v3.1) | High |
| CVE-2026-48026 | lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML | lakeFS | 8.7 (v3.1) | High |
| CVE-2026-53758 | Emlog: Stored XSS via Parsedown Markdown Processing - Raw HTML Not Sanitized | emlog | 8.7 (v4.0) | High |
| CVE-2026-54049 | Sakai Conversations has a Stored XSS Issue | sakai | 8.7 (v3.1) | High |
| CVE-2026-54347 | Froxlor: Stored XSS in DNS TXT Record Content Allows Customer-to-Admin Account Takeover | froxlor | 8.7 (v3.1) | High |
| CVE-2026-55230 | Vvveb: Stored XSS in Vvveb via sanitizeHTML() filter bypass using a quoted greater-than character | Vvveb | 8.7 (v3.1) | High |
| CVE-2026-55872 | GYM One admin user list is vulnerable to stored cross-site scripting | GYM-One | 8.7 (v3.1) | High |
| CVE-2026-68899 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback | wekan | 8.7 (v3.1) | High |
| CVE-2026-71542 | GetSimple CMS: Stored Cross-Site Scripting (XSS) via the "title" parameter in admin/components.php | GetSimpleCMS-CE | 8.7 (v4.0) | High |
| CVE-2026-84683 | Automation-controller: automation-controller-container: automation-controller: stored cross-site scripting in the job st | Red Hat Ansible Automation Platform 2.5 for RHEL 8 | 8.7 (v3.1) | High |
| CVE-2025-66024 | XWiki Blog Application home page vulnerable to Stored XSS via Post Title | blog application | 8.6 (v4.0) | High |
| CVE-2026-100645 | SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban | siyuan | 8.6 (v4.0) | High |
| CVE-2026-103904 | Stored XSS Vulnerability in JTL-Shop | JTL-Shop | 8.6 (v4.0) | High |
| CVE-2026-34463 | MantisBT has Stored HTML Injection/XSS via Clone Issue Form | mantisbt | 8.6 (v4.0) | High |
| CVE-2026-39338 | ChurchCRM has Blind XSS via Global Search – Administrative Cookie Session Exfiltration | churchcrm | 8.6 (v4.0) | High |
| CVE-2026-42548 | Flight: Reflected XSS via unvalidated JSONP callback in Flight::jsonp() | core | 8.6 (v4.0) | High |
| CVE-2026-49864 | wetty vulnerable to DOM XSS via file-download filename | wetty | 8.6 (v4.0) | High |
| CVE-2026-92985 | SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels | siyuan | 8.6 (v4.0) | High |
| CVE-2026-92986 | SiYuan before 3.8.4 Cross-Site Scripting via Document Title | siyuan | 8.6 (v4.0) | High |
| CVE-2026-9585 | Unauthenticated Reflected Cross-Site Scripting (XSS) in Switchvox SMB Web Portal | Switchvox SMB Edition | 8.6 (v4.0) | High |
| CVE-2025-39663 | Cross Site Scripting through compromised remote site | checkmk | 8.5 (v4.0) | High |
| CVE-2025-62172 | Home Assistant vulnerable to Stored XSS in Energy dashboard from Energy Entity Name | core | 8.5 (v4.0) | High |
| CVE-2026-100172 | Stored XSS in AIL Framework extracted-match popovers via unescaped dynamic values in HTML-enabled data-content attribute | ail framework | 8.5 (v4.0) | High |
| CVE-2026-100176 | Stored Cross-Site Scripting (XSS) in AIL Framework Username Timeline Tooltip | ail framework | 8.5 (v4.0) | High |
| CVE-2026-100643 | SiYuan before v3.8.4 Stored XSS via Attribute View textarea | siyuan | 8.5 (v4.0) | High |
| CVE-2026-21618 | Cross-site scripting (XSS) in OAuth Device Authorization screen | hexpm | 8.5 (v4.0) | High |
| CVE-2026-34932 | hoppscotch: Stored XSS via mock server responses on backend origin | hoppscotch | 8.5 (v4.0) | High |
| CVE-2026-55665 | DOM-based XSS in Grist via unsanitized links, enabling privilege escalation | grist-core | 8.5 (v4.0) | High |
| CVE-2026-58113 | Teamcenter V2412 Cross-site Scripting Vulnerability | Teamcenter V2412 | 8.5 (v4.0) | High |
| CVE-2026-63361 | LimeSurvey Community Edition 7.0.5+260623 - Reflected XSS in HTML editor popup | LimeSurvey | 8.5 (v4.0) | High |
| CVE-2026-64851 | Grav Shortcode Core Plugin: Stored XSS in shortcode-core attribute handlers | grav-plugin-shortcode-core | 8.5 (v4.0) | High |
| CVE-2026-71483 | Horilla: Reflected Cross-Site Scripting (XSS) in Employee Filter View | horilla-hr | 8.5 (v4.0) | High |
| CVE-2026-100673 | Grav Data Manager before 1.4.5 Stored XSS via item-detail view | grav-plugin-datamanager | 8.4 (v4.0) | High |
| CVE-2026-15973 | LimeSurvey 7.0.5 - Stored XSS in Survey Menu Entries | LimeSurvey | 8.4 (v4.0) | High |
| CVE-2026-5385 | GLPI 11.0.0 - Stored XSS in knowledge base | glpi | 8.4 (v4.0) | High |
| CVE-2026-62368 | Snipe-IT: Stored XSS via Custom Field name in asset-list column headers | snipe-it | 8.4 (v3.1) | High |
| CVE-2026-77072 | n8n before 1.123.69 Stored XSS via Form Completion Page | n8n | 8.4 (v4.0) | High |
| CVE-2026-77850 | Stored XSS in AshAdmin relationship typeahead via unescaped label_field content | ash admin | 8.4 (v4.0) | High |
| CVE-2026-85613 | OpenPanel Unauthenticated XSS via SVG Favicon Proxy | openpanel | 8.4 (v4.0) | High |
| CVE-2026-87814 | SiYuan before v3.8.2 Stored XSS via Asset Preview | siyuan | 8.4 (v4.0) | High |
| CVE-2012-10018 | WordPress Mapplic <= 6.1 / Mapplic Lite <= 1.0 - Authenticated Stored XSS via SVG File Upload | mapplic | 8.3 (v3.1) | High |
| CVE-2024-5420 | SEH utnserver Pro/ProMAX/INU-100 20.1.22 - Cross-Site Scripting | utnserver Pro | 8.3 (v4.0) | High |
| CVE-2026-44203 | OpenAM: Pre-auth Reflected XSS in OAuth2 / OIDC response_mode=form_post via state parameter (FormPostResponse.ftl) | OpenAM | 8.3 (v4.0) | High |
| CVE-2017-10075 | Oracle Content Server - Cross-Site Scripting | webcenter content | 8.2 (v3.0) | High |
| CVE-2026-104450 | YesWiki before 4.6.7 ACL Bypass and Stored XSS via pointimage Action | yeswiki | 8.2 (v4.0) | High |
| CVE-2026-34375 | AVideo Vulnerable to Reflected XSS via Unsanitized plugin Parameter in YPTWallet Stripe Payment Page | avideo | 8.2 (v3.1) | High |
| CVE-2026-34725 | dbgate-web: Stored XSS in applicationIcon leads to potential RCE in Electron due to unsafe renderer configuration | dbgate | 8.2 (v3.1) | High |
| CVE-2026-45627 | Arcane: Unauthenticated reflected XSS via SVG color parameter in /api/app-images/logo enables admin account takeover | arcane | 8.2 (v3.1) | High |
| CVE-2026-48788 | Remark42: Cross-Site Scripting (XSS) on /api/v1/img via content-type spoofing | remark42 | 8.2 (v3.0) | High |
| CVE-2026-54253 | TS3 Manager: Reflected XSS via /api/download port parameter steals operator session | ts3-manager | 8.2 (v3.1) | High |
| CVE-2026-56670 | ComfyUI: Stored XSS via SVG file upload on the /view endpoint | ComfyUI | 8.2 (v3.1) | High |
| CVE-2026-56736 | phpMyFAQ has Stored XSS in Admin FAQ Editor via HTML Entity Bypass in Frontend FAQ Submission | phpMyFAQ | 8.2 (v3.1) | High |
| CVE-2026-57582 | GeoNetwork - Reflected Cross-Site Scripting | core-geonetwork | 8.2 (v3.1) | High |
| CVE-2026-86016 | VNote: Stored XSS via YAML Frontmatter Leading to Local File Read and Remote Exfiltration | vnote | 8.2 (v3.1) | High |
| CVE-2016-1337 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 8.1 (v3.0) | High |
| CVE-2018-6221 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 8.1 (v3.0) | High |
| CVE-2025-62716 | Plane Vulnerable to Cross-Site Scripting via Open Redirect in ?next_path Parameter | plane | 8.1 (v3.1) | High |
| CVE-2025-68147 | opensourcepos has a Cross-site Scripting vulnerability | open source point of sale | 8.1 (v3.1) | High |
| CVE-2026-33437 | Stirling PDF: Stored XSS in Info Summary | Stirling-PDF | 8.1 (v3.1) | High |
| CVE-2026-39344 | Reflected XSS the login page through the 'username' parameter | churchcrm | 8.1 (v3.0) | High |
| CVE-2026-48060 | Litestar: HTML Injection Through CSRF Token | litestar | 8.1 (v3.1) | High |
| CVE-2026-50758 | DayuanJiang next-ai-draw-io 0.4.13 Arbitrary Code Execution Vulnerability | DayuanJiang next-ai-draw-io 0.4.13 | 8.1 (v3.1) | High |
| CVE-2026-58205 | GRR has a Reflected XSS issue | GRR | 8.1 (v3.1) | High |
| CVE-2025-12029 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 8.0 (v3.1) | High |
| CVE-2026-35575 | ChurchCRM has Stored XSS in Group Name | churchcrm | 8.0 (v3.1) | High |
| CVE-2026-58390 | OPNsense: Stored XSS to root RCE via OpenVPN client common_name in status views | core | 8.0 (v3.1) | High |
| CVE-2015-4669 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 7.8 (v3.0) | High |
| CVE-2016-9314 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 7.8 (v3.0) | High |
| CVE-2018-6222 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 7.8 (v3.0) | High |
| CVE-2021-27065 | Microsoft Exchange ProxyLogon RCE | exchange server | 7.8 (v3.1) | High |
| CVE-2026-55659 | Grist: XSS through unsafe value interpolation in server-rendered pages | grist-core | 7.7 (v3.1) | High |
| CVE-2025-47783 | Label Studio < 1.18.0 - Reflected XSS | label studio | 7.6 (v4.0) | High |
| CVE-2026-107303 | JHipster: Generated Applications Allow Stored XSS via Unrestricted Blob ContentType Opened as Same-Origin Blob | generator-jhipster | 7.6 (v3.1) | High |
| CVE-2026-116167 | SiYuan 2.9.0-3.8.6 - Unauthenticated XSS via check-auth "to" Parameter | siyuan | 7.6 (v4.0) | High |
| CVE-2026-16969 | DFIR-IRIS Stored XSS in Assets | iris-web | 7.6 (v3.1) | High |
| CVE-2026-18360 | DFIR-IRIS Stored XSS in Custom Attributes | iris-web | 7.6 (v3.1) | High |
| CVE-2026-18361 | DFIR-IRIS Stored XSS in Datastore Upload | iris-web | 7.6 (v3.1) | High |
| CVE-2026-32308 | OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose") | oneuptime | 7.6 (v3.1) | High |
| CVE-2026-35534 | ChurchCRM has Stored XSS in PersonView.php via Facebook Field Attribute Injection | churchcrm | 7.6 (v3.1) | High |
| CVE-2026-40283 | WeGIA has stored XSS in profile_paciente.php | wegia | 7.6 (v3.1) | High |
| CVE-2026-54506 | Vvveb: Stored XSS via sanitizeHTML() bypass in user profile bio field | Vvveb | 7.6 (v3.1) | High |
| CVE-2026-59814 | Joplin: Stored XSS via inline-served note attachment on published shares | joplin | 7.6 (v3.1) | High |
| CVE-2026-77394 | OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget | cosmos | 7.6 (v3.1) | High |
| CVE-2002-1131 | SquirrelMail 1.2.6/1.2.7 - Cross-Site Scripting | squirrelmail | 7.5 (v2.0) | High |
| CVE-2011-4075 | phpLDAPadmin query_engine Remote PHP Code Injection | phpldapadmin | 7.5 (v2.0) | High |
| CVE-2011-4899 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 7.5 (v2.0) | High |
| CVE-2012-5223 | vBSEO proc_deutf() Remote PHP Code Injection | vbseo | 7.5 (v2.0) | High |
| CVE-2012-5685 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 7.5 (v2.0) | High |
| CVE-2013-1412 | DataLife Engine preview.php PHP Code Injection | datalife engine | 7.5 (v2.0) | High |
| CVE-2013-4557 | SPIP connect Parameter PHP Injection | spip | 7.5 (v2.0) | High |
| CVE-2013-6041 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 7.5 (v2.0) | High |
| CVE-2014-1691 | Horde Framework Unserialize PHP Code Execution | horde application framework | 7.5 (v2.0) | High |
| CVE-2014-3704 | Drupal < 7.32 "Drupalgeddon" SQL Injection (CVE-2014-3704) | drupal | 7.5 (v2.0) | High |
| CVE-2015-2208 | PHPMoAdmin 1.1.2 Remote Code Execution | phpmoadmin | 7.5 (v2.0) | High |
| CVE-2015-6401 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 7.5 (v2.0) | High |
| CVE-2016-1328 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High |
| CVE-2016-1336 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 firmware | 7.5 (v3.0) | High |
| CVE-2020-5849 | Unraid 6.8.0 Auth Bypass PHP Code Execution | unraid | 7.5 (v3.1) | High |
| CVE-2026-16573 | Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload | Bit Form | 7.5 (v3.1) | High |
| CVE-2026-18983 | One User Avatar | User Profile Picture <= 2.5.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via wpua-file | One User Avatar | User Profile Picture | 7.5 (v3.1) | High |
| CVE-2026-40286 | WeGIA has Cross-Site Scripting in Controle de Contribuição | WeGIA | 7.5 (v3.1) | High |
| CVE-2026-44657 | MantisBT: Stored XSS in File Download | mantisbt | 7.5 (v4.0) | High |
| CVE-2026-67237 | RabbitMQ: Reflected XSS via the OAuth bootstrap JS endpoint | rabbitmq server | 7.5 (v4.0) | High |
| CVE-2026-7460 | mailcow-dockerized 2026-03b - Stored XSS in Queue Manager via unescaped | mailcow-dockerized | 7.4 (v4.0) | High |
| CVE-2026-87812 | SiYuan before v3.8.2 Stored XSS via Bazaar iconURL | siyuan | 7.4 (v4.0) | High |
| CVE-2026-91775 | LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings | LimeSurvey | 7.4 (v4.0) | High |
| CVE-2016-2098 | Ruby on Rails ActionPack Inline ERB Code Execution | debian linux | 7.3 (v3.0) | High |
| CVE-2025-11189 | kiwire Cross-Site Scripting Vulnerability | kiwire | 7.3 (v3.1) | High |
| CVE-2025-14340 | Payara Server - Cross-Site Scripting | Payara Server | 7.3 (v4.0) | High |
| CVE-2026-30819 | Combodo iTop: Reflected XSS in /pages/ajax.render.php dashboard_id parameter | iTop | 7.3 (v3.1) | High |
| CVE-2026-6735 | XSS within PHP-FPM status endpoint | php | 7.3 (v4.0) | High |
| CVE-2026-8203 | Concrete CMS 9.5.0 and below has Stored XSS on the height parameter | concrete cms | 7.3 (v4.0) | High |
| CVE-2022-2219 | Unyson < 2.7.27 - Cross Site Scripting | unyson | 7.2 (v3.1) | High |
| CVE-2022-24734 | MyBB Admin Control Code Injection RCE | mybb | 7.2 (v3.1) | High |
| CVE-2023-46818 | ISPConfig language_edit.php PHP Code Injection | ispconfig | 7.2 (v3.1) | High |
| CVE-2025-11994 | Easy Email Subscription <= 1.3 - Unauthenticated Stored Cross-Site Scripting | Easy Email Subscription | 7.2 (v3.1) | High |
| CVE-2025-12135 | WPBookit <= 1.0.6 - Unauthenticated Stored Cross-Site Scripting | WPBookit | 7.2 (v3.1) | High |
| CVE-2025-14151 | SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting | SlimStat Analytics | 7.2 (v3.1) | High |
| CVE-2025-66921 | open source point of sale Cross-Site Scripting Vulnerability | open source point of sale | 7.2 (v3.1) | High |
| CVE-2025-66923 | open source point of sale Cross-Site Scripting Vulnerability | open source point of sale | 7.2 (v3.1) | High |
| CVE-2026-101928 | Magic Tooltips For Contact Form 7 <= 1.0.34 - Unauthenticated Stored Cross-Site Scripting via 'esc_html' Filter Override | Magic Tooltips For Contact Form 7 | 7.2 (v3.1) | High |
| CVE-2026-102626 | LimeSurvey Community Edition 7.4.0 - Stored XSS through the Date/Time date_min question attribute | LimeSurvey | 7.2 (v4.0) | High |
| CVE-2026-107743 | Mapster WP Maps <= 2.0.5 - Unauthenticated Stored Cross-Site Scripting via 'config.loading.background' Parameter | Mapster WP Maps | 7.2 (v3.1) | High |
| CVE-2026-107764 | SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Author URL via Inspector hre | SiteOrigin CSS | 7.2 (v3.1) | High |
| CVE-2026-109193 | HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value | HivePress – Business Directory, Listings & Classified Ads Plugin | 7.2 (v3.1) | High |
| CVE-2026-109999 | AI Marketing Expert <= 1.2.8 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'name' Parameter | AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & Ai Chatbot | 7.2 (v3.1) | High |
| CVE-2026-110662 | MxChat <= 3.2.25 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'feedback' Parameter via mxchat_save_rating | MxChat – AI Chatbot & Content Generation for WordPress | 7.2 (v3.1) | High |
| CVE-2026-13359 | Contact Form to DB by BestWebSoft <= 1.7.5 - Unauthenticated Stored Cross-Site Scripting via cntctfrm_contact_dropdown P | Contact Form to DB by BestWebSoft – Messages Database Plugin For WordPress | 7.2 (v3.1) | High |
| CVE-2026-13425 | Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values | Database for CF7 | 7.2 (v3.1) | High |
| CVE-2026-13440 | StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Unau | StoreGrowth – Upsell, BOGO, Quick View, Direct Checkout & Side Cart for WooCommerce | 7.2 (v3.1) | High |
| CVE-2026-13731 | WPBot <= 8.4.9 - Cross-Site Scripting | chatbot | 7.2 (v3.1) | High |
| CVE-2026-15401 | VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Pa | VikBooking Hotel Booking Engine & PMS | 7.2 (v3.1) | High |
| CVE-2026-15780 | WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter | WP Statistics – Simple, privacy-friendly Google Analytics alternative | 7.2 (v3.1) | High |
| CVE-2026-16143 | VikRentItems Flexible Rental Management System <= 1.2.1 - Unauthenticated Stored Cross-Site Scripting | VikRentItems Flexible Rental Management System | 7.2 (v3.1) | High |
| CVE-2026-16809 | LimeSurvey Community Edition 7.0.5 - Stored XSS in quota message rendering | LimeSurvey | 7.2 (v4.0) | High |
| CVE-2026-17506 | Independent Analytics <= 2.15.0 - Unauthenticated Stored Cross-Site Scripting | Independent Analytics – WordPress Analytics Plugin | 7.2 (v3.1) | High |
| CVE-2026-18430 | HumHub 1.18.4 - Stored XSS in comment-deletion notifications through unescaped administrator reason | HumHub | 7.2 (v4.0) | High |
| CVE-2026-18756 | HumHub Community Edition 1.18.4-pl1 - Reflected XSS in Space membership request button rendering | HumHub | 7.2 (v4.0) | High |
| CVE-2026-19914 | Welcart e-Commerce <= 2.12.1 - Unauthenticated Stored Cross-Site Scripting via 'custom_order' Parameter | Welcart e-Commerce | 7.2 (v3.1) | High |
| CVE-2026-43874 | WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross-User JavaScript Execution via | AVideo | 7.2 (v3.1) | High |
| CVE-2026-5934 | WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpo | WP Rocket | 7.2 (v3.1) | High |
| CVE-2026-7534 | SUMO Reward Points for WooCommerce <= 32.7.0 - Unauthenticated Stored Cross-Site Scripting via 'reason' Parameter | SUMO Reward Points for WooCommerce | 7.2 (v3.1) | High |
| CVE-2026-83625 | Contact Form by Supsystic <= 1.10.2 - Unauthenticated Stored Cross-Site Scripting via IP Address Header | Contact Form by Supsystic | 7.2 (v3.1) | High |
| CVE-2026-87091 | Welcart e-Commerce <= 2.12.2 - Unauthenticated Stored Cross-Site Scripting via Settlement Notification Parameters | Welcart e-Commerce | 7.2 (v3.1) | High |
| CVE-2026-89417 | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 6.3.10 - Unauthenticated Stored Cross-Site Scripting via 's' | OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. | 7.2 (v3.1) | High |
| CVE-2026-93654 | Premium Packages <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'cart_items[][product_name]' Parameter | Premium Packages – Sell Digital Products Securely | 7.2 (v3.1) | High |
| CVE-2026-93756 | Smash Balloon Social Post Feed <= 4.13.0 - Unauthenticated Stored Cross-Site Scripting via Facebook Comment Message in A | Smash Balloon Social Post Feed – Simple Social Feeds for WordPress | 7.2 (v3.1) | High |
| CVE-2026-93775 | Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook | Podlove Podcast Publisher | 7.2 (v3.1) | High |
| CVE-2026-93875 | JetAppointment <= 2.5.2.1 - Unauthenticated Stored Cross-Site Scripting via 'friendlyTime' Parameter | JetAppointment | 7.2 (v3.1) | High |
| CVE-2026-93885 | Cryptocurrency Donation Box <= 2.2.13 - Unauthenticated Stored Cross-Site Scripting via data_object Parameter | Cryptocurrency Donation Box – Bitcoin & Crypto Donations | 7.2 (v3.1) | High |
| CVE-2026-95670 | No External Links <= 5.2.0 - Unauthenticated Stored Cross-Site Scripting via Log URL via /goto/{base64} Redirect | No External Links | 7.2 (v3.1) | High |
| CVE-2026-96561 | AI Engine <= 3.8.0 - Unauthenticated Stored Cross-Site Scripting via 'model_' Parameter → PHP Error-Log Injection → Advi | AI Engine – The Chatbot, AI Framework & MCP for WordPress | 7.2 (v3.1) | High |
| CVE-2026-96566 | Newsletter <= 9.4.0 - Unauthenticated Stored Cross-Site Scripting via 'np1' Custom Field Parameter | Newsletter – Send awesome emails from WordPress | 7.2 (v3.1) | High |
| CVE-2022-35499 | In Trimble TM4WEB 21.4.0.4, the external bill viewer endpoint Cross-Site Scripting Vulnerability | - | 7.1 (v3.1) | High |
| CVE-2024-10152 | Simple Certain Time to Show Content - Cross-Site Scripting | simple certain time to show content | 7.1 (v3.1) | High |
| CVE-2024-12638 | Bulk Me Now! Plugin <= 2.0 - Cross-Site Scripting | bulk me now! | 7.1 (v3.1) | High |
| CVE-2024-12749 | WordPress Competition Form Plugin <= 2.0 - Cross-Site Scripting | competition form | 7.1 (v3.1) | High |
| CVE-2024-12878 | Lazy Blocks <= 3.8.2 - Cross-Site Scripting | lazy blocks | 7.1 (v3.1) | High |
| CVE-2024-13094 | WP Triggers Lite - Cross-Site Scripting | wp triggers lite | 7.1 (v3.1) | High |
| CVE-2024-13330 | JustRows WordPress - Cross-Site Scripting | justrows free | 7.1 (v3.1) | High |
| CVE-2024-13352 | Legull WordPress - Cross-Site Scripting | legull | 7.1 (v3.1) | High |
| CVE-2024-41357 | phpIPAM 1.6 - Reflected-Cross-Site Scripting (XSS) | phpipam | 7.1 (v3.1) | High |
| CVE-2025-11560 | Team Members Showcase < 3.5.0 - Reflected XSS | Team Members Showcase | 7.1 (v3.1) | High |
| CVE-2025-11682 | Stored Cross-Site Scripting in Perx Customer Engagement & Loyalty Platform | Customer Engagement & Loyalty Platform | 7.1 (v4.0) | High |
| CVE-2025-12629 | Broken Link Manager <= 0.6.5 - Reflected XSS | Broken Link Manager | 7.1 (v3.1) | High |
| CVE-2025-12684 | URL Shortify < 1.11.3 - Reflected XSS | URL Shortify | 7.1 (v3.1) | High |
| CVE-2025-13072 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via utm_source | HandL UTM Grabber / Tracker | 7.1 (v3.1) | High |
| CVE-2025-13073 | HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page | HandL UTM Grabber / Tracker | 7.1 (v3.1) | High |
| CVE-2025-13355 | URL Shortify < 1.11.4 - Reflected XSS | URL Shortify | 7.1 (v3.1) | High |
| CVE-2025-14701 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller | crafty controller | 7.1 (v3.1) | High |
| CVE-2026-115457 | baserCMS: Unauthenticated Stored XSS via Shortcode Expansion in Blog Comments | basercms | 7.1 (v3.1) | High |
| CVE-2026-12970 | LearnPress < 4.4.1 - Reflected XSS via c_search | LearnPress | 7.1 (v3.1) | High |
| CVE-2026-13725 | Dynamic Pricing With Discount Rules for WooCommerce < 5.0.0 - Reflected XSS via wdpAjax | Dynamic Pricing With Discount Rules for WooCommerce | 7.1 (v3.1) | High |
| CVE-2026-14234 | WOLF - WordPress Posts Bulk Editor and Manager < 1.1.0 - Stored XSS via CSRF | WOLF | 7.1 (v3.1) | High |
| CVE-2026-14239 | Tourmaster < 5.4.8 - Stored XSS via CSRF | tourmaster | 7.1 (v3.1) | High |
| CVE-2026-34598 | YesWiki has Persistant Blind XSS at "/?BazaR&vue=consulter" | yeswiki | 7.1 (v4.0) | High |
| CVE-2026-41576 | Ajax30/BraveCMS-2.0: Stored HTML Injection in Contact Email via nl2br() and Unescaped Blade Template | BraveCMS-2.0 | 7.1 (v3.1) | High |
| CVE-2026-6495 | WordPress Ajax Load More < 7.8.4 - Reflected Cross-Site Scripting | ajax-load-more | 7.1 (v3.1) | High |
| CVE-2026-6858 | Transbank Webpay < 1.14.0 - Unauthenticated Stored XSS | Transbank Webpay | 7.1 (v3.1) | High |
| CVE-2026-76790 | Estatik < 4.3.5 - Reflected XSS via get_listings hash Parameter | Estatik Real Estate Plugin | 7.1 (v3.1) | High |
| CVE-2026-84192 | LibreNMS before 26.3.1 Stored XSS via SNMP/Syslog Data | librenms | 7.1 (v4.0) | High |
| CVE-2026-9833 | WordPress Tag Groups < 2.2.0 - Reflected Cross-Site Scripting | tag-groups | 7.1 (v3.1) | High |
| CVE-2026-55746 | Cotonti stored XSS via PFS folder title | Cotonti | 7.0 (v4.0) | High |
| CVE-2026-58411 | ChurchCRM has Reflected Cross-Site Scripting (XSS) via unsanitized request parameter names and values | CRM | 7.0 (v4.0) | High |
| CVE-2018-3238 | Oracle Fusion Middleware WebCenter Sites 11.1.1.8.0 - Cross-Site Scripting | webcenter sites | 6.9 (v3.0) | Medium |
| CVE-2025-11183 | Cross-Site Scripting Vulnerability in QWC2 | QWC2 | 6.9 (v4.0) | Medium |
| CVE-2025-11937 | Stored XSS through a system message in SecurePoll | Mediawiki - SecurePoll Extension | 6.9 (v4.0) | Medium |
| CVE-2025-43779 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2025-4388 | Liferay Portal - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2025-4576 | Liferay Portal & DXP - Cross-Site Scripting | digital experience platform | 6.9 (v4.0) | Medium |
| CVE-2025-59746 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 6.9 (v4.0) | Medium |
| CVE-2025-59747 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 6.9 (v4.0) | Medium |
| CVE-2025-59748 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 6.9 (v4.0) | Medium |
| CVE-2025-59749 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 6.9 (v4.0) | Medium |
| CVE-2025-59755 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 6.9 (v4.0) | Medium |
| CVE-2025-62597 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'sql' | wegia | 6.9 (v4.0) | Medium |
| CVE-2025-62598 | WeGIA Vulnerable to Reflected Cross-Site Scripting via Endpoint 'pessoa/editar_info_pessoal.php' Parameter 'action' | wegia | 6.9 (v4.0) | Medium |
| CVE-2025-62613 | VDO.Ninja - DOM-Based Cross-Site Scripting | vdo.ninja | 6.9 (v4.0) | Medium |
| CVE-2025-62662 | Stored XSS through system messages in AdvancedSearch | Mediawiki - AdvancedSearch Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62663 | Stored XSS through a system message in UploadWizard | Mediawiki - UploadWizard Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62664 | Stored XSS through a system message in ImageRating | Mediawiki - ImageRating Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62670 | Stored XSS through a system message in FlexDiagrams | Mediawiki - FlexDiagrams Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62671 | Stored XSS through wikitext in Cargo | Mediawiki - Cargo Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62693 | Stored XSS through system messages in LastModified | Mediawiki - LastModified Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62695 | Stored XSS through system messages | Mediawiki - WikiLambda Extension | 6.9 (v4.0) | Medium |
| CVE-2025-62698 | Stored XSS through system messages in ExternalGuidance | Mediawiki - ExternalGuidance | 6.9 (v4.0) | Medium |
| CVE-2025-62700 | Stored XSS through a system message in MultiBoilerplate | Mediawiki - MultiBoilerplate Extensionmaste | 6.9 (v4.0) | Medium |
| CVE-2026-14358 | Stored XSS in Wikimedia Chart pie tooltip via Data:*.tab field title | mediawiki | 6.9 (v4.0) | Medium |
| CVE-2026-39422 | MaxKB has Stored XSS via ChatHeadersMiddleware | maxkb | 6.9 (v4.0) | Medium |
| CVE-2026-39423 | Stored XSS via Eval Injection in EchartsRander Component | maxkb | 6.9 (v4.0) | Medium |
| CVE-2026-39838 | ProofreadPage improperly sanitizes multiline styles using Sanitizer::checkCSS | MediaWiki - ProofreadPage Extension | 6.9 (v4.0) | Medium |
| CVE-2026-39936 | Stored XSS in Score due to usage of non-reserved data attributes | Mediawiki - Score Extension | 6.9 (v4.0) | Medium |
| CVE-2026-40598 | MantisBT has Potential Referer-Based Reflected HTML Injection / XSS in Tag Update Page | mantisbt | 6.9 (v4.0) | Medium |
| CVE-2026-42138 | Dify Vulnerable to Stored XSS via SVG-file upload | dify | 6.9 (v4.0) | Medium |
| CVE-2026-44651 | SillyTavern: Reflected XSS vulnerability in the CORS proxy middleware | SillyTavern | 6.9 (v4.0) | Medium |
| CVE-2026-59238 | Stored XSS in Pentestify via unsanitized finding images and report client logo | Pentestify | 6.9 (v4.0) | Medium |
| CVE-2026-69092 | Admidio before 5.0.11 Reflected XSS via SSO/SAML Endpoint | admidio | 6.9 (v4.0) | Medium |
| CVE-2026-73848 | Emlog: Stored XSS via Tag Name in Article Editor | emlog | 6.9 (v4.0) | Medium |
| CVE-2026-86188 | AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting | AVideo | 6.9 (v4.0) | Medium |
| CVE-2004-0519 | SquirrelMail 1.4.x - Folder Name Cross-Site Scripting | propack | 6.8 (v2.0) | Medium |
| CVE-2007-0885 | Jira Rainbow.Zen - Cross-Site Scripting | rainbow.zen | 6.8 (v2.0) | Medium |
| CVE-2012-5683 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 6.8 (v2.0) | Medium |
| CVE-2015-2755 | WordPress AB Google Map Travel <=3.4 - Stored Cross-Site Scripting | ab google map travel | 6.8 (v2.0) | Medium |
| CVE-2018-6230 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.8 (v3.0) | Medium |
| CVE-2025-9978 | Jeg Elementor Kit < 2.7.0 - Author+ Stored XSS | Jeg Kit for Elementor | 6.8 (v3.1) | Medium |
| CVE-2026-13605 | Photo Swipe <= 4.1.1.1 - Author+ Stored XSS via title Attribute | PhotoSwipe | 6.8 (v3.1) | Medium |
| CVE-2026-14817 | Element Pack Elementor Addons < 8.7.13 - Contributor+ DOM-Based Stored XSS via uikit Data Attributes | Element Pack Addons for Elementor | 6.8 (v3.1) | Medium |
| CVE-2026-14833 | Lightbox with PhotoSwipe < 5.9.0 - Author+ Stored XSS via data-lbwps-caption Attribute | Lightbox with PhotoSwipe | 6.8 (v3.1) | Medium |
| CVE-2026-15047 | s2Member < 260805 - Contributor+ Stored XSS via Shortcode | s2Member | 6.8 (v3.1) | Medium |
| CVE-2026-16069 | Brizy - Page Builder < 2.8.19 - Contributor+ Stored XSS via Featured Image Focal Point | Brizy | 6.8 (v3.1) | Medium |
| CVE-2026-16559 | YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload | YMC Filter | 6.8 (v3.1) | Medium |
| CVE-2026-33741 | EspoCRM: Stored XSS via SVG attachment loading same-origin JavaScript | espocrm | 6.8 (v3.1) | Medium |
| CVE-2026-40284 | WeGIA has stored XSS in listar_despachos.php | WeGIA | 6.8 (v3.1) | Medium |
| CVE-2026-67352 | luci-app-https-dns-proxy Stored XSS via resolver_url | luci | 6.8 (v4.0) | Medium |
| CVE-2018-1203 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium |
| CVE-2018-1204 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon onefs | 6.7 (v3.0) | Medium |
| CVE-2012-1258 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.5 (v3.1) | Medium |
| CVE-2012-6554 | Active Collab "chat module" Remote PHP Code Injection Exploit | activecollab chat module | 6.5 (v2.0) | Medium |
| CVE-2017-6338 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2017-6339 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 6.5 (v3.0) | Medium |
| CVE-2018-6219 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 6.5 (v3.0) | Medium |
| CVE-2021-24405 | WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS | easy cookies policy | 6.5 (v3.1) | Medium |
| CVE-2021-31195 | Microsoft Exchange Server - Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium |
| CVE-2021-31249 | CHIYU TCP/IP Converter - Carriage Return Line Feed Injection | bf-430 firmware | 6.5 (v3.1) | Medium |
| CVE-2021-41349 | Microsoft Exchange Server Pre-Auth POST Based Cross-Site Scripting | exchange server | 6.5 (v3.1) | Medium |
| CVE-2025-32430 | XWiki Platform - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium |
| CVE-2025-66472 | XWiki DeleteApplication - Cross-Site Scripting | xwiki | 6.5 (v4.0) | Medium |
| CVE-2026-24128 | XWiki Platform Distribution Flavor Main - Cross-Site Scripting | xwiki-platform-distribution-flavor-main | 6.5 (v4.0) | Medium |
| CVE-2026-40105 | XWiki - Cross-Site Scripting | xwiki-platform | 6.5 (v4.0) | Medium |
| CVE-2026-55549 | Yamcs <=5.8.6 - Cross-Site Scripting | yamcs | 6.5 (v3.1) | Medium |
| CVE-2026-78838 | AppNitro MachForm v30 Cross-Site Scripting Vulnerability | AppNitro MachForm v30 | 6.5 (v3.1) | Medium |
| CVE-2026-88618 | 1024-lab SmartAdmin v3.30.0 Arbitrary Code Execution Vulnerability | 1024-lab SmartAdmin v3.30.0 | 6.5 (v3.1) | Medium |
| CVE-2025-10128 | Eulerpool Research Systems <= 4.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | Eulerpool Research Systems | 6.4 (v3.1) | Medium |
| CVE-2025-10130 | Layers <= 0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting | Layers | 6.4 (v3.1) | Medium |
| CVE-2025-10139 | WP BookWidgets <= 0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting | WP BookWidgets | 6.4 (v3.1) | Medium |
| CVE-2025-10189 | BP Direct Menus <= 1.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting | BP Direct Menus | 6.4 (v3.1) | Medium |
| CVE-2025-13135 | HotelRunner Booking Widget <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting | HotelRunner Booking Widget | 6.4 (v3.1) | Medium |
| CVE-2025-13418 | Responsive Pricing Table <= 5.1.12 - Cross-Site Scripting | Responsive Pricing Table | 6.4 (v3.1) | Medium |
| CVE-2025-14387 | LearnPress – WordPress LMS Plugin <= 4.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via get_profile_soc | LearnPress – WordPress LMS Plugin for Create and Sell Online Courses | 6.4 (v3.1) | Medium |
| CVE-2025-15064 | Ultimate Member <= 2.11.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via DOM Gadgets | Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin | 6.4 (v3.1) | Medium |
| CVE-2025-47828 | H5P-Nodejs-library Cross-site Scripting Vulnerability | H5P-Nodejs-library | 6.4 (v3.1) | Medium |
| CVE-2025-9130 | Unify <= 3.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via unify_checkout Shortcode | Unify | 6.4 (v3.1) | Medium |
| CVE-2026-0552 | Simple Shopping Cart <= 5.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsc_display_product' Shor | Simple Shopping Cart | 6.4 (v3.1) | Medium |
| CVE-2026-0626 | WPFunnels <= 3.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpf_optin_form' Shortcode | WPFunnels – Funnel Builder for WooCommerce with Checkout & One Click Upsell | 6.4 (v3.1) | Medium |
| CVE-2026-0737 | Shortcodes Ultimate <= 7.4.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'su_lightbox' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-0738 | Shortcodes Ultimate <= 7.4.8 - authenticated (Contributor+) Stored Cross-Site Scripting via 'su_carousel' Shortcode | WP Shortcodes Plugin — Shortcodes Ultimate | 6.4 (v3.1) | Medium |
| CVE-2026-100106 | FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter | FiboSearch – Ajax Search for WooCommerce | 6.4 (v3.1) | Medium |
| CVE-2026-101925 | bbp style pack <= 6.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Author Display Name | bbp style pack | 6.4 (v3.1) | Medium |
| CVE-2026-13203 | Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_id' Shortcode Attribute | Live Composer – Free WordPress Website Builder | 6.4 (v3.1) | Medium |
| CVE-2026-13770 | AppMySite <= 3.15.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via save_ams_license_key AJAX Handler | AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) | 6.4 (v3.1) | Medium |
| CVE-2026-16786 | Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output S | Live Composer – Free WordPress Website Builder | 6.4 (v3.1) | Medium |
| CVE-2026-18400 | Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' | Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider | 6.4 (v3.1) | Medium |
| CVE-2026-18488 | Blocksy Companion <= 2.1.51 - Authenticated (Author+) Stored Cross-Site Scripting via 'tagName' Block Attribute (blocksy | Blocksy Companion | 6.4 (v3.1) | Medium |
| CVE-2026-3885 | WP Shortcodes Plugin — Shortcodes Ultimate <= 7.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_bo | Shortcodes Ultimate – Content Elements | 6.4 (v3.1) | Medium |
| CVE-2026-45797 | HeyForm Vulnerable to Stored XSS via Unauthenticated SVG File Upload | heyform | 6.4 (v4.0) | Medium |
| CVE-2026-50592 | Znuny Cross-Site Scripting Vulnerability | Znuny | 6.4 (v3.1) | Medium |
| CVE-2026-5092 | Greenshift <= 12.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Data URI | Greenshift – animation and page builder blocks | 6.4 (v3.1) | Medium |
| CVE-2026-5391 | LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes | Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress | 6.4 (v3.1) | Medium |
| CVE-2026-6454 | Firelight Lightbox <= 2.3.20 - Authenticated (Contributor+) Stored DOM Cross-Site Scripting via PDF beforeLoad 'href' At | Firelight Lightbox | 6.4 (v3.1) | Medium |
| CVE-2026-6565 | Style Kits – Advanced Theme Styles for Elementor <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via | Style Kits for Elementor | 6.4 (v3.1) | Medium |
| CVE-2026-87870 | Ninja Forms - Scheduled Exports <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via REST API Paramete | Ninja Forms - Scheduled Exports | 6.4 (v3.1) | Medium |
| CVE-2026-8791 | Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting | Booking System Trafft | 6.4 (v3.1) | Medium |
| CVE-2026-8977 | WP GDPR Cookie Consent <= 1.0.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'ninja_gdpr_ajax_actions' | WP GDPR Cookie Consent | 6.4 (v3.1) | Medium |
| CVE-2026-9281 | Master Addons For Elementor <= 3.1.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'jtlma_custom_js' Page Se | Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits | 6.4 (v3.1) | Medium |
| CVE-2026-96268 | Awesome Support <= 6.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'gdpr-data' Parameter via wpas_gd | Awesome Support – WordPress HelpDesk & Support Plugin | 6.4 (v3.1) | Medium |
| CVE-2026-96648 | Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'd | Data Tables Generator by Supsystic | 6.4 (v3.1) | Medium |
| CVE-2026-97396 | Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'd | Email Marketing for WordPress and WooCommerce – Retainful | 6.4 (v3.1) | Medium |
| CVE-2025-10567 | FunnelKit < 3.12.0.1 - Reflected XSS | FunnelKit | 6.3 (v3.1) | Medium |
| CVE-2026-100190 | Stored Cross-Site Scripting (XSS) via Crawler Capture Import in AIL Framework showDomain Page | ail framework | 6.3 (v4.0) | Medium |
| CVE-2026-115513 | OpenCATS before 0.12.0 Stored XSS via MRU Navigation Panel | OpenCATS | 6.3 (v4.0) | Medium |
| CVE-2026-43980 | Malla: Stored XSS via Meshtastic node names in multiple frontend pages | malla | 6.3 (v3.1) | Medium |
| CVE-2025-34281 | Stored Cross-Site Scripting (XSS) in ThingsBoard | thingsboard | 6.2 (v4.0) | Medium |
| CVE-2025-66312 | Grav Admin Plugin vulnerable to Cross-Site Scripting (XSS) Stored endpoint /admin/accounts/groups/[group] parameter `d | grav-plugin-admin | 6.2 (v4.0) | Medium |
| CVE-2012-1260 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2012-1261 | Scrutinizer NetFlow & sFlow Analyzer - Multiple Vulnerabilities | scrutinizer netflow & sflow analyzer | 6.1 (v3.1) | Medium |
| CVE-2012-5193 | Bitweaver 2.8.1 - Multiple Vulnerabilities | bitweaver | 6.1 (v3.1) | Medium |
| CVE-2014-4535 | Import Legacy Media <= 0.1 - Cross-Site Scripting | import legacy media | 6.1 (v3.1) | Medium |
| CVE-2014-4536 | Infusionsoft Gravity Forms Add-on < 1.5.7 - Cross-Site Scripting | infusionsoft gravity forms | 6.1 (v3.1) | Medium |
| CVE-2014-4539 | Movies <= 0.6 - Cross-Site Scripting | movies | 6.1 (v3.1) | Medium |
| CVE-2014-4544 | Podcast Channels < 0.28 - Cross-Site Scripting | podcast channels | 6.1 (v3.1) | Medium |
| CVE-2014-4558 | WooCommerce Swipe <= 2.7.1 - Cross-Site Scripting | swipehq-payment-gateway-woocommerce | 6.1 (v3.1) | Medium |
| CVE-2014-4561 | Ultimate Weather Plugin <= 1.0 - Cross-Site Scripting | ultimate-weather | 6.1 (v3.1) | Medium |
| CVE-2014-4592 | WP Planet <= 0.1 - Cross-Site Scripting | wp-planet | 6.1 (v3.1) | Medium |
| CVE-2014-9606 | Netsweeper 4.0.8 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2014-9607 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2014-9615 | Netsweeper 4.0.4 - Cross-Site Scripting | netsweeper | 6.1 (v3.1) | Medium |
| CVE-2015-4668 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 6.1 (v3.0) | Medium |
| CVE-2015-6477 | Nordex NC2 - Cross-Site Scripting | nordex control 2 scada | 6.1 (v3.1) | Medium |
| CVE-2015-6544 | Combodo iTop <2.2.0-2459 - Cross-Site Scripting | itop | 6.1 (v3.0) | Medium |
| CVE-2015-8349 | SourceBans <2.0 - Cross-Site Scripting | sourcebans | 6.1 (v3.0) | Medium |
| CVE-2015-8350 | WordPress Calls to Action <=2.4.3 - Authenticated Reflected XSS | call to action | 6.1 (v3.0) | Medium |
| CVE-2015-9312 | NewStatPress <=1.0.4 - Cross-Site Scripting | newstatpress | 6.1 (v3.0) | Medium |
| CVE-2015-9414 | WordPress Symposium <=15.8.1 - Cross-Site Scripting | wp-symposium | 6.1 (v3.1) | Medium |
| CVE-2016-1000126 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | admin-font-editor | 6.1 (v3.0) | Medium |
| CVE-2016-1000127 | WordPress AJAX Random Post <=2.00 - Cross-Site Scripting | ajax-random-post | 6.1 (v3.0) | Medium |
| CVE-2016-1000128 | WordPress anti-plagiarism <=3.60 - Cross-Site Scripting | anti-plagiarism | 6.1 (v3.0) | Medium |
| CVE-2016-1000129 | WordPress defa-online-image-protector <=3.3 - Cross-Site Scripting | defa-online-image-protector | 6.1 (v3.0) | Medium |
| CVE-2016-1000130 | WordPress e-search <=1.0 - Cross-Site Scripting | e-search | 6.1 (v3.0) | Medium |
| CVE-2016-1000131 | WordPress e-search <=1.0 - Cross-Site Scripting | esearch | 6.1 (v3.0) | Medium |
| CVE-2016-1000132 | WordPress enhanced-tooltipglossary 3.2.8 - Cross-Site Scripting | tooltip glossary | 6.1 (v3.0) | Medium |
| CVE-2016-1000133 | WordPress forget-about-shortcode-buttons 1.1.1 - Cross-Site Scripting | forget about shortcode buttons | 6.1 (v3.0) | Medium |
| CVE-2016-1000134 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium |
| CVE-2016-1000135 | WordPress HDW Video Gallery <=1.2 - Cross-Site Scripting | hdw-tube | 6.1 (v3.0) | Medium |
| CVE-2016-1000136 | WordPress heat-trackr 1.0 - Cross-Site Scripting | heat-trackr | 6.1 (v3.0) | Medium |
| CVE-2016-1000137 | WordPress Hero Maps Pro 2.1.0 - Cross-Site Scripting | hero-maps-pro | 6.1 (v3.0) | Medium |
| CVE-2016-1000138 | WordPress Admin Font Editor <=1.8 - Cross-Site Scripting | indexisto | 6.1 (v3.0) | Medium |
| CVE-2016-1000141 | WordPress Page Layout builder v1.9.3 - Cross-Site Scripting | page-layout-builder | 6.1 (v3.0) | Medium |
| CVE-2016-1000142 | WordPress MW Font Changer <=4.2.5 - Cross-Site Scripting | parsi-font | 6.1 (v3.0) | Medium |
| CVE-2016-1000143 | WordPress Photoxhibit 2.1.8 - Cross-Site Scripting | photoxhibit | 6.1 (v3.0) | Medium |
| CVE-2016-1000146 | WordPress Pondol Form to Mail <=1.1 - Cross-Site Scripting | pondol-formmail | 6.1 (v3.0) | Medium |
| CVE-2016-1000148 | WordPress S3 Video <=0.983 - Cross-Site Scripting | s3-video | 6.1 (v3.0) | Medium |
| CVE-2016-1000153 | WordPress Tidio Gallery <=1.1 - Cross-Site Scripting | tidio-gallery | 6.1 (v3.0) | Medium |
| CVE-2016-1000154 | WordPress WHIZZ <=1.0.7 - Cross-Site Scripting | whizz | 6.1 (v3.0) | Medium |
| CVE-2016-10973 | Brafton WordPress Plugin < 3.4.8 - Cross-Site Scripting | brafton | 6.1 (v3.1) | Medium |
| CVE-2016-10976 | Safe Editor Plugin < 1.2 - CSS/JS-injection | safe editor | 6.1 (v3.1) | Medium |
| CVE-2016-15041 | MainWP Dashboard <= 3.1.2 - Stored Cross-Site Scripting | mainwp dashboard | 6.1 (v3.1) | Medium |
| CVE-2016-7981 | SPIP <3.1.2 - Cross-Site Scripting | spip | 6.1 (v3.0) | Medium |
| CVE-2016-8527 | Aruba AirWave 8.2.3 - XML External Entity Injection / Cross-Site Scripting | airwave | 6.1 (v3.0) | Medium |
| CVE-2017-11629 | FineCMS <=5.0.10 - Cross-Site Scripting | finecms | 6.1 (v3.0) | Medium |
| CVE-2017-12583 | DokuWiki - Cross-Site Scripting | dokuwiki | 6.1 (v3.0) | Medium |
| CVE-2017-12794 | Django Debug Page - Cross-Site Scripting | django | 6.1 (v3.0) | Medium |
| CVE-2017-14622 | WordPress 2kb Amazon Affiliates Store <2.1.1 - Cross-Site Scripting | 2kb amazon affiliates store | 6.1 (v3.0) | Medium |
| CVE-2017-15287 | Dreambox WebControl 2.0.0 - Cross-Site Scripting | bouqueteditor | 6.1 (v3.0) | Medium |
| CVE-2017-15687 | Logitech Media Server - Cross-Site Scripting | media server | 6.1 (v3.0) | Medium |
| CVE-2017-17059 | WordPress amtyThumb Posts 8.1.3 - Cross-Site Scripting | amtythumb | 6.1 (v3.0) | Medium |
| CVE-2017-17451 | WordPress Mailster <=1.5.4 - Cross-Site Scripting | wp mailster | 6.1 (v3.0) | Medium |
| CVE-2017-18024 | AvantFAX 3.3.3 - Cross-Site Scripting | avantfax | 6.1 (v3.0) | Medium |
| CVE-2017-18487 | AdPush < 1.44 - Cross-Site Scripting | google adsense | 6.1 (v3.0) | Medium |
| CVE-2017-18490 | Contact Form Multi by BestWebSoft < 1.2.1 - Cross-Site Scripting | contact form multi | 6.1 (v3.0) | Medium |
| CVE-2017-18491 | Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting | contact form | 6.1 (v3.0) | Medium |
| CVE-2017-18492 | Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting | contact form to db | 6.1 (v3.0) | Medium |
| CVE-2017-18493 | Custom Admin Page by BestWebSoft < 0.1.2 - Cross-Site Scripting | custom admin page | 6.1 (v3.0) | Medium |
| CVE-2017-18494 | Custom Search by BestWebSoft < 1.36 - Cross-Site Scripting | custom search | 6.1 (v3.0) | Medium |
| CVE-2017-18496 | Htaccess by BestWebSoft < 1.7.6 - Cross-Site Scripting | htaccess | 6.1 (v3.0) | Medium |
| CVE-2017-18500 | Social Buttons Pack by BestWebSof < 1.1.1 - Cross-Site Scripting | social buttons pack | 6.1 (v3.0) | Medium |
| CVE-2017-18501 | Social Login by BestWebSoft < 0.2 - Cross-Site Scripting | social login | 6.1 (v3.0) | Medium |
| CVE-2017-18502 | Subscriber by BestWebSoft < 1.3.5 - Cross-Site Scripting | subscriber | 6.1 (v3.0) | Medium |
| CVE-2017-18505 | BestWebSoft's Twitter < 2.55 - Cross-Site Scripting | twitter button | 6.1 (v3.0) | Medium |
| CVE-2017-18516 | LinkedIn by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | |
| CVE-2017-18517 | Pinterest by BestWebSoft < 1.0.5 - Cross-Site Scripting | 6.1 (v3.0) | Medium | |
| CVE-2017-18518 | SMTP by BestWebSoft < 1.1.0 - Cross-Site Scripting | smtp | 6.1 (v3.0) | Medium |
| CVE-2017-18527 | Pagination by BestWebSoft < 1.0.7 - Cross-Site Scripting | pagination | 6.1 (v3.0) | Medium |
| CVE-2017-18528 | PDF & Print by BestWebSoft < 1.9.4 - Cross-Site Scripting | pdf & print | 6.1 (v3.0) | Medium |
| CVE-2017-18529 | PromoBar by BestWebSoft < 1.1.1 - Cross-Site Scripting | promobar | 6.1 (v3.0) | Medium |
| CVE-2017-18530 | Rating by BestWebSoft < 0.2 - Cross-Site Scripting | rating | 6.1 (v3.0) | Medium |
| CVE-2017-18532 | Realty by BestWebSoft < 1.1.0 - Cross-Site Scripting | realty | 6.1 (v3.0) | Medium |
| CVE-2017-18536 | WordPress Stop User Enumeration <=1.3.7 - Cross-Site Scripting | stop user enumeration | 6.1 (v3.0) | Medium |
| CVE-2017-18537 | Visitors Online by BestWebSoft < 1.0.0 - Cross-Site Scripting | visitors online | 6.1 (v3.0) | Medium |
| CVE-2017-18542 | Zendesk Help Center by BestWebSoft < 1.0.5 - Cross-Site Scripting | zendesk help center | 6.1 (v3.0) | Medium |
| CVE-2017-18556 | Google Analytics by BestWebSoft < 1.7.1 - Cross-Site Scripting | google analytics | 6.1 (v3.0) | Medium |
| CVE-2017-18557 | Google Maps by BestWebSoft < 1.3.6 - Cross-Site Scripting | google maps | 6.1 (v3.0) | Medium |
| CVE-2017-18558 | Testimonials by BestWebSoft < 0.1.9 - Cross-Site Scripting | testimonials | 6.1 (v3.0) | Medium |
| CVE-2017-18562 | Error Log Viewer by BestWebSoft < 1.0.6 - Cross-Site Scripting | error log viewer | 6.1 (v3.0) | Medium |
| CVE-2017-18564 | Sender by BestWebSoft < 1.2.1 - Cross-Site Scripting | sender | 6.1 (v3.0) | Medium |
| CVE-2017-18565 | Updater by BestWebSoft < 1.35 - Cross-Site Scripting | updater | 6.1 (v3.0) | Medium |
| CVE-2017-18566 | User Role by BestWebSoft < 1.5.6 - Cross-Site Scripting | user role | 6.1 (v3.0) | Medium |
| CVE-2017-18590 | Timesheet Plugin < 0.1.5 - Cross-Site Scripting | timesheet | 6.1 (v3.0) | Medium |
| CVE-2017-3132 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-3133 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 6.1 (v3.0) | Medium |
| CVE-2017-5631 | KMCIS CaseAware - Cross-Site Scripting | caseaware | 6.1 (v3.0) | Medium |
| CVE-2017-6443 | EPSON TMNet WebConfig 1.00 - Cross-Site Scripting | tmnet webconfig | 6.1 (v3.0) | Medium |
| CVE-2017-6478 | MaNGOSWebV4 < 4.0.8 - Cross-Site Scripting | mangoswebv4 | 6.1 (v3.1) | Medium |
| CVE-2017-7855 | IceWarp WebMail 11.3.1.5 - Cross-Site Scripting | server | 6.1 (v3.0) | Medium |
| CVE-2017-9140 | Reflected XSS - Telerik Reporting Module | telerik reporting | 6.1 (v3.0) | Medium |
| CVE-2017-9288 | WordPress Raygun4WP <=1.8.0 - Cross-Site Scripting | raygun4wp | 6.1 (v3.0) | Medium |
| CVE-2018-1000129 | Jolokia 1.3.7 - Cross-Site Scripting | jolokia | 6.1 (v3.0) | Medium |
| CVE-2018-10095 | Dolibarr <7.0.2 - Cross-Site Scripting | dolibarr | 6.1 (v3.0) | Medium |
| CVE-2018-10141 | Palo Alto Networks PAN-OS GlobalProtect <8.1.4 - Cross-Site Scripting | pan-os | 6.1 (v3.0) | Medium |
| CVE-2018-10230 | Zend Server <9.13 - Cross-Site Scripting | zend server | 6.1 (v3.0) | Medium |
| CVE-2018-10383 | Lantronix SecureLinx Spider (SLS) 2.2+ - Cross-Site Scripting | securelinx spider firmware | 6.1 (v3.0) | Medium |
| CVE-2018-11133 | Quest KACE SMA /common/run_cross_report.php 'fmt' XSS | kace system management appliance | 6.1 (v3.0) | Medium |
| CVE-2018-11227 | Monstra CMS <=3.0.4 - Cross-Site Scripting | monstra cms | 6.1 (v3.0) | Medium |
| CVE-2018-11709 | WordPress wpForo Forum <= 1.4.11 - Cross-Site Scripting | wpforo forum | 6.1 (v3.0) | Medium |
| CVE-2018-12111 | Canon PrintMe EFI - Cross-Site Scripting | efi printme | 6.1 (v3.0) | Medium |
| CVE-2018-12998 | Zoho manageengine - Cross-Site Scripting | firewall analyzer | 6.1 (v3.1) | Medium |
| CVE-2018-14013 | Synacor Zimbra Collaboration Suite Collaboration <8.8.11 - Cross-Site Scripting | zimbra collaboration suite | 6.1 (v3.0) | Medium |
| CVE-2018-16134 | Cybrotech CyBroHttpServer 1.0.3 - Cross-Site Scripting | cybrohttpserver | 6.1 (v3.0) | Medium |
| CVE-2018-16139 | BIBLIOsoft BIBLIOpac 2008 - Cross-Site Scripting | bibliopac | 6.1 (v3.0) | Medium |
| CVE-2018-17441 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium |
| CVE-2018-17443 | D-Link Central WiFiManager Software Controller 1.03 - Multiple Vulnerabilities | central wifimanager | 6.1 (v3.0) | Medium |
| CVE-2018-18608 | DedeCMS 5.7 SP2 - Cross-Site Scripting | dedecms | 6.1 (v3.0) | Medium |
| CVE-2018-19136 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium |
| CVE-2018-19137 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium |
| CVE-2018-19287 | WordPress Ninja Forms <3.3.18 - Cross-Site Scripting | ninja forms | 6.1 (v3.0) | Medium |
| CVE-2018-19439 | Oracle Secure Global Desktop Administration Console 4.4 - Cross-Site Scripting | secure global desktop | 6.1 (v3.0) | Medium |
| CVE-2018-19933 | Bolt CMS < 3.6.2 - Cross-Site Scripting | bolt cms | 6.1 (v3.0) | Medium |
| CVE-2018-20462 | WordPress JSmol2WP <=1.07 - Cross-Site Scripting | jsmol2wp | 6.1 (v3.0) | Medium |
| CVE-2018-20503 | SirsiDynix e-Library 3.5.x - Cross-Site Scripting | 8100l/8 firmware | 6.1 (v3.0) | Medium |
| CVE-2018-20824 | Atlassian Jira WallboardServlet <7.13.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium |
| CVE-2018-5230 | Atlassian Jira Confluence - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium |
| CVE-2018-5715 | SugarCRM 3.5.1 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium |
| CVE-2018-6882 | zimbra collaboration suite Cross-Site Scripting Vulnerability | zimbra collaboration suite | 6.1 (v3.1) | Medium |
| CVE-2018-7192 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2018-7196 | osTicket < 1.10.2 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2018-7203 | TwonkyMedia Server 7.0.11-8.5 - Persistent Cross-Site Scripting | twonky server | 6.1 (v3.0) | Medium |
| CVE-2018-7543 | WordPress Plugin Duplicator 1.2.32 - Cross-Site Scripting | duplicator | 6.1 (v3.1) | Medium |
| CVE-2018-7653 | YzmCMS v3.6 - Cross-Site Scripting | yzmcms | 6.1 (v3.0) | Medium |
| CVE-2018-8006 | Apache ActiveMQ <=5.15.5 - Cross-Site Scripting | activemq | 6.1 (v3.1) | Medium |
| CVE-2018-9238 | Yahei PHP Prober 0.4.7 - Cross-Site Scripting | yahei php prober | 6.1 (v3.0) | Medium |
| CVE-2019-0221 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.0) | Medium |
| CVE-2019-1010287 | Timesheet Next Gen <=1.5.3 - Cross-Site Scripting | timesheet next gen | 6.1 (v3.0) | Medium |
| CVE-2019-10475 | Jenkins build-metrics 1.3 - Cross-Site Scripting | build-metrics | 6.1 (v3.1) | Medium |
| CVE-2019-10685 | Prinect Archive System 2015 Release 2.6 - Cross-Site Scripting | prinect archiver | 6.1 (v3.0) | Medium |
| CVE-2019-11398 | UliCMS 2019.1 'Spitting Lama' - Persistent Cross-Site Scripting | ulicms | 6.1 (v3.0) | Medium |
| CVE-2019-11507 | Pulse Secure Pulse Connect Secure - Cross-Site Scripting (Reflected) | connect secure | 6.1 (v3.1) | Medium |
| CVE-2019-12461 | WebPort 1.19.1 - Cross-Site Scripting | web port | 6.1 (v3.0) | Medium |
| CVE-2019-12935 | Shopware < 5.5.8 - Cross-Site Scripting | shopware | 6.1 (v3.0) | Medium |
| CVE-2019-14696 | Open-School 3.0/Community Edition 2.3 - Cross-Site Scripting | open-school | 6.1 (v3.0) | Medium |
| CVE-2019-14750 | osTicket < 1.12.1 - Cross-Site Scripting | osticket | 6.1 (v3.0) | Medium |
| CVE-2019-14789 | Custom 404 Pro < 3.2.8 - Cross-Site Scripting | custom 404 pro | 6.1 (v3.0) | Medium |
| CVE-2019-14950 | WP Live Chat Support <= 8.0.27 — Stored Cross-Site Scripting | live chat | 6.1 (v3.0) | Medium |
| CVE-2019-14974 | SugarCRM Enterprise 9.0.0 - Cross-Site Scripting | sugarcrm | 6.1 (v3.0) | Medium |
| CVE-2019-15501 | L-Soft LISTSERV <16.5-2018a - Cross-Site Scripting | listserv | 6.1 (v3.0) | Medium |
| CVE-2019-15713 | WordPress My Calendar <= 3.1.9 - Cross-Site Scripting | my calendar | 6.1 (v3.0) | Medium |
| CVE-2019-15811 | DomainMOD <=4.13.0 - Cross-Site Scripting | domainmod | 6.1 (v3.0) | Medium |
| CVE-2019-15889 | WordPress Download Manager <2.9.94 - Cross-Site Scripting | wordpress download manager | 6.1 (v3.0) | Medium |
| CVE-2019-16332 | WordPress API Bearer Auth <20190907 - Cross-Site Scripting | api bearer auth | 6.1 (v3.1) | Medium |
| CVE-2019-16525 | WordPress Checklist <1.1.9 - Cross-Site Scripting | checklist | 6.1 (v3.1) | Medium |
| CVE-2019-16931 | WordPress Visualizer <3.3.1 - Cross-Site Scripting | visualizer | 6.1 (v3.1) | Medium |
| CVE-2019-17231 | WordPress OneTone theme <= 3.0.6 – Unauthenticated Stored XSS | onetone | 6.1 (v3.1) | Medium |
| CVE-2019-17504 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 6.1 (v3.1) | Medium |
| CVE-2019-18859 | Digi AnywhereUSB 14 - Reflective Cross-Site Scripting | anywhereusb/14 firmware | 6.1 (v3.1) | Medium |
| CVE-2019-18957 | MicroStrategy Library <11.1.3 - Cross-Site Scripting | microstrategy library | 6.1 (v3.1) | Medium |
| CVE-2019-19134 | WordPress Hero Maps Premium <=2.2.1 - Cross-Site Scripting | hero maps premium | 6.1 (v3.1) | Medium |
| CVE-2019-19908 | phpMyChat-Plus 1.98 - Cross-Site Scripting | phpmychat-plus | 6.1 (v3.1) | Medium |
| CVE-2019-20210 | WordPress CTHthemes - Cross-Site Scripting | citybook | 6.1 (v3.1) | Medium |
| CVE-2019-3402 | Jira < 8.1.1 - Cross-Site Scripting | jira | 6.1 (v3.0) | Medium |
| CVE-2019-3911 | LabKey Server Community Edition <18.3.0 - Cross-Site Scripting | labkey server | 6.1 (v3.1) | Medium |
| CVE-2019-6112 | WordPress Sell Media 2.4.1 - Cross-Site Scripting | sell media | 6.1 (v3.1) | Medium |
| CVE-2019-7219 | Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting | webaccess | 6.1 (v3.0) | Medium |
| CVE-2019-8937 | HotelDruid 2.3.0 - Cross-Site Scripting | hoteldruid | 6.1 (v3.0) | Medium |
| CVE-2019-9553 | Bolt CMS 3.6.4 - Cross-Site Scripting | bolt | 6.1 (v3.1) | Medium |
| CVE-2019-9912 | WP Google Maps < 7.10.43 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium |
| CVE-2019-9955 | Zyxel - Cross-Site Scripting | atp200 firmware | 6.1 (v3.0) | Medium |
| CVE-2020-1106 | Microsoft Office SharePoint XSS Vulnerability | sharepoint enterprise server | 6.1 (v3.1) | Medium |
| CVE-2020-11930 | WordPress GTranslate <2.8.52 - Cross-Site Scripting | translate wordpress with gtranslate | 6.1 (v3.1) | Medium |
| CVE-2020-12054 | WordPress Catch Breadcrumb <1.5.4 - Cross-Site Scripting | catch breadcrumb | 6.1 (v3.1) | Medium |
| CVE-2020-13258 | Contentful <=2020-05-21 - Cross-Site Scripting | python example | 6.1 (v3.1) | Medium |
| CVE-2020-13483 | Bitrix24 <=20.0.0 - Cross-Site Scripting | bitrix24 | 6.1 (v3.1) | Medium |
| CVE-2020-13820 | Extreme Management Center 8.4.1.24 - Cross-Site Scripting | extreme management center | 6.1 (v3.1) | Medium |
| CVE-2020-14408 | Agentejo Cockpit 0.10.2 - Cross-Site Scripting | cockpit | 6.1 (v3.1) | Medium |
| CVE-2020-14413 | NeDi 1.9C - Cross-Site Scripting | nedi | 6.1 (v3.1) | Medium |
| CVE-2020-15500 | TileServer GL <=3.0.0 - Cross-Site Scripting | tileservergl | 6.1 (v3.1) | Medium |
| CVE-2020-15599 | Victor CMS 1.0 - 'user_firstname' Persistent Cross-Site Scripting | victor cms | 6.1 (v3.1) | Medium |
| CVE-2020-15718 | RosarioSIS 6.7.2 - Cross-Site Scripting | rosariosis | 6.1 (v3.1) | Medium |
| CVE-2020-15895 | D-Link DIR-816L 2.x - Cross-Site Scripting | dir-816l firmware | 6.1 (v3.1) | Medium |
| CVE-2020-17362 | Nova Lite < 1.3.9 - Cross-Site Scripting | nova lite | 6.1 (v3.1) | Medium |
| CVE-2020-19283 | Jeesns 1.4.2 - Cross-Site Scripting | jeesns | 6.1 (v3.1) | Medium |
| CVE-2020-19515 | qdPM 9.1 - Cross-site Scripting | qdpm | 6.1 (v3.1) | Medium |
| CVE-2020-23517 | Aryanic HighMail (High CMS) - Cross-Site Scripting | high cms | 6.1 (v3.1) | Medium |
| CVE-2020-23814 | XXL-JOB v2.2.0 — Stored Cross Site Scripting | xxl-job | 6.1 (v3.1) | Medium |
| CVE-2020-24609 | Savsoft Quiz 5 - Stored Cross-Site Scripting | savsoft quiz | 6.1 (v3.1) | Medium |
| CVE-2020-24701 | OX Appsuite - Cross-Site Scripting | open-xchange appsuite | 6.1 (v3.1) | Medium |
| CVE-2020-27735 | Wing FTP 6.4.4 - Cross-Site Scripting | wing ftp server | 6.1 (v3.1) | Medium |
| CVE-2020-27982 | IceWarp WebMail 11.4.5.0 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium |
| CVE-2020-29164 | PacsOne Server <7.1.1 - Cross-Site Scripting | pacsone server | 6.1 (v3.1) | Medium |
| CVE-2020-35416 | PHPJabbers Appointment Scheduler 2.3 - Reflected XSS (Cross-Site Scripting) | phpjabbers appointment scheduler | 6.1 (v3.1) | Medium |
| CVE-2020-3580 | Cisco ASA/FTD Software - Cross-Site Scripting | firepower threat defense | 6.1 (v3.1) | Medium |
| CVE-2020-36510 | WordPress 15Zine <3.3.0 - Cross-Site Scripting | 15zine | 6.1 (v3.1) | Medium |
| CVE-2020-36731 | Flexible Checkout Fields for WooCommerce <= 2.3.1 - Unauthenticated Arbitrary Plugin Settings Update | flexible checkout fields for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2020-6171 | CLink Office 2.0 - Cross-Site Scripting | clink office | 6.1 (v3.1) | Medium |
| CVE-2020-7107 | WordPress Ultimate FAQ <1.8.30 - Cross-Site Scripting | ultimate faq | 6.1 (v3.1) | Medium |
| CVE-2020-8115 | Revive Adserver <=5.0.3 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium |
| CVE-2020-8191 | Citrix ADC/Gateway - Cross-Site Scripting | application delivery controller firmware | 6.1 (v3.1) | Medium |
| CVE-2020-8512 | IceWarp WebMail Server <=11.4.4.1 - Cross-Site Scripting | icewarp server | 6.1 (v3.1) | Medium |
| CVE-2020-8549 | WordPress Plugin Strong Testimonials 2.40.1 - Persistent Cross-Site Scripting | strong testimonials | 6.1 (v3.1) | Medium |
| CVE-2020-9036 | Jeedom <=4.0.38 - Cross-Site Scripting | jeedom | 6.1 (v3.1) | Medium |
| CVE-2020-9344 | Jira Subversion ALM for Enterprise <8.8.2 - Cross-Site Scripting | subversion application lifecycle management | 6.1 (v3.1) | Medium |
| CVE-2021-20137 | Gryphon Tower - Cross-Site Scripting | gryphon tower | 6.1 (v3.1) | Medium |
| CVE-2021-20792 | WordPress Quiz and Survey Master <7.1.14 - Cross-Site Scripting | quiz and survey master | 6.1 (v3.1) | Medium |
| CVE-2021-21799 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21800 | Advantech R-SeeNet 2.4.12 - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21801 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21802 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-21803 | Advantech R-SeeNet - Cross-Site Scripting | r-seenet | 6.1 (v3.1) | Medium |
| CVE-2021-22122 | FortiWeb - Cross Site Scripting | fortiweb | 6.1 (v3.1) | Medium |
| CVE-2021-24169 | WordPress Advanced Order Export For WooCommerce <3.1.8 - Authenticated Cross-Site Scripting | advanced order export | 6.1 (v3.1) | Medium |
| CVE-2021-24213 | GiveWP <= 2.9.7 - Cross-Site Scripting | givewp | 6.1 (v3.1) | Medium |
| CVE-2021-24214 | WordPress OpenID Connect Generic Client 3.8.0-3.8.1 - Cross-Site Scripting | openid connect generic client | 6.1 (v3.1) | Medium |
| CVE-2021-24235 | WordPress Goto Tour & Travel Theme <2.0 - Cross-Site Scripting | goto | 6.1 (v3.1) | Medium |
| CVE-2021-24237 | WordPress Realteo <=1.2.3 - Cross-Site Scripting | findeo | 6.1 (v3.1) | Medium |
| CVE-2021-24245 | WordPress Plugin Stop Spammers 2021.8 - 'log' Reflected Cross-site Scripting (XSS) | stop spammers | 6.1 (v3.1) | Medium |
| CVE-2021-24274 | WordPress Supsystic Ultimate Maps <1.2.5 - Cross-Site Scripting | ultimate maps | 6.1 (v3.1) | Medium |
| CVE-2021-24275 | Popup by Supsystic <1.10.5 - Cross-Site scripting | popup | 6.1 (v3.1) | Medium |
| CVE-2021-24276 | WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting | contact form | 6.1 (v3.1) | Medium |
| CVE-2021-24286 | WordPress Plugin Redirect 404 to Parent 1.3.0 - Cross-Site Scripting | redirect 404 to parent | 6.1 (v3.1) | Medium |
| CVE-2021-24287 | WordPress Select All Categories and Taxonomies <1.3.2 - Cross-Site Scripting | select all categories and taxonomies, change checkbox to radio buttons | 6.1 (v3.1) | Medium |
| CVE-2021-24298 | WordPress Simple Giveaways <2.36.2 - Cross-Site Scripting | simple giveaways | 6.1 (v3.1) | Medium |
| CVE-2021-24300 | WordPress WooCommerce <1.13.22 - Cross-Site Scripting | product slider for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2021-24316 | WordPress Mediumish Theme <=1.0.47 - Cross-Site Scripting | mediumish | 6.1 (v3.1) | Medium |
| CVE-2021-24320 | WordPress Bello Directory & Listing Theme <1.6.0 - Cross-Site Scripting | bello | 6.1 (v3.1) | Medium |
| CVE-2021-24335 | WordPress Car Repair Services & Auto Mechanic Theme <4.0 - Cross-Site Scripting | car repair services & auto mechanic | 6.1 (v3.1) | Medium |
| CVE-2021-24342 | WordPress JNews Theme <8.0.6 - Cross-Site Scripting | jnews | 6.1 (v3.1) | Medium |
| CVE-2021-24351 | WordPress The Plus Addons for Elementor <4.1.12 - Cross-Site Scripting | the plus addons for elementor | 6.1 (v3.1) | Medium |
| CVE-2021-24364 | WordPress Jannah Theme <5.4.4 - Cross-Site Scripting | jannah | 6.1 (v3.1) | Medium |
| CVE-2021-24387 | WordPress Pro Real Estate 7 Theme <3.1.1 - Cross-Site Scripting | real estate 7 | 6.1 (v3.1) | Medium |
| CVE-2021-24389 | WordPress FoodBakery <2.2 - Cross-Site Scripting | foodbakery | 6.1 (v3.1) | Medium |
| CVE-2021-24409 | Prismatic < 2.8 - Cross-Site Scripting | prismatic | 6.1 (v3.1) | Medium |
| CVE-2021-24435 | WordPress Titan Framework plugin <= 1.12.1 - Cross-Site Scripting | titan framework | 6.1 (v3.1) | Medium |
| CVE-2021-24436 | WordPress W3 Total Cache <2.1.4 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium |
| CVE-2021-24452 | WordPress W3 Total Cache <2.1.5 - Cross-Site Scripting | w3 total cache | 6.1 (v3.1) | Medium |
| CVE-2021-24488 | WordPress Post Grid <2.1.8 - Cross-Site Scripting | post grid | 6.1 (v3.1) | Medium |
| CVE-2021-24495 | Wordpress Marmoset Viewer <1.9.3 - Cross-Site Scripting | marmoset viewer | 6.1 (v3.1) | Medium |
| CVE-2021-24498 | WordPress Calendar Event Multi View <1.4.01 - Cross-Site Scripting | calendar event multi view | 6.1 (v3.1) | Medium |
| CVE-2021-24510 | WordPress MF Gig Calendar <=1.1 - Cross-Site Scripting | mf gig calendar | 6.1 (v3.1) | Medium |
| CVE-2021-24522 | ProfilePress < 3.1.11 - Cross-Site Scripting | profilepress | 6.1 (v3.1) | Medium |
| CVE-2021-24875 | WordPress eCommerce Product Catalog <3.0.39 - Cross-Site Scripting | ecommerce product catalog | 6.1 (v3.1) | Medium |
| CVE-2021-24876 | Registrations for The Events Calendar < 2.7.5 - Authenticated Reflected Cross-Site Scripting | registrations for the events calendar | 6.1 (v3.1) | Medium |
| CVE-2021-24878 | SupportCandy < 2.2.7 - Reflected Cross-Site Scripting | supportcandy | 6.1 (v3.1) | Medium |
| CVE-2021-24926 | WordPress Domain Check <1.0.17 - Cross-Site Scripting | domain check | 6.1 (v3.1) | Medium |
| CVE-2021-24940 | WordPress Persian Woocommerce <=5.8.0 - Cross-Site Scripting | persian-woocommerce | 6.1 (v3.1) | Medium |
| CVE-2021-24956 | Blog2Social < 6.8.7 - Cross-Site Scripting | blog2social | 6.1 (v3.1) | Medium |
| CVE-2021-24979 | Paid Memberships Pro < 2.6.6 - Cross-Site Scripting | paid memberships pro | 6.1 (v3.1) | Medium |
| CVE-2021-24987 | WordPress Super Socializer <7.13.30 - Cross-Site Scripting | super socializer | 6.1 (v3.1) | Medium |
| CVE-2021-25008 | The Code Snippets WordPress Plugin < 2.14.3 - Cross-Site Scripting | code snippets | 6.1 (v3.1) | Medium |
| CVE-2021-25016 | Chaty < 2.8.2 - Cross-Site Scripting | chaty | 6.1 (v3.1) | Medium |
| CVE-2021-25055 | WordPress FeedWordPress < 2022.0123 - Authenticated Cross-Site Scripting | feedwordpress | 6.1 (v3.1) | Medium |
| CVE-2021-25063 | WordPress Contact Form 7 Skins <=2.5.0 - Cross-Site Scripting | contact form 7 skins | 6.1 (v3.1) | Medium |
| CVE-2021-25079 | Contact Form Entries < 1.2.4 - Cross-Site Scripting | contact form entries | 6.1 (v3.1) | Medium |
| CVE-2021-25104 | WordPress Ocean Extra <1.9.5 - Cross-Site Scripting | ocean extra | 6.1 (v3.1) | Medium |
| CVE-2021-25112 | WordPress WHMCS Bridge <6.4b - Cross-Site Scripting | whmcs bridge | 6.1 (v3.1) | Medium |
| CVE-2021-25120 | Easy Social Feed < 6.2.7 - Cross-Site Scripting | easy social feed | 6.1 (v3.1) | Medium |
| CVE-2021-25161 | Aruba Instant Access Point (IAP) - Cross-Site Scripting | aruba-instant-access-point | 6.1 (v3.1) | Medium |
| CVE-2021-26247 | Cacti - Cross-Site Scripting | cacti | 6.1 (v3.1) | Medium |
| CVE-2021-26475 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium |
| CVE-2021-26702 | EPrints 3.4.2 - Cross-Site Scripting | eprints | 6.1 (v3.1) | Medium |
| CVE-2021-26710 | Redwood Report2Web 4.3.4.5 & 4.5.3 - Cross-Site Scripting | report2web | 6.1 (v3.1) | Medium |
| CVE-2021-26812 | Moodle Jitsi Meet 2.7-2.8.3 - Cross-Site Scripting | meet | 6.1 (v3.1) | Medium |
| CVE-2021-26947 | Odoo <= 15.0 - Cross-Site Scripting | odoo | 6.1 (v3.1) | Medium |
| CVE-2021-27309 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium |
| CVE-2021-27310 | Clansphere CMS 2011.4 - Cross-Site Scripting | clansphere | 6.1 (v3.1) | Medium |
| CVE-2021-27330 | Triconsole Datepicker Calendar <3.77 - Cross-Site Scripting | datepicker calendar | 6.1 (v3.1) | Medium |
| CVE-2021-27519 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium |
| CVE-2021-27520 | FUDForum 3.1.0 - Cross-Site Scripting | fudforum | 6.1 (v3.1) | Medium |
| CVE-2021-27695 | openMAINT openMAINT 2.1-3.3-b - 'Multiple' Persistent Cross-Site Scripting | openmaint | 6.1 (v3.1) | Medium |
| CVE-2021-27909 | Mautic <3.3.4 - Cross-Site Scripting | mautic | 6.1 (v3.1) | Medium |
| CVE-2021-29625 | Adminer <=4.8.0 - Cross-Site Scripting | adminer | 6.1 (v3.1) | Medium |
| CVE-2021-3002 | Seo Panel 4.8.0 - Cross-Site Scripting | seo panel | 6.1 (v3.1) | Medium |
| CVE-2021-30049 | SysAid Technologies 20.3.64 b14 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium |
| CVE-2021-30134 | Php-mod/curl Library <2.3.2 - Cross-Site Scripting | php curl class | 6.1 (v3.1) | Medium |
| CVE-2021-30151 | Sidekiq <=6.2.0 - Cross-Site Scripting | sidekiq | 6.1 (v3.1) | Medium |
| CVE-2021-30203 | Dzzoffice 2.02.1 - Cross-Site Scripting | dzzoffice | 6.1 (v3.1) | Medium |
| CVE-2021-30213 | Knowage Suite 7.3 - Cross-Site Scripting | knowage | 6.1 (v3.1) | Medium |
| CVE-2021-31537 | SIS Informatik REWE GO SP17 <7.7 - Cross-Site Scripting | sis-rewe go | 6.1 (v3.1) | Medium |
| CVE-2021-31589 | BeyondTrust Secure Remote Access Base <=6.0.1 - Cross-Site Scripting | appliance base software | 6.1 (v3.1) | Medium |
| CVE-2021-31682 | WebCTRL OEM <= 6.5 - Cross-Site Scripting | webctrl | 6.1 (v3.1) | Medium |
| CVE-2021-31862 | SysAid 20.4.74 - Cross-Site Scripting | sysaid | 6.1 (v3.1) | Medium |
| CVE-2021-32478 | Moodle 3.8-3.10.3 - Reflected XSS & Open Redirect | moodle | 6.1 (v3.1) | Medium |
| CVE-2021-34630 | GTranslate < 2.8.65 - Cross-Site Scripting | gtranslate | 6.1 (v3.1) | Medium |
| CVE-2021-34640 | WordPress Securimage-WP-Fixed <=3.5.4 - Cross-Site Scripting | securimage-wp-fixed | 6.1 (v3.1) | Medium |
| CVE-2021-34643 | WordPress Skaut Bazar <1.3.3 - Cross-Site Scripting | skaut-bazar | 6.1 (v3.1) | Medium |
| CVE-2021-35265 | MaxSite CMS > V106 - Cross-Site Scripting | maxsite cms | 6.1 (v3.1) | Medium |
| CVE-2021-35488 | Thruk 2.40-2 - Cross-Site Scripting | thruk | 6.1 (v3.1) | Medium |
| CVE-2021-36646 | KodExplorer - Cross-Site Scripting | kod-explorer | 6.1 (v3.1) | Medium |
| CVE-2021-37416 | Zoho ManageEngine ADSelfService Plus <=6103 - Cross-Site Scripting | manageengine adselfservice plus | 6.1 (v3.1) | Medium |
| CVE-2021-37573 | Tiny Java Web Server - Cross-Site Scripting | tiny java web server | 6.1 (v3.1) | Medium |
| CVE-2021-37833 | Hotel Druid 3.0.2 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium |
| CVE-2021-3831 | Gnuboard 5 - Cross-Site Scripting | gnuboard5 | 6.1 (v3.1) | Medium |
| CVE-2021-38702 | Cyberoam NetGenie Cross-Site Scripting | netgenie c0101b1-20141120-ng11vo firmware | 6.1 (v3.1) | Medium |
| CVE-2021-38704 | ClinicCases 7.3.3 Cross-Site Scripting | cliniccases | 6.1 (v3.1) | Medium |
| CVE-2021-39320 | WordPress Under Construction <1.19 - Cross-Site Scripting | underconstruction | 6.1 (v3.1) | Medium |
| CVE-2021-39322 | WordPress Easy Social Icons Plugin < 3.0.9 - Cross-Site Scripting | easy social icons | 6.1 (v3.1) | Medium |
| CVE-2021-39350 | FV Flowplayer Video Player WordPress plugin - Authenticated Cross-Site Scripting | fv flowplayer video player | 6.1 (v3.1) | Medium |
| CVE-2021-39411 | Hospital Management System 1.0 - Cross-Site Scripting | hospital management system | 6.1 (v3.1) | Medium |
| CVE-2021-40272 | IRTS OP5 Monitor - Cross-Site Scripting | monitor | 6.1 (v3.1) | Medium |
| CVE-2021-40868 | Cloudron 6.2 Cross-Site Scripting | cloudron | 6.1 (v3.1) | Medium |
| CVE-2021-40968 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-40969 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-40970 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-40971 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-40972 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-40973 | Spotweb <= 1.5.1 - Cross Site Scripting | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-41174 | Grafana 8.0.0 <= v.8.2.2 - Angularjs Rendering Cross-Site Scripting | grafana | 6.1 (v3.1) | Medium |
| CVE-2021-41467 | JustWriting - Cross-Site Scripting | justwriting | 6.1 (v3.1) | Medium |
| CVE-2021-41878 | i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS) | i-panel administration system | 6.1 (v3.1) | Medium |
| CVE-2021-41951 | Resourcespace - Cross-Site Scripting | resourcespace | 6.1 (v3.1) | Medium |
| CVE-2021-42063 | SAP Knowledge Warehouse <=7.5.0 - Cross-Site Scripting | knowledge warehouse | 6.1 (v3.1) | Medium |
| CVE-2021-42551 | NetBiblio WebOPAC - Cross-Site Scripting | netbiblio | 6.1 (v3.1) | Medium |
| CVE-2021-42565 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium |
| CVE-2021-42566 | myfactory FMS - Cross-Site Scripting | fms | 6.1 (v3.1) | Medium |
| CVE-2021-42567 | Apereo CAS Cross-Site Scripting | central authentication service | 6.1 (v3.1) | Medium |
| CVE-2021-43062 | Fortinet FortiMail 7.0.1 - Cross-Site Scripting | fortimail | 6.1 (v3.1) | Medium |
| CVE-2021-43725 | Spotweb <= 1.5.1 - Cross Site Scripting (Reflected) | spotweb | 6.1 (v3.1) | Medium |
| CVE-2021-45422 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium |
| CVE-2021-45425 | SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS) | safari montage | 6.1 (v3.1) | Medium |
| CVE-2021-46387 | Zyxel ZyWALL 2 Plus Internet Security Appliance - Cross-Site Scripting (XSS) | zywall 2 plus internet security appliance firmware | 6.1 (v3.1) | Medium |
| CVE-2022-0087 | Keystone 6 Login Page - Open Redirect and Cross-Site Scripting | keystone | 6.1 (v3.1) | Medium |
| CVE-2022-0147 | WordPress Cookie Information/Free GDPR Consent Solution <2.0.8 - Cross-Site Scripting | wp-gdpr-compliance | 6.1 (v3.1) | Medium |
| CVE-2022-0149 | WooCommerce Stored Exporter WordPress Plugin < 2.7.1 - Cross-Site Scripting | store exporter for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2022-0189 | WordPress RSS Aggregator < 4.20 - Authenticated Cross-Site Scripting | wp rss aggregator | 6.1 (v3.1) | Medium |
| CVE-2022-0201 | WordPress Permalink Manager <2.2.15 - Cross-Site Scripting | permalink manager lite | 6.1 (v3.1) | Medium |
| CVE-2022-0206 | WordPress NewStatPress <1.3.6 - Cross-Site Scripting | newstatpress | 6.1 (v3.1) | Medium |
| CVE-2022-0208 | WordPress Plugin MapPress <2.73.4 - Cross-Site Scripting | mappress | 6.1 (v3.1) | Medium |
| CVE-2022-0212 | WordPress Spider Calendar <=1.5.65 - Cross-Site Scripting | spidercalendar | 6.1 (v3.1) | Medium |
| CVE-2022-0234 | WordPress WOOCS < 1.3.7.5 - Cross-Site Scripting | woocs | 6.1 (v3.1) | Medium |
| CVE-2022-0250 | Redirection for Contact Form 7 < 2.5.0 - Cross-Site Scripting | redirection for contact form 7 | 6.1 (v3.1) | Medium |
| CVE-2022-0271 | LearnPress <4.1.6 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium |
| CVE-2022-0346 | WordPress XML Sitemap Generator for Google <2.0.4 - Cross-Site Scripting/Remote Code Execution | xml sitemap generator | 6.1 (v3.1) | Medium |
| CVE-2022-0381 | WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting | embed swagger | 6.1 (v3.1) | Medium |
| CVE-2022-0437 | karma-runner DOM-based Cross-Site Scripting | karma | 6.1 (v3.1) | Medium |
| CVE-2022-0533 | Ditty (formerly Ditty News Ticker) < 3.0.15 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium |
| CVE-2022-0599 | WordPress Mapping Multiple URLs Redirect Same Page <=5.8 - Cross-Site Scripting | mapping multiple urls redirect same page | 6.1 (v3.1) | Medium |
| CVE-2022-0678 | Microweber <1.2.11 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-0864 | UpdraftPlus < 1.22.9 - Cross-Site Scripting | updraftplus | 6.1 (v3.1) | Medium |
| CVE-2022-0879 | Caldera Forms < 1.9.7 - Reflected Cross-Site Scripting | caldera forms | 6.1 (v3.1) | Medium |
| CVE-2022-0899 | Header Footer Code Manager < 1.1.24 - Cross-Site Scripting | header footer code manager | 6.1 (v3.1) | Medium |
| CVE-2022-1007 | WordPress Advanced Booking Calendar <1.7.1 - Cross-Site Scripting | advanced booking calendar | 6.1 (v3.1) | Medium |
| CVE-2022-1168 | WordPress WP JobSearch <1.5.1 - Cross-Site Scripting | jobsearch wp job board | 6.1 (v3.1) | Medium |
| CVE-2022-1170 | JobMonster < 4.5.2.9 - Cross-Site Scripting | jobmonster | 6.1 (v3.1) | Medium |
| CVE-2022-1221 | WordPress Gwyn's Imagemap Selector <=0.3.3 - Cross-Site Scripting | gwyn's imagemap selector | 6.1 (v3.1) | Medium |
| CVE-2022-1439 | Microweber <1.2.15 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-1597 | WordPress WPQA <5.4 - Cross-Site Scripting | wpqa builder | 6.1 (v3.1) | Medium |
| CVE-2022-1724 | WordPress Simple Membership <4.1.1 - Cross-Site Scripting | simple membership | 6.1 (v3.1) | Medium |
| CVE-2022-1756 | Newsletter < 7.4.5 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium |
| CVE-2022-1904 | WordPress Easy Pricing Tables <3.2.1 - Cross-Site Scripting | easy pricing tables | 6.1 (v3.1) | Medium |
| CVE-2022-1906 | WordPress Copyright Proof <=4.16 - Cross-Site-Scripting | copyright proof | 6.1 (v3.1) | Medium |
| CVE-2022-1910 | WordPress Shortcodes and Extra Features for Phlox <2.9.8 - Cross-Site Scripting | shortcodes and extra features for phlox theme | 6.1 (v3.1) | Medium |
| CVE-2022-1916 | WordPress Active Products Tables for WooCommerce <1.0.5 - Cross-Site Scripting | woot | 6.1 (v3.1) | Medium |
| CVE-2022-1933 | WordPress CDI <5.1.9 - Cross Site Scripting | collect and deliver interface for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2022-1937 | WordPress Awin Data Feed <=1.6 - Cross-Site Scripting | awin data feed | 6.1 (v3.1) | Medium |
| CVE-2022-1946 | WordPress Gallery <2.0.0 - Cross-Site Scripting | gallery | 6.1 (v3.1) | Medium |
| CVE-2022-2130 | Microweber < 1.2.17 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-2168 | WordPress Download Manager < 3.2.44 - Authenticated Cross-Site Scripting | download manager | 6.1 (v3.1) | Medium |
| CVE-2022-2174 | microweber 1.2.18 - Cross-site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-2187 | WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting | contact form 7 captcha | 6.1 (v3.1) | Medium |
| CVE-2022-22242 | Juniper Web Device Manager - Cross-Site Scripting | junos | 6.1 (v3.1) | Medium |
| CVE-2022-2290 | Trilium <0.52.4 - Cross-Site Scripting | trilium | 6.1 (v3.1) | Medium |
| CVE-2022-23397 | Cedar Gate EZ-NET <= 6.8.0 - Cross-Site Scripting | ez-net portal | 6.1 (v3.1) | Medium |
| CVE-2022-23808 | phpMyAdmin < 5.1.2 - Cross-Site Scripting | phpmyadmin | 6.1 (v3.1) | Medium |
| CVE-2022-2383 | WordPress Feed Them Social <3.0.1 - Cross-Site Scripting | feed them social | 6.1 (v3.1) | Medium |
| CVE-2022-24384 | SmarterTools SmarterTrack - Cross-Site Scripting | smartertrack | 6.1 (v3.1) | Medium |
| CVE-2022-25323 | ZEROF Web Server 2.0 - Cross-Site Scripting | web server | 6.1 (v3.1) | Medium |
| CVE-2022-2599 | WordPress Anti-Malware Security and Brute-Force Firewall <4.21.83 - Cross-Site Scripting | anti-malware security and brute-force firewall | 6.1 (v3.1) | Medium |
| CVE-2022-2627 | WordPress Newspaper < 12 - Cross-Site Scripting | newspaper | 6.1 (v3.1) | Medium |
| CVE-2022-26564 | HotelDruid Hotel Management Software 3.0.3 - Cross-Site Scripting | hoteldruid | 6.1 (v3.1) | Medium |
| CVE-2022-2733 | Openemr < 7.0.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium |
| CVE-2022-27926 | Zimbra Collaboration (ZCS) - Cross Site Scripting | collaboration | 6.1 (v3.1) | Medium |
| CVE-2022-28290 | WordPress Country Selector <1.6.6 - Cross-Site Scripting | wordpress country selector | 6.1 (v3.1) | Medium |
| CVE-2022-28363 | Reprise License Manager 14.2 - Cross-Site Scripting | reprise license manager | 6.1 (v3.1) | Medium |
| CVE-2022-28508 | MantisBT < 2.25.2 - Cross-Site Scripting | mantisbt | 6.1 (v3.1) | Medium |
| CVE-2022-29004 | Diary Management System 1.0 - Cross-Site Scripting | e-diary management system | 6.1 (v3.1) | Medium |
| CVE-2022-29005 | Online Birth Certificate System 1.2 - Stored Cross-Site Scripting | online birth certificate system | 6.1 (v3.1) | Medium |
| CVE-2022-29548 | WSO2 - Cross-Site Scripting | api manager | 6.1 (v3.1) | Medium |
| CVE-2022-30489 | Wavlink WN-535G3 - Cross-Site Scripting | wn535g3 firmware | 6.1 (v3.1) | Medium |
| CVE-2022-30514 | School Dormitory Management System 1.0 - Authenticated Cross-Site Scripting | school dormitory management system | 6.1 (v3.1) | Medium |
| CVE-2022-3062 | Simple File List < 4.4.12 - Cross Site Scripting | simple-file-list | 6.1 (v3.1) | Medium |
| CVE-2022-30776 | Atmail 6.5.0 - Cross-Site Scripting | atmail | 6.1 (v3.1) | Medium |
| CVE-2022-30777 | Parallels H-Sphere 3.6.1713 - Cross-Site Scripting | h-sphere | 6.1 (v3.1) | Medium |
| CVE-2022-30983 | Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 Cross-Site Scripting Vulnerability | Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 | 6.1 (v3.1) | Medium |
| CVE-2022-31470 | Axigen WebMail - Cross-Site Scripting | webmail | 6.1 (v3.1) | Medium |
| CVE-2022-31798 | Nortek Linear eMerge E3-Series - Cross-Site Scripting | emerge e3 firmware | 6.1 (v3.1) | Medium |
| CVE-2022-32195 | Open edX <2022-06-06 - Cross-Site Scripting | open edx | 6.1 (v3.1) | Medium |
| CVE-2022-3242 | Microweber <1.3.2 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2022-32770 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-32771 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2022-34093 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium |
| CVE-2022-34094 | Software Publico Brasileiro i3geo v7.0.5 - Cross-Site Scripting | i3geo | 6.1 (v3.1) | Medium |
| CVE-2022-34305 | Apache Tomcat Examples Web Application - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium |
| CVE-2022-34328 | PMB 7.3.10 - Cross-Site Scripting | pmb | 6.1 (v3.1) | Medium |
| CVE-2022-3484 | WordPress WPB Show Core - Cross-Site Scripting | wpb show core | 6.1 (v3.1) | Medium |
| CVE-2022-35155 | Bus Pass Management System 1.0 - Cross-Site Scripting (XSS) | bus pass management system | 6.1 (v3.1) | Medium |
| CVE-2022-35416 | H3C SSL VPN <=2022-07-10 - Cross-Site Scripting | ssl vpn | 6.1 (v3.1) | Medium |
| CVE-2022-35493 | eShop 3.0.4 - Cross-Site Scripting | eshop - ecommerce / store website | 6.1 (v3.1) | Medium |
| CVE-2022-35653 | Moodle LTI module Reflected - Cross-Site Scripting | moodle | 6.1 (v3.1) | Medium |
| CVE-2022-3578 | WordPress ProfileGrid <5.1.1 - Cross-Site Scripting | profilegrid | 6.1 (v3.1) | Medium |
| CVE-2022-37153 | Artica Proxy 4.30.000000 - Cross-Site Scripting | artica proxy | 6.1 (v3.1) | Medium |
| CVE-2022-3766 | phpMyFAQ < 3.1.8 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2022-38295 | Cuppa CMS v1.0 - Cross Site Scripting | cuppacms | 6.1 (v3.1) | Medium |
| CVE-2022-38463 | ServiceNow - Cross-Site Scripting | servicenow | 6.1 (v3.1) | Medium |
| CVE-2022-38467 | CRM Perks Forms < 1.1.1 - Cross Site Scripting | crm perks forms | 6.1 (v3.1) | Medium |
| CVE-2022-3908 | WordPress Helloprint <1.4.7 - Cross-Site Scripting | helloprint | 6.1 (v3.1) | Medium |
| CVE-2022-39195 | LISTSERV 17 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium |
| CVE-2022-40359 | Kae's File Manager <=1.4.7 - Cross-Site Scripting | kfm | 6.1 (v3.1) | Medium |
| CVE-2022-41441 | ReQlogic v11.3 - Cross Site Scripting | reqlogic | 6.1 (v3.1) | Medium |
| CVE-2022-42746 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-42747 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-42748 | CandidATS 3.0.0 - Cross-Site Scripting. | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-42749 | CandidATS 3.0.0 - Cross-Site Scripting | candidats | 6.1 (v3.1) | Medium |
| CVE-2022-4301 | WordPress Sunshine Photo Cart <2.9.15 - Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium |
| CVE-2022-43014 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43016 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43017 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-43018 | OpenCATS 0.9.6 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-4320 | WordPress Events Calendar <1.4.5 - Cross-Site Scripting | wordpress events calendar plugin | 6.1 (v3.1) | Medium |
| CVE-2022-4321 | PDF Generator for WordPress < 1.1.2 - Cross Site Scripting | pdf generator for wordpress | 6.1 (v3.1) | Medium |
| CVE-2022-45365 | Stock Ticker <= 3.23.2 - Cross-Site-Scripting | stock ticker | 6.1 (v3.1) | Medium |
| CVE-2022-45836 | WordPress Download Manager <= 3.2.59 - Reflected XSS | download manager | 6.1 (v3.1) | Medium |
| CVE-2022-46381 | Linear eMerge E3-Series - Cross-Site Scripting | linear emerge e3 access control firmware | 6.1 (v3.1) | Medium |
| CVE-2022-46888 | NexusPHP <1.7.33 - Cross-Site Scripting | nexusphp | 6.1 (v3.1) | Medium |
| CVE-2022-48012 | OpenCATS 0.9.7 - Cross-Site Scripting | opencats | 6.1 (v3.1) | Medium |
| CVE-2022-48197 | Yahoo User Interface library (YUI2) TreeView v2.8.2 - Cross-Site Scripting | yui | 6.1 (v3.1) | Medium |
| CVE-2022-4897 | WordPress BackupBuddy <8.8.3 - Cross Site Scripting | backupbuddy | 6.1 (v3.1) | Medium |
| CVE-2022-4971 | Sassy Social Share <= 3.3.3 - Cross-Site Scripting | sassy social share | 6.1 (v3.1) | Medium |
| CVE-2023-0099 | Simple URLs < 115 - Cross Site Scripting | simple urls | 6.1 (v3.1) | Medium |
| CVE-2023-0236 | WordPress Tutor LMS <2.0.10 - Cross Site Scripting | tutor lms | 6.1 (v3.1) | Medium |
| CVE-2023-0334 | ShortPixel Adaptive Images < 3.6.3 - Cross Site Scripting | shortpixel adaptive images | 6.1 (v3.1) | Medium |
| CVE-2023-0448 | WP Helper Lite < 4.3 - Cross-Site Scripting | wp helper premium | 6.1 (v3.1) | Medium |
| CVE-2023-0514 | Membership Database <= 1.0 - Cross-Site Scripting | membership database | 6.1 (v3.1) | Medium |
| CVE-2023-0527 | Online Security Guards Hiring System - Cross-Site Scripting | online security guards hiring system | 6.1 (v3.1) | Medium |
| CVE-2023-0602 | Twittee Text Tweet <= 1.0.8 - Cross-Site Scripting | twittee text tweet | 6.1 (v3.1) | Medium |
| CVE-2023-0676 | phpIPAM 1.5.1 - Cross-site Scripting | phpipam | 6.1 (v3.1) | Medium |
| CVE-2023-0942 | WordPress Japanized for WooCommerce <2.5.5 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2023-0948 | WordPress Japanized for WooCommerce <2.5.8 - Cross-Site Scripting | japanized for woocommerce | 6.1 (v3.1) | Medium |
| CVE-2023-0968 | WordPress Watu Quiz <3.3.9.1 - Cross-Site Scripting | watu quiz | 6.1 (v3.1) | Medium |
| CVE-2023-1080 | WordPress GN Publisher <1.5.6 - Cross-Site Scripting | gn publisher | 6.1 (v3.1) | Medium |
| CVE-2023-1119 | WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting | wp-optimize,srbtranslatin | 6.1 (v3.1) | Medium |
| CVE-2023-1546 | MyCryptoCheckout < 2.124 - Cross-Site Scripting | mycryptocheckout | 6.1 (v3.1) | Medium |
| CVE-2023-1780 | Companion Sitemap Generator < 4.5.3 - Cross-Site Scripting | companion sitemap generator | 6.1 (v3.1) | Medium |
| CVE-2023-1880 | Phpmyfaq v3.1.11 - Cross-Site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2023-1893 | Login Configurator <=2.1 - Cross-Site Scripting | login configurator | 6.1 (v3.1) | Medium |
| CVE-2023-2023 | Custom 404 Pro < 3.7.3 - Cross-Site Scripting | custom 404 pro | 6.1 (v3.1) | Medium |
| CVE-2023-2122 | Image Optimizer by 10web < 1.0.26 - Cross-Site Scripting | image optimizer | 6.1 (v3.1) | Medium |
| CVE-2023-2256 | WordPress Product Addons & Fields for WooCommerce < 32.0.7 - Cross-Site Scripting | woocommerce-product-addon | 6.1 (v3.1) | Medium |
| CVE-2023-2309 | wpForo Forum <= 2.1.8 - Cross-Site Scripting | wpforo forum | 6.1 (v3.1) | Medium |
| CVE-2023-23161 | Art Gallery Management System Project v1.0 - Cross-Site Scripting | art gallery management system | 6.1 (v3.1) | Medium |
| CVE-2023-23491 | Quick Event Manager < 9.7.5 - Cross-Site Scripting | quick event manager | 6.1 (v3.1) | Medium |
| CVE-2023-23548 | XSS in business intelligence | checkmk | 6.1 (v3.1) | Medium |
| CVE-2023-24278 | Squidex <7.4.0 - Cross-Site Scripting | squidex | 6.1 (v3.1) | Medium |
| CVE-2023-24322 | mojoPortal 2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium |
| CVE-2023-24657 | phpIPAM - 1.6 - Cross-Site Scripting | phpipam | 6.1 (v3.1) | Medium |
| CVE-2023-25346 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 6.1 (v3.1) | Medium |
| CVE-2023-2624 | KiviCare WordPress Plugin - Cross-Site Scripting | kivicare | 6.1 (v3.1) | Medium |
| CVE-2023-27008 | ATutor < 2.2.1 - Cross Site Scripting | atutor | 6.1 (v3.1) | Medium |
| CVE-2023-27641 | L-Soft LISTSERV 16.5 - Cross-Site Scripting | listserv | 6.1 (v3.1) | Medium |
| CVE-2023-2779 | Super Socializer < 7.13.52 - Cross-Site Scripting | social share, social login and social comments | 6.1 (v3.1) | Medium |
| CVE-2023-27922 | Newsletter < 7.6.9 - Cross-Site Scripting | newsletter | 6.1 (v3.1) | Medium |
| CVE-2023-2813 | Wordpress Multiple Themes - Reflected Cross-Site Scripting | connections reloaded | 6.1 (v3.1) | Medium |
| CVE-2023-2822 | Ellucian Ethos Identity CAS - Cross-Site Scripting | ethos identity | 6.1 (v3.1) | Medium |
| CVE-2023-2948 | OpenEMR < 7.0.1 - Cross-Site Scripting | openemr | 6.1 (v3.1) | Medium |
| CVE-2023-29489 | cPanel < 11.109.9999.116 - Cross-Site Scripting | cpanel | 6.1 (v3.1) | Medium |
| CVE-2023-2949 | OpenEMR < 7.0.1 - Cross-site Scripting | openemr | 6.1 (v3.1) | Medium |
| CVE-2023-29506 | XWiki >= 13.10.8 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-29623 | Purchase Order Management v1.0 - Cross Site Scripting (Reflected) | purchase order management | 6.1 (v3.1) | Medium |
| CVE-2023-30210 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium |
| CVE-2023-30212 | OURPHP <= 7.2.0 - Cross Site Scripting | ourphp | 6.1 (v3.1) | Medium |
| CVE-2023-30256 | Webkul QloApps 1.5.2 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium |
| CVE-2023-34599 | Gibbon v25.0.0 - Cross-Site Scripting | gibbon | 6.1 (v3.1) | Medium |
| CVE-2023-3479 | Hestiacp <= 1.7.7 - Cross-Site Scripting | control panel | 6.1 (v3.1) | Medium |
| CVE-2023-35155 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-35156 | XWiki >= 6.0-rc-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-35158 | XWiki - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-35159 | XWiki >= 3.4-milestone-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-35160 | XWiki >= 2.5-milestone-2 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-35161 | XWiki >= 6.2-milestone-1 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-35162 | XWiki < 14.10.5 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-3521 | FOSSBilling < 0.5.3 - Cross-Site Scripting | fossbilling | 6.1 (v3.1) | Medium |
| CVE-2023-36289 | Webkul QloApps 1.6.0 - Cross-site Scripting | qloapps | 6.1 (v3.1) | Medium |
| CVE-2023-36306 | Adiscon LogAnalyzer v.4.1.13 - Cross-Site Scripting | loganalyzer | 6.1 (v3.1) | Medium |
| CVE-2023-36346 | POS Codekop v2.0 - Cross Site Scripting | codekop | 6.1 (v3.1) | Medium |
| CVE-2023-37580 | Zimbra Collaboration Suite (ZCS) v.8.8.15 - Cross-Site Scripting | zimbra | 6.1 (v3.1) | Medium |
| CVE-2023-37728 | IceWarp Webmail Server v10.2.1 - Cross Site Scripting | icewarp | 6.1 (v3.1) | Medium |
| CVE-2023-37979 | Ninja Forms < 3.6.26 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium |
| CVE-2023-37988 | Contact Form Generator <= 2.5.5 - Cross-Site Scripting | contact form generator | 6.1 (v3.1) | Medium |
| CVE-2023-38040 | Revive Adserver 5.4.1 - Cross-Site Scripting | revive adserver | 6.1 (v3.1) | Medium |
| CVE-2023-38192 | SuperWebMailer 9.00.0.01710 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium |
| CVE-2023-38194 | SuperWebMailer - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium |
| CVE-2023-3843 | mooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-3844 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-3845 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-3846 | MooDating 1.2 - Cross-Site Scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-3847 | MooDating 1.2 - Cross-Site scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-3848 | MooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-3849 | mooDating 1.2 - Cross-site scripting | moodating | 6.1 (v3.1) | Medium |
| CVE-2023-38501 | CopyParty v1.8.6 - Cross Site Scripting | copyparty | 6.1 (v3.1) | Medium |
| CVE-2023-38875 | PHP Login System 2.0.1 - Cross-Site Scripting | php-login-system | 6.1 (v3.1) | Medium |
| CVE-2023-38910 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' ) | csz cms | 6.1 (v3.1) | Medium |
| CVE-2023-39598 | IceWarp Email Client - Cross Site Scripting | webclient | 6.1 (v3.1) | Medium |
| CVE-2023-39600 | IceWarp 11.4.6.0 - Cross-Site Scripting | icewarp | 6.1 (v3.1) | Medium |
| CVE-2023-39676 | PrestaShop fieldpopupnewsletter Module - Cross Site Scripting | fieldpopupnewsletter | 6.1 (v3.1) | Medium |
| CVE-2023-39700 | IceWarp Mail Server v10.4.5 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium |
| CVE-2023-40208 | Stock Ticker <= 3.23.2 - Cross-Site Scripting | stock ticker | 6.1 (v3.1) | Medium |
| CVE-2023-40750 | PHPJabbers Yacht Listing Script v1.0 - Cross-Site Scripting | yacht listing script | 6.1 (v3.1) | Medium |
| CVE-2023-40751 | PHPJabbers Fundraising Script v1.0 - Cross-Site Scripting | fundraising script | 6.1 (v3.1) | Medium |
| CVE-2023-40752 | PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting | make an offer widget | 6.1 (v3.1) | Medium |
| CVE-2023-4110 | PHPJabbers Availability Booking Calendar 5.0 - Cross-Site Scripting | availability booking calendar | 6.1 (v3.1) | Medium |
| CVE-2023-4111 | PHPJabbers Bus Reservation System 1.1 - Cross-Site Scripting | bus reservation system | 6.1 (v3.1) | Medium |
| CVE-2023-4112 | PHPJabbers Shuttle Booking Software 1.0 - Cross Site Scripting | shuttle booking software | 6.1 (v3.1) | Medium |
| CVE-2023-4113 | PHPJabbers Service Booking Script 1.0 - Cross Site Scripting | service booking script | 6.1 (v3.1) | Medium |
| CVE-2023-4114 | PHP Jabbers Night Club Booking 1.0 - Cross Site Scripting | night club booking software | 6.1 (v3.1) | Medium |
| CVE-2023-4115 | PHPJabbers Cleaning Business 1.0 - Cross-Site Scripting | cleaning business software | 6.1 (v3.1) | Medium |
| CVE-2023-4116 | PHPJabbers Taxi Booking 2.0 - Cross Site Scripting | taxi booking script | 6.1 (v3.1) | Medium |
| CVE-2023-4136 | CrafterCMS Engine - Cross-Site Scripting | craftercms | 6.1 (v3.1) | Medium |
| CVE-2023-4148 | Ditty < 3.1.25 - Cross-Site Scripting | ditty | 6.1 (v3.1) | Medium |
| CVE-2023-41538 | PHPJabbers PHP Forum Script 3.0 - Cross-Site Scripting | php forum script | 6.1 (v3.1) | Medium |
| CVE-2023-41597 | EyouCms v1.6.2 - Cross-Site Scripting | eyoucms | 6.1 (v3.1) | Medium |
| CVE-2023-41621 | Emlog Pro v2.1.14 - Cross-Site Scripting | emlog | 6.1 (v3.1) | Medium |
| CVE-2023-4173 | mooSocial 3.1.8 - Reflected XSS | moostore | 6.1 (v3.1) | Medium |
| CVE-2023-4174 | mooSocial 3.1.6 - Reflected Cross Site Scripting | moostore | 6.1 (v3.1) | Medium |
| CVE-2023-42343 | OpenCMS - Cross-Site Scripting | opencms | 6.1 (v3.1) | Medium |
| CVE-2023-4284 | WordPress Post Timeline Plugin < 2.2.6 - Cross-Site Scripting | post timeline | 6.1 (v3.1) | Medium |
| CVE-2023-43325 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-43326 | MooSocial 3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-44012 | mojoPortal v.2.7.0.0 - Cross-Site Scripting | mojoportal | 6.1 (v3.1) | Medium |
| CVE-2023-44352 | Adobe Coldfusion - Cross-Site Scripting | coldfusion | 6.1 (v3.1) | Medium |
| CVE-2023-44393 | Piwigo - Cross-Site Scripting | piwigo | 6.1 (v3.1) | Medium |
| CVE-2023-4451 | Cockpit - Cross-Site Scripting | cockpit | 6.1 (v3.1) | Medium |
| CVE-2023-44812 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-44813 | mooSocial v.3.1.8 - Cross-Site Scripting | moosocial | 6.1 (v3.1) | Medium |
| CVE-2023-46020 | Blood Bank v1.0 - Stored Cross Site Scripting (XSS) | blood bank | 6.1 (v3.1) | Medium |
| CVE-2023-46732 | XWiki < 14.10.14 - Cross-Site Scripting | xwiki | 6.1 (v3.1) | Medium |
| CVE-2023-47684 | Essential Grid <= 3.1.0 - Cross-Site Scripting | essential grid | 6.1 (v3.1) | Medium |
| CVE-2023-48728 | WWBN AVideo 11.6 - Cross-Site Scripting | avideo | 6.1 (v3.1) | Medium |
| CVE-2023-49293 | Vite dev server - Cross-Site Scripting | vite | 6.1 (v3.1) | Medium |
| CVE-2023-49489 | KodeExplorer 4.51 - Reflective Cross Site Scripting (XSS) | kodexplorer | 6.1 (v3.1) | Medium |
| CVE-2023-49494 | DedeCMS v5.7.111 - Cross-Site Scripting | dedecms | 6.1 (v3.1) | Medium |
| CVE-2023-4973 | Academy LMS 6.2 - Cross-Site Scripting | academy lms | 6.1 (v3.1) | Medium |
| CVE-2023-51769 | Frappe Cross-Site Scripting Vulnerability | Frappe | 6.1 (v3.1) | Medium |
| CVE-2023-5244 | Microweber < V.2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2023-5558 | LearnPress < 4.2.5.5 - Cross-Site Scripting | learnpress | 6.1 (v3.1) | Medium |
| CVE-2023-5758 | firefox mobile Cross-Site Scripting Vulnerability | firefox mobile | 6.1 (v3.1) | Medium |
| CVE-2023-5863 | phpMyFAQ < 3.2.0 - Cross-site Scripting | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2023-6000 | WordPress Popup Builder <= 4.2.3 - Unauthenticated Stored XSS | popup builder | 6.1 (v3.1) | Medium |
| CVE-2023-6275 | TOTVS Fluig Platform - Cross-Site Scripting | fluig | 6.1 (v3.1) | Medium |
| CVE-2023-6379 | OpenCMS 14 & 15 - Cross Site Scripting | opencms | 6.1 (v3.1) | Medium |
| CVE-2023-6697 | WP Go Maps (formerly WP Google Maps) < 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium |
| CVE-2024-12585 | PropertyHive < 2.1.1 - Cross-Site Scripting | propertyhive | 6.1 (v3.1) | Medium |
| CVE-2024-12724 | WP DeskLite - Reflected XSS | wp desklite | 6.1 (v3.1) | Medium |
| CVE-2024-12732 | AffiliateImporterEb <= 1.0.6 - Reflected XSS | affiliateimportereb | 6.1 (v3.1) | Medium |
| CVE-2024-12737 | WP BASE Booking - Reflected XSS | wp base booking of appointments, services and events | 6.1 (v3.1) | Medium |
| CVE-2024-12873 | Custom Field Manager WordPress - Cross-Site Scripting | custom field manager | 6.1 (v3.1) | Medium |
| CVE-2024-13112 | WP MediaTagger <= 4.1.1 - Cross-Site Scripting | wp mediatagger | 6.1 (v3.1) | Medium |
| CVE-2024-13114 | WP Projects Portfolio <= 3.0 - Cross-Site Scripting | wp projects portfolio with client testimonials | 6.1 (v3.1) | Medium |
| CVE-2024-13219 | Privacy Policy Genius - Cross-Site Scripting | privacy policy genius | 6.1 (v3.1) | Medium |
| CVE-2024-13220 | WordPress Google Map Professional - Cross-Site Scripting | google map professional | 6.1 (v3.1) | Medium |
| CVE-2024-13221 | Fantastic ElasticSearch Plugin <= 4.1.0 - Cross-Site Scripting | fantastic elasticsearch | 6.1 (v3.1) | Medium |
| CVE-2024-13222 | WordPress User Messages <= 1.2.4 - Reflected XSS | user messages | 6.1 (v3.1) | Medium |
| CVE-2024-13224 | SlideDeck 1 Lite Content Slider - Cross-Site Scripting | slidedeck 1 lite content slider | 6.1 (v3.1) | Medium |
| CVE-2024-13225 | ECT Home Page Products - Reflected XSS | ect home page products | 6.1 (v3.1) | Medium |
| CVE-2024-13226 | A5 Custom Login Page - Reflected XSS | a5 custom login page | 6.1 (v3.1) | Medium |
| CVE-2024-13327 | Musicbox WordPress - Reflected XSS | musicbox | 6.1 (v3.1) | Medium |
| CVE-2024-13328 | Giga Messenger WordPress - Cross-Site Scripting | giga messenger | 6.1 (v3.1) | Medium |
| CVE-2024-13331 | WP Dream Carousel < 1.0.1b - Cross-Site Scripting | wp dream carousel | 6.1 (v3.1) | Medium |
| CVE-2024-13543 | Zarinpal Paid Download - Reflected XSS | zarinpal paid download | 6.1 (v3.1) | Medium |
| CVE-2024-13570 | WordPress Stray Random Quotes <= 1.9.9 - Cross-Site Scripting | stray random quotes | 6.1 (v3.1) | Medium |
| CVE-2024-13619 | LifterLMS < 8.0.1 - Cross-Site Scripting | lifterlms | 6.1 (v3.1) | Medium |
| CVE-2024-13628 | WP Pricing Table - Reflected XSS | wp pricing table | 6.1 (v3.1) | Medium |
| CVE-2024-13630 | NewsTicker <= 1.0 - Reflected Cross-Site Scripting | newsticker | 6.1 (v3.1) | Medium |
| CVE-2024-13634 | Post Sync Plugin <= 1.1 - Cross-Site Scripting | post sync | 6.1 (v3.1) | Medium |
| CVE-2024-13727 | MemberSpace WordPress - Cross-Site Scripting | memberspace | 6.1 (v3.1) | Medium |
| CVE-2024-13853 | WordPress SEO Tools Plugin 4.0.7 - Cross-Site Scripting | seo-automatic-seo-tools | 6.1 (v3.1) | Medium |
| CVE-2024-24131 | SuperWebMailer 9.31.0.01799 - Cross-Site Scripting | superwebmailer | 6.1 (v3.1) | Medium |
| CVE-2024-24494 | Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS) | daily habit tracker | 6.1 (v3.1) | Medium |
| CVE-2024-28623 | RiteCMS 3.0.0 - Cross-site Scripting | ritecms | 6.1 (v3.1) | Medium |
| CVE-2024-28734 | Coda v.2024Q1 - Cross-Site Scripting | Unit4 Financials by Coda prior to 2023Q4 | 6.1 (v3.1) | Medium |
| CVE-2024-29138 | WordPress Restrict User Access <= 2.5 - Cross-Site Scripting | restrict user access | 6.1 (v3.1) | Medium |
| CVE-2024-29792 | Unlimited Elements for Elementor <= 1.5.93 - Cross Site Scripting | unlimited elements for elementor | 6.1 (v3.1) | Medium |
| CVE-2024-29931 | WP Go Maps <= 9.0.29 - Cross-Site Scripting | wp go maps | 6.1 (v3.1) | Medium |
| CVE-2024-30194 | Sunshine Photo Cart <= 3.1.1 - Reflected Cross-Site Scripting | sunshine photo cart | 6.1 (v3.1) | Medium |
| CVE-2024-3231 | Popup4Phone <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting | popup4phone | 6.1 (v3.1) | Medium |
| CVE-2024-34326 | ProPhoenix Law RMS v2022.2403.3.101 Cross-Site Scripting Vulnerability | ProPhoenix Law RMS v2022.2403.3.101 | 6.1 (v3.1) | Medium |
| CVE-2024-3469 | GP Premium <= 2.4.0 - Cross-Site Scripting | gp-premium | 6.1 (v3.1) | Medium |
| CVE-2024-35627 | TileServer API - Cross Site Scripting | tileserver-gl up to v4.4.10 | 6.1 (v3.1) | Medium |
| CVE-2024-35693 | WordPress 12 Step Meeting List Plugin <= 3.14.33 - Cross-Site Scripting | 12 step meeting list | 6.1 (v3.1) | Medium |
| CVE-2024-37259 | WP Extended < 3.0.0 - Stored Cross-Site Scripting | wp extended | 6.1 (v3.1) | Medium |
| CVE-2024-37261 | WP-Lister Lite for Amazon <= 2.6.16 - Cross-Site Scripting | wp-lister lite for amazon | 6.1 (v3.1) | Medium |
| CVE-2024-39646 | WordPress Custom 404 Pro <= 3.11.1 - Reflected XSS | custom 404 pro | 6.1 (v3.1) | Medium |
| CVE-2024-41810 | Twisted - Open Redirect & XSS | twisted | 6.1 (v3.1) | Medium |
| CVE-2024-42852 | AcuToWeb server/10.5.0.7577c8b - Cross-Site Scripting | acutoweb | 6.1 (v3.1) | Medium |
| CVE-2024-44635 | student record system Cross-Site Scripting Vulnerability | student record system | 6.1 (v3.1) | Medium |
| CVE-2024-44647 | small crm Cross-Site Scripting Vulnerability | small crm | 6.1 (v3.1) | Medium |
| CVE-2024-46336 | school management system Cross-Site Scripting Vulnerability | school management system | 6.1 (v3.1) | Medium |
| CVE-2024-55218 | IceWarp Server 10.2.1 - Cross-Site Scripting | mail server | 6.1 (v3.1) | Medium |
| CVE-2024-6517 | Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting | ds-cf7-math-captcha | 6.1 (v3.1) | Medium |
| CVE-2024-6651 | WordPress File Upload Plugin < 4.24.8 - Cross-Site Scripting | wp-file-upload | 6.1 (v3.1) | Medium |
| CVE-2024-7313 | Shield Security Plugin < 20.0.6 - Cross-Site Scripting | shield security | 6.1 (v3.1) | Medium |
| CVE-2024-7354 | Ninja Forms 3.8.6-3.8.10 - Cross-Site Scripting | ninja forms | 6.1 (v3.1) | Medium |
| CVE-2025-12123 | Customer Reviews Collector for WooCommerce <= 4.6.1 - Reflected Cross-Site Scripting | Customer Reviews Collector for WooCommerce | 6.1 (v3.1) | Medium |
| CVE-2025-14312 | Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via counter | Advance WP Query Search Filter | 6.1 (v3.1) | Medium |
| CVE-2025-14313 | Advance WP Query Search Filter <= 1.0.10 - Reflected XSS via taxo_ajax | Advance WP Query Search Filter | 6.1 (v3.1) | Medium |
| CVE-2025-25296 | Label Studio < 1.16.0 - Cross-Site Scripting | label studio | 6.1 (v3.1) | Medium |
| CVE-2025-2609 | MagnusBilling Login Logs - Cross-Site Scripting | magnusbilling | 6.1 (v3.1) | Medium |
| CVE-2025-46349 | YesWiki Reflected XSS via File Upload | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-4652 | Broadstreet WordPress plugin - Reflected XSS | broadstreet | 6.1 (v3.1) | Medium |
| CVE-2025-46550 | YesWiki < 4.5.4 - Cross-Site Scripting | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2025-47204 | Bootstrap Multiselect <= 1.1.2 - Cross-Site Scripting | bootstrap multiselect | 6.1 (v3.1) | Medium |
| CVE-2025-48954 | Discourse OAuth Social Login - Cross-site Scripting | discourse | 6.1 (v3.1) | Medium |
| CVE-2025-51501 | Microweber CMS2.0 - Cross-Site Scripting | microweber | 6.1 (v3.1) | Medium |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) - Reflected Cross-Site Scripting | Docs (DocumentServer) | 6.1 (v3.1) | Medium |
| CVE-2025-54589 | Copyparty <=1.18.6 - Cross-Site Scripting | copyparty | 6.1 (v3.1) | Medium |
| CVE-2025-55757 | Extension - virtuemart.net - XSS in VirtueMart component 1.0.0 - 4.4.10 for Joomla | Virtuemart component for Joomla | 6.1 (v3.1) | Medium |
| CVE-2025-60934 | HR Performance Solutions Performance Pro v3.19.17 Cross-Site Scripting Vulnerability | HR Performance Solutions Performance Pro v3.19.17 | 6.1 (v3.1) | Medium |
| CVE-2025-61583 | TS3 Manager is vulnerable to unauthenticated reflected XSS attack due to insecure error handling | ts3 manager | 6.1 (v3.1) | Medium |
| CVE-2025-62358 | WeGIA Reflected XSS to Account TakeOver at /html/configuracao/configuracao_geral.php via log parameter | wegia | 6.1 (v3.1) | Medium |
| CVE-2025-63238 | limesurvey Cross-Site Scripting Vulnerability | limesurvey | 6.1 (v3.1) | Medium |
| CVE-2025-63448 | water management system Cross-Site Scripting Vulnerability | water management system | 6.1 (v3.1) | Medium |
| CVE-2025-63607 | TechStore 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2025-63737 | rockoa Cross-Site Scripting Vulnerability | rockoa | 6.1 (v3.1) | Medium |
| CVE-2025-63949 | hotel management system Cross-Site Scripting Vulnerability | hotel management system | 6.1 (v3.1) | Medium |
| CVE-2025-65013 | LibreNMS vulnerable to Reflected Cross-Site Scripting (XSS) in endpoint /maps/nodeimage parameter Image Name | librenms | 6.1 (v3.1) | Medium |
| CVE-2025-65019 | Astro Cloudflare adapter has a Stored Cross Site Scripting vulnerability in /_image endpoint | astro | 6.1 (v3.1) | Medium |
| CVE-2025-65233 | slims Cross-Site Scripting Vulnerability | slims | 6.1 (v3.1) | Medium |
| CVE-2025-66026 | REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types] | redaxo | 6.1 (v3.1) | Medium |
| CVE-2025-66924 | open source point of sale Cross-Site Scripting Vulnerability | open source point of sale | 6.1 (v3.1) | Medium |
| CVE-2025-67443 | cms Cross-Site Scripting Vulnerability | cms | 6.1 (v3.1) | Medium |
| CVE-2025-67648 | Shopware's inproper input validation can lead to Reflected XSS through Storefront Login Page | shopware | 6.1 (v3.1) | Medium |
| CVE-2025-68951 | phpMyFAQ has stored XSS in admin "List of users" via display_name HTML entity decoding (html_entity_decode) + Twig |raw | phpmyfaq | 6.1 (v3.1) | Medium |
| CVE-2025-70797 | limesurvey Arbitrary Code Execution Vulnerability | limesurvey | 6.1 (v3.1) | Medium |
| CVE-2025-9952 | Trinity Audio <= 5.20.2 - Reflected Cross-Site Scripting | Trinity Audio – Text to Speech AI audio player to convert content into audio | 6.1 (v3.1) | Medium |
| CVE-2026-0561 | Shield Security <= 21.0.8 - Unauthenticated Reflected XSS | shield-security | 6.1 (v3.1) | Medium |
| CVE-2026-0594 | WordPress List Site Contributors < 1.1.8 - Reflected XSS | List Site Contributors | 6.1 (v3.1) | Medium |
| CVE-2026-103888 | WPC Smart Quick View for WooCommerce <= 4.4.0 - Reflected Cross-Site Scripting via 'woosq-redirect' Parameter | WPC Smart Quick View for WooCommerce | 6.1 (v3.1) | Medium |
| CVE-2026-104140 | QGIS: Stored XSS in WFS3 getFeatures HTML page via unescaped feature attribute values | QGIS | 6.1 (v3.1) | Medium |
| CVE-2026-10525 | NEX-Forms Express WP Form Builder < 9.2.3 - Unauthenticated Stored XSS | nex-forms-express-wp-form-builder | 6.1 (v3.1) | Medium |
| CVE-2026-107393 | FreeScout: Stored HTML Injection in Administrator Alert Emails via Spoofed CF-Connecting-IP Header | freescout | 6.1 (v3.1) | Medium |
| CVE-2026-113659 | ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated us | apostrophe | 6.1 (v3.1) | Medium |
| CVE-2026-11588 | EONSR AEO Agent <= 3.7.9 - Unauthenticated Stored XSS via Scheduled Post Creation | EONSR AEO Agent | 6.1 (v3.1) | Medium |
| CVE-2026-11603 | Product Filter Widget for Elementor <= 1.0.6 - Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter | Product Filter Widget for Elementor | 6.1 (v3.1) | Medium |
| CVE-2026-118652 | Echo: Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob | echo | 6.1 (v3.1) | Medium |
| CVE-2026-11881 | Fluent Forms < 6.2.6 - Contributor+ Stored XSS via Date/Time Field | Fluent Forms | 6.1 (v3.1) | Medium |
| CVE-2026-12982 | Document Gallery < 5.1.1 - Reflected XSS via dg_generate_gallery | Document Gallery | 6.1 (v3.1) | Medium |
| CVE-2026-13330 | Animation Addons for Elementor < 2.7.0 - Author+ Stored XSS via SVG Upload | Animation Addons for Elementor | 6.1 (v3.1) | Medium |
| CVE-2026-13400 | Simply Schedule Appointments < 1.6.12.4 - Unauthenticated Stored XSS via Booking Customer Information | Simply Schedule Appointments | 6.1 (v3.1) | Medium |
| CVE-2026-14190 | Sina Extension for Elementor < 3.10.2 - Reflected XSS | Sina Extension for Elementor | 6.1 (v3.1) | Medium |
| CVE-2026-14207 | LifterLMS < 10.0.10 - Instructor+ Stored XSS via Featured Pricing Information | LifterLMS | 6.1 (v3.1) | Medium |
| CVE-2026-14841 | King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget | King Addons for Elementor | 6.1 (v3.1) | Medium |
| CVE-2026-14845 | NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget | NewStatPress | 6.1 (v3.1) | Medium |
| CVE-2026-14921 | Ultimate Addons for WPBakery Page Builder < 3.21.5 - Contributor+ Stored XSS via ult_buttons Shortcode | Ultimate Addons for WPBakery Page Builder | 6.1 (v3.1) | Medium |
| CVE-2026-16535 | WordPress Link Library < 7.9.4 - Cross-Site Scripting | link-library | 6.1 (v3.1) | Medium |
| CVE-2026-17505 | WordPress TranslatePress < 3.2.6 - Cross-Site Scripting | translatepress-multilingual | 6.1 (v3.1) | Medium |
| CVE-2026-17532 | Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting | Seraphinite Accelerator | 6.1 (v3.1) | Medium |
| CVE-2026-18843 | Beaver Builder Plugin (Pro Version) <= 2.11.0.1 - Reflected Cross-Site Scripting via 'no_results_message' node_preview P | Beaver Builder Plugin (Starter Version) | 6.1 (v3.1) | Medium |
| CVE-2026-25616 | Blesta <= 5.13.1 - Cross-Site Scripting | blesta | 6.1 (v3.1) | Medium |
| CVE-2026-26028 | CryptPad: Sanitizer Bypass in Diffmarked.js Allows Arbitrary HTML Injection and Potential XSS | cryptpad | 6.1 (v3.1) | Medium |
| CVE-2026-3001 | Gutenverse Plugin <= 3.4.6 - Cross-Site Scripting | gutenverse | 6.1 (v3.1) | Medium |
| CVE-2026-30251 | zenshare suite Cross-Site Scripting Vulnerability | zenshare suite | 6.1 (v3.1) | Medium |
| CVE-2026-30252 | zencrm Cross-Site Scripting Vulnerability | zencrm | 6.1 (v3.1) | Medium |
| CVE-2026-31013 | ad phonebook Cross-Site Scripting Vulnerability | ad phonebook | 6.1 (v3.1) | Medium |
| CVE-2026-33403 | Pi-hole has a Reflected XSS / HTML injection in taillog.js | web interface | 6.1 (v3.1) | Medium |
| CVE-2026-33436 | Stirling-PDF: Reflected XSS through crafted filename in file upload functionality | stirling pdf | 6.1 (v3.1) | Medium |
| CVE-2026-34206 | Captcha Protect: Reflected XSS in challenge page via unsanitized destination rendered with text/template | captcha protect | 6.1 (v3.1) | Medium |
| CVE-2026-34229 | Emlog: Stored XSS in Comment Module via URI Scheme Validation Bypass | emlog | 6.1 (v3.1) | Medium |
| CVE-2026-34396 | AVideo: Stored XSS via Unescaped Plugin Configuration Values in Admin Panel | avideo | 6.1 (v3.1) | Medium |
| CVE-2026-34739 | AVideo: Reflected XSS via Unescaped ip Parameter in User_Location testIP.php | avideo | 6.1 (v3.1) | Medium |
| CVE-2026-36324 | SourceCodester Doctor Appointment System 1.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-36468 | Cross-site Scripting (XSS) in index.php in CuteNews v.2.1.2 Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-37750 | School Management System by mahmoudai1 Cross-Site Scripting Vulnerability | School Management System by mahmoudai1 | 6.1 (v3.1) | Medium |
| CVE-2026-38432 | erpnext Cross-Site Scripting Vulnerability | erpnext | 6.1 (v3.1) | Medium |
| CVE-2026-38446 | Cross-Site Scripting | - | 6.1 (v3.1) | Medium |
| CVE-2026-38472 | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | forum reward comments in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 6.1 (v3.1) | Medium |
| CVE-2026-39038 | BharatMLStack up to and including v1.3.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-39335 | ChurchCRM has Stored XSS via Unescaped data-* Attributes in Group/Family Controls | churchcrm | 6.1 (v3.1) | Medium |
| CVE-2026-39336 | ChurchCRM has Stored XSS from unescaped config values in HTML attributes | churchcrm | 6.1 (v3.1) | Medium |
| CVE-2026-41067 | Astro: XSS via incomplete </script> sanitization in define:vars allows case-insensitive and whitespace-based bypass | astro | 6.1 (v3.1) | Medium |
| CVE-2026-41580 | Stirling-PDF: Reflected XSS through crafted PDF metadata fields (Title and Author) | stirling pdf | 6.1 (v3.1) | Medium |
| CVE-2026-4246 | ElementsKit Pro <= 4.10.1 - Unauthenticated Stored Cross-Site Scripting via 's' Parameter | ElementsKit Pro | 6.1 (v3.1) | Medium |
| CVE-2026-43878 | WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped user/pass Parameters Reflected into JavaScript St | AVideo | 6.1 (v3.1) | Medium |
| CVE-2026-44366 | Vvveb: Stored XSS via Comment Author Field | Vvveb | 6.1 (v3.1) | Medium |
| CVE-2026-44587 | CarrierWave has a denylisted_content_type bypass via Unescaped Regex Metacharacters | carrierwave | 6.1 (v3.1) | Medium |
| CVE-2026-49264 | OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation | oauthlib | 6.1 (v3.1) | Medium |
| CVE-2026-50182 | AVideo Has Unauthenticated Reflected XSS via $_GET['search'] in YouTubeAPI Gallery Pagination | AVideo | 6.1 (v3.1) | Medium |
| CVE-2026-50229 | Apache Tomcat - Cross-Site Scripting | tomcat | 6.1 (v3.1) | Medium |
| CVE-2026-51133 | za-internet GmbH C-MOR Video Surveillance <= V6.0104 Arbitrary Code Execution Vulnerability | za-internet GmbH C-MOR Video Surveillance <= V6.0104 | 6.1 (v3.1) | Medium |
| CVE-2026-51565 | Modules/Docs/DocsController.php in Milk admin <=0.9.8 Cross-Site Scripting Vulnerability | Modules/Docs/DocsController.php in Milk admin <=0.9.8 | 6.1 (v3.1) | Medium |
| CVE-2026-52232 | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 Cross-Site Scripting Vulnerability | FS Inc S3150-8T2F Switch 2.2.0D Build 118101 | 6.1 (v3.1) | Medium |
| CVE-2026-52475 | aiflowy <= 2.1.2 Cross-Site Scripting Vulnerability | aiflowy <= 2.1.2 | 6.1 (v3.1) | Medium |
| CVE-2026-52774 | YesWiki Bazar Widget - Reflected XSS via 'id' Parameter | yeswiki | 6.1 (v3.1) | Medium |
| CVE-2026-54714 | Logto: XSS via unescaped RelayState in SAML auto-submit form | logto | 6.1 (v3.1) | Medium |
| CVE-2026-55087 | Etherpad: x-proxy-path header reflected into admin HTML/JS/CSS (cache-poisoning XSS) and concatenated into redirect (ope | etherpad | 6.1 (v3.1) | Medium |
| CVE-2026-58191 | Appium base-driver <=10.6.0 - Reflected Cross-Site Scripting | appium | 6.1 (v3.1) | Medium |
| CVE-2026-61526 | AdonisJS HTTP Server is vulnerable to reflected XSS through its exception handler | http-server | 6.1 (v3.1) | Medium |
| CVE-2026-62280 | OpenAM Reflected XSS in the OAuth2/OIDC wap consent page | OpenAM | 6.1 (v3.1) | Medium |
| CVE-2026-73084 | Activepieces: Reflected Cross-Site Scripting in OAuth Redirect Endpoint | activepieces | 6.1 (v3.1) | Medium |
| CVE-2026-75170 | the HubCore platform (version 14.1.1) Cross-Site Scripting Vulnerability | the HubCore platform (version 14.1.1) | 6.1 (v3.1) | Medium |
| CVE-2026-75307 | zhitan-ems 1.0.0 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-78742 | Silverpeas Core <=6.4.6 Cross-Site Scripting Vulnerability | - | 6.1 (v3.1) | Medium |
| CVE-2026-78902 | Netgate pfSense 26.03.1-RELEASE Arbitrary Code Execution Vulnerability | Netgate pfSense 26.03.1-RELEASE | 6.1 (v3.1) | Medium |
| CVE-2026-82382 | Apache Roller: Reflected cross-site scripting in the frontpage directory parameter | Apache Roller | 6.1 (v3.1) | Medium |
| CVE-2026-8447 | Langflow is vulnerable to stored cross-site scripting and IP spoofing due to unsanitized Markdown rendering and untruste | langflow | 6.1 (v3.1) | Medium |
| CVE-2026-84925 | Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Reflected Cross-Site Scripting via 'lang' Parameter | Avada | Website Builder For WordPress & WooCommerce | 6.1 (v3.1) | Medium |
| CVE-2026-8626 | SponsorMe <= 0.5.2 - Reflected Cross-Site Scripting via PHP_SELF Parameter | SponsorMe | 6.1 (v3.1) | Medium |
| CVE-2026-89047 | Social Media Share Buttons & Social Sharing Icons <= 3.0.1 - Reflected DOM-Based Cross-Site Scripting via URL | Social Media Share Buttons & Social Sharing Icons | 6.1 (v3.1) | Medium |
| CVE-2026-92974 | Photo Gallery by 10Web <= 1.8.46 - Reflected Cross-Site Scripting via 'thumb_url' Parameter | Photo Gallery by 10Web – Mobile-Friendly Image Gallery | 6.1 (v3.1) | Medium |
| CVE-2026-96594 | Gitea repository media API stored XSS | gitea | 6.1 (v3.1) | Medium |
| CVE-2012-6081 | MoinMoin twikidraw Action Traversal File Upload | moinmoin | 6.0 (v2.0) | Medium |
| CVE-2013-2121 | Foreman (Red Hat OpenStack/Satellite) bookmarks/create Code Injection | openstack | 6.0 (v2.0) | Medium |
| CVE-2014-8791 | Tuleap PHP Unserialize Code Execution | tuleap | 6.0 (v2.0) | Medium |
| CVE-2023-6717 | Keycloak: xss via assertion consumer service url in saml post-binding flow | Red Hat AMQ Broker 7 | 6.0 (v3.1) | Medium |
| CVE-2026-8245 | Concrete CMS 9.5.0 and below is vulnerable to Reflected XSS in Legacy Pagination via HTML attribute injection | concrete cms | 6.0 (v4.0) | Medium |
| CVE-2024-3753 | Hostel < 1.1.5.3 - Cross-Site Scripting | hostel | 5.9 (v3.1) | Medium |
| CVE-2025-28906 | Skitter Slideshow <= 2.5.2 - Authenticated (Administrator+) Stored Cross-Site Scripting | Skitter Slideshow | 5.9 (v3.1) | Medium |
| CVE-2026-21631 | Joomla! Core - [20260303] - XSS vector in com_associations comparison view | joomla! | 5.9 (v4.0) | Medium |
| CVE-2026-55793 | Craft CMS: Stored XSS via Structure entry title in table view | cms | 5.9 (v4.0) | Medium |
| CVE-2026-5696 | Multiple vulnerabilities in the Microweber administration panel | Administration panel | 5.9 (v4.0) | Medium |
| CVE-2025-62657 | Stored XSS through system messages in PageForms | MediaWiki PageForms extension | 5.8 (v4.0) | Medium |
| CVE-2025-8280 | Contact Form 7 reCAPTCHA <= 1.2.0 - Reflected XSS via $_SERVER['REQUEST_URI'] | contact form 7 recaptcha | 5.8 (v3.1) | Medium |
| CVE-2026-84193 | LibreNMS through 26.2.0 Stored Cross-Site Scripting via SNMP | librenms | 5.8 (v4.0) | Medium |
| CVE-2026-44696 | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration | openproject | 5.7 (v3.1) | Medium |
| CVE-2026-55600 | Part-DB: Stored HTML injection in BOM validation results via unescaped Part name | Part-DB-server | 5.7 (v4.0) | Medium |
| CVE-2026-57568 | Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View) | Lychee | 5.7 (v4.0) | Medium |
| CVE-2026-115425 | Multiple cross-site scripting (XSS) in OPNsense | OPNsense firewall | 5.6 (v4.0) | Medium |
| CVE-2025-62365 | LibreNMS vulnerable to Reflected-XSS in report_this function | librenms | 5.5 (v4.0) | Medium |
| CVE-2025-62421 | DataEase vulnerable to stored cross-site scripting via file upload bypass | dataease | 5.5 (v4.0) | Medium |
| CVE-2025-64747 | Directus Vulnerable to Stored Cross-site Scripting | directus | 5.5 (v3.1) | Medium |
| CVE-2026-5827 | code-projects Simple IT Discussion Forum question-function.php sql injection | Simple IT Discussion Forum | 5.5 (v4.0) | Medium |
| CVE-2016-10993 | ScoreMe Theme - Cross-Site Scripting | scoreme | 5.4 (v3.1) | Medium |
| CVE-2016-9316 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium |
| CVE-2017-14186 | FortiGate FortiOS SSL VPN Web Portal - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium |
| CVE-2017-3131 | Fortinet FortiOS < 5.6.0 - Cross-Site Scripting | fortios | 5.4 (v3.0) | Medium |
| CVE-2017-6340 | Trend Micro InterScan Web Security Virtual Appliance (IWSVA) 6.5 SP2 - Multiple Vulnerabilities | interscan web security virtual appliance | 5.4 (v3.0) | Medium |
| CVE-2018-12095 | OEcms 3.1 - Cross-Site Scripting | oecms | 5.4 (v3.0) | Medium |
| CVE-2018-15917 | Jorani Leave Management System 0.6.5 - Cross-Site Scripting | jorani | 5.4 (v3.0) | Medium |
| CVE-2018-16363 | WordPress File Manager < 3.0 - Cross-Site Scripting | file manager | 5.4 (v3.0) | Medium |
| CVE-2018-16736 | Roundcube rcfilters plugin 2.1.6 - Cross-Site Scripting | rcfilters | 5.4 (v3.0) | Medium |
| CVE-2018-6226 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2018-6227 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 5.4 (v3.0) | Medium |
| CVE-2018-8024 | Apache Spark UI - Cross-Site Scripting | spark | 5.4 (v3.0) | Medium |
| CVE-2019-9556 | Fiberhome AN5506-04-F RP2669 - Persistent Cross-Site Scripting | an5506-04-f firmware | 5.4 (v3.1) | Medium |
| CVE-2020-10385 | WordPress Plugin WPForms 1.5.8.2 - Persistent Cross-Site Scripting | contact form | 5.4 (v3.1) | Medium |
| CVE-2020-11110 | Grafana <= 6.7.1 - Cross-Site Scripting | grafana | 5.4 (v3.1) | Medium |
| CVE-2020-11456 | LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting | limesurvey | 5.4 (v3.1) | Medium |
| CVE-2020-12256 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium |
| CVE-2020-12259 | rConfig 3.9.4 - Cross-Site Scripting | rconfig | 5.4 (v3.1) | Medium |
| CVE-2020-12706 | php-fusion 9.03.50 - Persistent Cross-Site Scripting | php-fusion | 5.4 (v3.1) | Medium |
| CVE-2020-20988 | DomainMOD 4.13.0 - Cross-Site Scripting | domainmod | 5.4 (v3.1) | Medium |
| CVE-2020-23518 | Neo Billing 3.5 - Persistent Cross-Site Scripting | neo billing | 5.4 (v3.1) | Medium |
| CVE-2020-27533 | DedeCMS v.5.8 - keyword Cross-Site Scripting | dedecms | 5.4 (v3.1) | Medium |
| CVE-2020-35774 | twitter-server Cross-Site Scripting | twitter-server | 5.4 (v3.1) | Medium |
| CVE-2020-7108 | WordPress Plugin LearnDash LMS 3.1.2 - Reflective Cross-Site Scripting | learndash | 5.4 (v3.1) | Medium |
| CVE-2020-9467 | Piwigo 2.10.1 - Cross Site Scripting | piwigo | 5.4 (v3.1) | Medium |
| CVE-2021-25065 | Smash Balloon Social Post Feed < 4.1.1 - Authenticated Reflected Cross-Site Scripting | smash balloon social post feed | 5.4 (v3.1) | Medium |
| CVE-2021-31250 | CHIYU TCP/IP Converter - Cross-Site Scripting | bf-430 firmware | 5.4 (v3.1) | Medium |
| CVE-2021-40577 | Online Enrollment Management System in PHP and PayPal 1.0 - 'U_NAME' Stored Cross-Site Scripting | online enrollment management system | 5.4 (v3.1) | Medium |
| CVE-2021-46005 | Sourcecodester Car Rental Management System 1.0 - Stored Cross-Site Scripting | car rental management system | 5.4 (v3.1) | Medium |
| CVE-2022-0020 | Palo Alto Cortex XSOAR 6.5.0 - Stored Cross-Site Scripting (XSS) | cortex xsoar | 5.4 (v3.1) | Medium |
| CVE-2022-0148 | WordPress All-in-one Floating Contact Form <2.0.4 - Cross-Site Scripting | mystickyelements | 5.4 (v3.1) | Medium |
| CVE-2022-0378 | Microweber Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium |
| CVE-2022-0928 | Microweber < 1.2.12 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium |
| CVE-2022-0954 | Microweber <1.2.11 - Stored Cross-Site Scripting | microweber | 5.4 (v3.1) | Medium |
| CVE-2022-25489 | Atom CMS v2.0 - Cross-Site Scripting | atomcms | 5.4 (v3.1) | Medium |
| CVE-2022-35497 | TM4WEB Cross-Site Scripting Vulnerability | TM4WEB | 5.4 (v3.1) | Medium |
| CVE-2022-3933 | WordPress Essential Real Estate <3.9.6 - Authenticated Cross-Site Scripting | essential real estate | 5.4 (v3.1) | Medium |
| CVE-2022-3934 | WordPress FlatPM <3.0.13 - Cross-Site Scripting | flat pm | 5.4 (v3.1) | Medium |
| CVE-2022-4306 | WordPress Panda Pods Repeater Field <1.5.4 - Cross-Site Scripting | panda pods repeater field | 5.4 (v3.1) | Medium |
| CVE-2022-48178 | X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated) | x2crm | 5.4 (v3.1) | Medium |
| CVE-2023-1315 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium |
| CVE-2023-1318 | osTicket < v1.16.6 - Cross-Site Scripting | osticket | 5.4 (v3.1) | Medium |
| CVE-2023-26842 | ChurchCRM 4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium |
| CVE-2023-31548 | ChurchCRM v4.5.3 - Cross-Site Scripting | churchcrm | 5.4 (v3.1) | Medium |
| CVE-2023-34537 | Hoteldruid 3.0.5 - Cross-Site Scripting | hoteldruid | 5.4 (v3.1) | Medium |
| CVE-2023-38911 | CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery') | csz cms | 5.4 (v3.1) | Medium |
| CVE-2023-40355 | Axigen WebMail - Cross-Site Scripting | axigen mobile webmail | 5.4 (v3.1) | Medium |
| CVE-2023-5452 | SnipeIT 6.2.1 - Stored Cross Site Scripting | snipe-it | 5.4 (v3.1) | Medium |
| CVE-2024-10146 | Simple File List < 6.1.13 - Reflected Cross-Site Scripting | simple file list | 5.4 (v3.1) | Medium |
| CVE-2024-13097 | WP Finance Plugin <= 1.3.6 - Cross-Site Scripting | wp finance | 5.4 (v3.1) | Medium |
| CVE-2024-13098 | WordPress Email Newsletter - Reflected XSS | wordpress email newsletter | 5.4 (v3.1) | Medium |
| CVE-2024-13099 | Widget4Call WordPress - Cross-Site Scripting | widget4call | 5.4 (v3.1) | Medium |
| CVE-2024-21485 | Dash Framework - Cross-site Scripting | dash | 5.4 (v3.1) | Medium |
| CVE-2024-23176 | MassMessage Cross-Site Scripting Vulnerability | MassMessage | 5.4 (v3.1) | Medium |
| CVE-2024-31027 | Greek Universities Network (GUnet) Open eClass Platform v.3.15 Arbitrary Code Execution Vulnerability | Greek Universities Network (GUnet) Open eClass Platform v.3.15 | 5.4 (v3.1) | Medium |
| CVE-2024-33724 | SOPlanning 1.52.00 Cross Site Scripting | soplanning | 5.4 (v3.1) | Medium |
| CVE-2024-48120 | X2CRM 8.5 - Stored Cross-Site Scripting (XSS) | x2crm | 5.4 (v3.1) | Medium |
| CVE-2024-52762 | Ganglia Web Interface (v3.7.3 - v3.7.6) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium |
| CVE-2024-52763 | Ganglia Web Interface (v3.7.3 - v3.7.5) - Cross-Site Scripting | ganglia-web | 5.4 (v3.1) | Medium |
| CVE-2025-2610 | MagnusBilling Alarm Module - Cross-Site Scripting | magnusbilling | 5.4 (v3.1) | Medium |
| CVE-2025-50363 | maid hiring management system Cross-Site Scripting Vulnerability | maid hiring management system | 5.4 (v3.1) | Medium |
| CVE-2025-52367 | PivotX Remote Code Execution | pivotx | 5.4 (v3.1) | Medium |
| CVE-2025-57244 | openkm Cross-Site Scripting Vulnerability | openkm | 5.4 (v3.1) | Medium |
| CVE-2025-59788 | nextcloud server Cross-Site Scripting Vulnerability | nextcloud server | 5.4 (v3.1) | Medium |
| CVE-2025-61597 | Emlog Pro is vulnerable to stored XSS attack through HTML template injection | emlog | 5.4 (v3.1) | Medium |
| CVE-2025-62178 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint '/html/atendido/cadastro_atendido_parentesco_pessoa_nova.php' parame | wegia | 5.4 (v3.1) | Medium |
| CVE-2025-62430 | ClipBucket v5 stored XSS via video/photo fields | clipbucket | 5.4 (v3.1) | Medium |
| CVE-2025-62780 | ChangeDetection.io <= v0.50.33 - Stored XSS via Watch API | changedetection | 5.4 (v3.1) | Medium |
| CVE-2025-63528 | blood bank management system Cross-Site Scripting Vulnerability | blood bank management system | 5.4 (v3.1) | Medium |
| CVE-2025-63948 | phpmsadmin SQL Injection Vulnerability | phpmsadmin | 5.4 (v3.1) | Medium |
| CVE-2025-67496 | WeGia is Vulnerable to XSS through id_pessoa Parameter on Password Configuration Page | wegia | 5.4 (v3.1) | Medium |
| CVE-2026-103421 | WPMobile.App <= 11.84 - Unauthenticated Stored Cross-Site Scripting via '/android_json/search/<value>/0' Path Segment | WPMobile.App – Android and iOS App Builder | 5.4 (v3.1) | Medium |
| CVE-2026-103482 | Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage | Noptin – Newsletter, New Post Notifications & Email Automation | 5.4 (v3.1) | Medium |
| CVE-2026-105694 | Penpot: Stored XSS via Unsanitised SVG Uploads | penpot | 5.4 (v3.1) | Medium |
| CVE-2026-106033 | Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter | Red Hat Ansible Automation Platform 2 | 5.4 (v3.1) | Medium |
| CVE-2026-106706 | XXL-JOB through 3.5.0-SNAPSHOT Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2026-106707 | XXL-JOB <=3.5.0-SNAPSHOT Cross-Site Scripting Vulnerability | XXL-JOB <=3.5.0-SNAPSHOT | 5.4 (v3.1) | Medium |
| CVE-2026-11569 | Quay: quay: stored xss via filedrop svg upload | Red Hat Quay 3 | 5.4 (v3.1) | Medium |
| CVE-2026-14864 | JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode | JetEngine | 5.4 (v3.1) | Medium |
| CVE-2026-15234 | Codeless Page Builder <= 1.1.4 - Contributor+ Stored XSS via Shortcode Attribute | Codeless Page Builder | 5.4 (v3.1) | Medium |
| CVE-2026-15245 | BNE Testimonials < 2.0.8.2 - Contributor+ Stored XSS via Slider Shortcode | BNE Testimonials | 5.4 (v3.1) | Medium |
| CVE-2026-16063 | Event Booking Manager for WooCommerce < 5.3.7 - Author+ Stored XSS via Event Timeline Content | Event Booking Manager for WooCommerce | 5.4 (v3.1) | Medium |
| CVE-2026-16537 | Slick Slider < 0.5.3 - Contributor+ Stored XSS via Gallery Shortcode | Slick Slider | 5.4 (v3.1) | Medium |
| CVE-2026-16558 | YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema | YMC Filter | 5.4 (v3.1) | Medium |
| CVE-2026-17010 | Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta | Saitama Addon Pack | 5.4 (v3.1) | Medium |
| CVE-2026-18395 | Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes | Child Pages Card | 5.4 (v3.1) | Medium |
| CVE-2026-32629 | phpMyFAQ: Stored XSS via Unsanitized Email Field in Admin FAQ Editor | phpmyfaq | 5.4 (v4.0) | Medium |
| CVE-2026-32893 | Chamilo LMS has Reflected XSS via Unsanitized http_build_query() in Exercise Question List Pagination | chamilo lms | 5.4 (v3.1) | Medium |
| CVE-2026-34848 | hoppscotch: Stored XSS in team member overflow tooltip via display name | hoppscotch | 5.4 (v3.1) | Medium |
| CVE-2026-34974 | phpMyFAQ: SVG Sanitizer Bypass via HTML Entity Encoding leads to Stored XSS and Privilege Escalation | phpmyfaq | 5.4 (v3.1) | Medium |
| CVE-2026-35046 | Tandoor has a Stored CSS Injection via <style> Tag in Recipe Instructions (API-Level) | recipes | 5.4 (v3.1) | Medium |
| CVE-2026-35403 | LORIS has potential cross-site scripting in survey_accounts module | loris | 5.4 (v3.1) | Medium |
| CVE-2026-35455 | immich has Stored XSS via OCR Text in 360° Panorama Viewer | immich | 5.4 (v3.1) | Medium |
| CVE-2026-36163 | LiquidFiles v4.2.7 Cross-site Scripting Vulnerability | LiquidFiles v4.2.7 | 5.4 (v3.1) | Medium |
| CVE-2026-36392 | FairSketch Rise CRM Version 3.9.6 Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2026-38473 | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 Cross-Site Scripting Vulnerability | the subtitle deletion flow in GazellePW (GazellePosterWall) commit 86c4bedf727691b5a97af42a4864869d18446449 | 5.4 (v3.1) | Medium |
| CVE-2026-38725 | xipblog module 2.0.1 and Earlier for PrestaShop Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2026-39040 | BharatMLStack up to and including 1.3.0 Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2026-39380 | Open Source Point of Sale has Stored XSS in Stock Location (Configuration) | open source point of sale | 5.4 (v3.1) | Medium |
| CVE-2026-39964 | TypeBot: Stored XSS via javascript: URI in text bubble links — bot author executes JS on visitors' browsers | typebot.io | 5.4 (v3.1) | Medium |
| CVE-2026-40483 | ChurchCRM: Stored XSS in PledgeEditor.php via Donation Comment Field | CRM | 5.4 (v3.1) | Medium |
| CVE-2026-41061 | WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiver | avideo | 5.4 (v3.1) | Medium |
| CVE-2026-41318 | AnythingLLM vulnerable to stored DOM XSS in chart caption renderer - LLM-driven prompt injection produces executable HTM | anythingllm | 5.4 (v3.1) | Medium |
| CVE-2026-42877 | FacturaScripts: Stored XSS via product reference in sales/purchases | facturascripts | 5.4 (v3.1) | Medium |
| CVE-2026-45138 | CI4MS: Stored XSS in Blog Content via Broken html_purify Validation Rule | ci4ms | 5.4 (v3.1) | Medium |
| CVE-2026-45580 | WWBN AVideo Live: stored XSS via unescaped stream key in modeYoutubeLive.php class attribute | avideo | 5.4 (v3.1) | Medium |
| CVE-2026-45694 | LibreNMS: Reflected XSS in the Proxmox app view via unsanitized instance/vmid parameters | librenms | 5.4 (v3.1) | Medium |
| CVE-2026-58392 | OPNsense: Stored XSS in Services: NTP GPS | core | 5.4 (v3.1) | Medium |
| CVE-2026-59188 | Part-DB: SVG Sanitization Bypass via Extension Spoofing Leads to Stored XSS in Attachment Viewer | Part-DB-server | 5.4 (v3.1) | Medium |
| CVE-2026-63498 | Snipe-IT: Stored XSS via Inline XML Rendering in the Uploaded Files API | snipe-it | 5.4 (v3.1) | Medium |
| CVE-2026-70492 | Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages | open webui | 5.4 (v3.1) | Medium |
| CVE-2026-72570 | cube-root directory-serve - Stored Cross-Site Scripting via Malicious Filename | directory-serve | 5.4 (v3.1) | Medium |
| CVE-2026-72583 | fastschema - Stored Cross-Site Scripting via MIME Type Bypass in File Upload | fastschema | 5.4 (v3.1) | Medium |
| CVE-2026-78849 | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 Arbitrary Code Execution Vulnerability | Netgate pfSense Plus software versions <= 26.03 pfSense CE software versions <= 2.8.1 | 5.4 (v3.1) | Medium |
| CVE-2026-82396 | Sulu: Stored XSS via media download inline-disposition override | sulu | 5.4 (v3.1) | Medium |
| CVE-2026-91021 | Trillium Notes Cross-Site Scripting Vulnerability | Trillium Notes | 5.4 (v3.1) | Medium |
| CVE-2026-9278 | Form Builder CP < 1.2.47 - Editor+ Stored XSS via form_structure | Form Builder CP | 5.4 (v3.1) | Medium |
| CVE-2026-95166 | In Bacularis v1.0.0 - 6.5.1 when adding a new pool, the LabelFormat field Cross-Site Scripting Vulnerability | - | 5.4 (v3.1) | Medium |
| CVE-2019-17503 | Kirona-DRS 5.5.3.5 - Information Disclosure | dynamic resource scheduling | 5.3 (v3.1) | Medium |
| CVE-2019-25731 | Zuz Music 2.1 Persistent Cross-site Scripting via zuzconsole Contact | Zuz Music | 5.3 (v4.0) | Medium |
| CVE-2023-30943 | Moodle - Cross-Site Scripting/Remote Code Execution | moodle | 5.3 (v3.1) | Medium |
| CVE-2024-11587 | idcCMS V1.60 - Cross-Site Scripting | idccms | 5.3 (v4.0) | Medium |
| CVE-2024-28397 | Pyload RCE (CVE-2024-39205) with js2py sandbox escape (CVE-2024-28397) | pyload | 5.3 (v3.1) | Medium |
| CVE-2024-58292 | XMB Forum 1.9.12.06 Persistent Cross-Site Scripting via Admin Templates | XMB Forum | 5.3 (v4.0) | Medium |
| CVE-2024-58296 | CE Phoenix v3.0.1 Stored Cross-Site Scripting via admin/currencies.php | CE Phoenix | 5.3 (v4.0) | Medium |
| CVE-2024-58391 | Frappe before 15.4.0 XSS via Printview Parameters | frappe | 5.3 (v4.0) | Medium |
| CVE-2024-9007 | 123Solar 1.8.4.5 - Cross-Site Scripting | 123solar | 5.3 (v4.0) | Medium |
| CVE-2025-10341 | HTML injection in Perfex CRM | perfex crm | 5.3 (v4.0) | Medium |
| CVE-2025-10342 | HTML injection in Perfex CRM | perfex crm | 5.3 (v4.0) | Medium |
| CVE-2025-10343 | HTML injection in Perfex CRM | perfex crm | 5.3 (v4.0) | Medium |
| CVE-2025-10344 | HTML injection in Perfex CRM | perfex crm | 5.3 (v4.0) | Medium |
| CVE-2025-10346 | HTML injection in Perfex CRM | perfex crm | 5.3 (v4.0) | Medium |
| CVE-2025-2127 | JoomlaUX JUX Real Estate 3.4.0 - Reflected XSS | jux real estate | 5.3 (v4.0) | Medium |
| CVE-2025-2709 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2710 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2711 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-2712 | Yonyou UFIDA ERP-NC V5.0 - Cross-Site Scripting | ufida erp-nc | 5.3 (v4.0) | Medium |
| CVE-2025-34398 | MailEnable < 10.54 Reflected XSS in AddressesBcc Parameter of AddressBook.aspx | mailenable | 5.3 (v4.0) | Medium |
| CVE-2025-34400 | MailEnable < 10.54 Reflected XSS in AddressesTo Parameter of AddressBook.aspx | mailenable | 5.3 (v4.0) | Medium |
| CVE-2025-34408 | MailEnable < 10.54 Reflected XSS in Added Parameter of MAI/AddRecipientsResult.aspx | mailenable | 5.3 (v4.0) | Medium |
| CVE-2025-34425 | MailEnable < 10.54 Reflected XSS in WindowContext Parameter of MAI/compose.aspx | mailenable | 5.3 (v4.0) | Medium |
| CVE-2025-62359 | WeGIA Cross-Site Scripting (XSS) Reflected endpoint id_pet | wegia | 5.3 (v4.0) | Medium |
| CVE-2025-62800 | FastMCP vulnerable to reflected XSS in client's callback page | fastmcp | 5.3 (v4.0) | Medium |
| CVE-2025-66452 | LibreChat's lack of JSON parsing error handling can lead to XSS | librechat | 5.3 (v4.0) | Medium |
| CVE-2025-66460 | Lookyloo vulnerable to XSS due to lack of escaping in HTML elements passed to Datatables | lookyloo | 5.3 (v4.0) | Medium |
| CVE-2025-9728 | givanz Vvveb login.tpl cross site scripting | vvveb | 5.3 (v4.0) | Medium |
| CVE-2026-100381 | UploadWizard Flickr collection and set titles allow DOM XSS | Mediawiki - UploadWizard Extension | 5.3 (v4.0) | Medium |
| CVE-2026-102333 | httpdbg before 2.2.1 Stored Cross-Site Scripting via javascript URL | httpdbg | 5.3 (v4.0) | Medium |
| CVE-2026-104083 | SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content | Smartermail | 5.3 (v4.0) | Medium |
| CVE-2026-105114 | OpenAM before 16.1.3 Reflected XSS via OAuth2 Authorization Error Page | OpenAM | 5.3 (v4.0) | Medium |
| CVE-2026-105124 | W (wcms) through 3.18.0 Unauthenticated Stored XSS via Login Username and Comments | wcms | 5.3 (v4.0) | Medium |
| CVE-2026-107797 | Jivejdon through 5.0 Reflected XSS via postThread.jsp to and tag Parameters | jivejdon | 5.3 (v4.0) | Medium |
| CVE-2026-109328 | Admidio 5.0.0 before 5.0.15 Unauthenticated Stored XSS via Registration Name | admidio | 5.3 (v4.0) | Medium |
| CVE-2026-109352 | LibreNMS before 26.9.0 Stored XSS via wireless sensor description | librenms | 5.3 (v4.0) | Medium |
| CVE-2026-116203 | YesWiki before 4.7.0 Stored XSS via filtertags Action Parameters | yeswiki | 5.3 (v4.0) | Medium |
| CVE-2026-116217 | RosarioSIS before 12.9.2 Reflected XSS via menu_id in MenuReports.php | rosariosis | 5.3 (v4.0) | Medium |
| CVE-2026-116823 | YesWiki before 4.7.0 Reflected XSS via BazarField $_REQUEST Fallback | yeswiki | 5.3 (v4.0) | Medium |
| CVE-2026-116874 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via JsonResultPrinter Default Parameter | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-116875 | SemanticMediaWiki 3.0.0 before 7.3.1 Reflected XSS via Special:Ask Separator Parameters | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-116885 | Semantic MediaWiki before 7.3.1 Reflected XSS via Special:SMWAdmin id Parameter | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-116886 | Semantic MediaWiki before 7.3.1 Stored XSS via External Identifier in Special:Browse | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-116887 | Semantic MediaWiki 3.0.0 before 7.3.1 Stored XSS via Special:Browse Keyword Property | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-116889 | SemanticMediaWiki 2.5.0 before 7.3.1 Stored XSS via Special:Browse Code Property | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-116892 | SemanticMediaWiki 3.1.0 before 7.3.1 Reflected XSS via Special:Search smw Profile | SemanticMediaWiki | 5.3 (v4.0) | Medium |
| CVE-2026-35208 | lichess.org has an Unsanitized Stream Title Injection on /streamer | lila | 5.3 (v4.0) | Medium |
| CVE-2026-39941 | ChurchCRM has an XSS vulnerability | churchcrm | 5.3 (v4.0) | Medium |
| CVE-2026-41472 | CyberPanel < 2.4.5 Stored XSS via AI Scanner Dashboard | cyberpanel | 5.3 (v4.0) | Medium |
| CVE-2026-41932 | Vvveb < 1.0.8.3 Stored XSS via Signup Controller | Vvveb | 5.3 (v4.0) | Medium |
| CVE-2026-42458 | Magento LTS: Reflected XSS - Import -> Data Flow (profiles) | magento-lts | 5.3 (v4.0) | Medium |
| CVE-2026-42554 | Fiber: XSS in AutoFormat Content Negotiation | fiber | 5.3 (v4.0) | Medium |
| CVE-2026-45622 | Vvveb: Unauthenticated reflected XSS in public product return form via customer_order_id | Vvveb | 5.3 (v4.0) | Medium |
| CVE-2026-47096 | AJA HELO Plus < 2.1.7 Stored XSS via System Name Parameter | HELO Plus | 5.3 (v4.0) | Medium |
| CVE-2026-47119 | Agent Zero < 1.15 Stored XSS via image_get API Endpoint | agent-zero | 5.3 (v4.0) | Medium |
| CVE-2026-48094 | ShareOpenly has Cross-Site Scripting (XSS) via Missing esc_url() on Shared URL in Content Output | shareopenly | 5.3 (v4.0) | Medium |
| CVE-2026-56347 | AVideo TopMenu Plugin - Stored Cross-Site Scripting via Unescaped Menu Item Fields | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-58032 | mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html | mediawiki | 5.3 (v4.0) | Medium |
| CVE-2026-5808 | openstatusHQ openstatus Onboarding Endpoint client.tsx cross site scripting | openstatus | 5.3 (v4.0) | Medium |
| CVE-2026-59232 | Stored Cross-site Scripting in Prospero Flow CRM lead name field | Prospero Flow CRM | 5.3 (v4.0) | Medium |
| CVE-2026-69116 | FlyEnv < 4.18.0 Cross-Site Scripting via v-html | FlyEnv | 5.3 (v4.0) | Medium |
| CVE-2026-73038 | NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.url and tag.name | NodeBB | 5.3 (v4.0) | Medium |
| CVE-2026-73422 | Astro: Reflected XSS via unescaped View Transition animation properties | astro | 5.3 (v4.0) | Medium |
| CVE-2026-73628 | Serendipity 2.3.5 Reflected XSS via search clean-URL route | Serendipity | 5.3 (v4.0) | Medium |
| CVE-2026-76837 | Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name | Baserow | 5.3 (v4.0) | Medium |
| CVE-2026-82646 | WWBN AVideo Unauthenticated Reflected XSS via url2Embed.json.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-84191 | LibreNMS before 26.5.0 Stored XSS via SNMP VRF fields | librenms | 5.3 (v4.0) | Medium |
| CVE-2026-85158 | AVideo Reflected XSS via videoEmbeded.php link parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85159 | AVideo Reflected XSS via cancelUri in userLogin.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-85577 | AVideo userLogin.php Reflected XSS via error parameter | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89240 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89241 | WWBN AVideo Reflected XSS via confirmLivePassword.php | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-89244 | WWBN AVideo Reflected XSS via Gallery Category getBackURL | AVideo | 5.3 (v4.0) | Medium |
| CVE-2026-90571 | Exrick xmall Order Printing order-print.jsp cross site scripting | xmall | 5.3 (v4.0) | Medium |
| CVE-2026-90848 | Governikus AusweisApp StartPAOSResponse cross site scripting | AusweisApp | 5.3 (v4.0) | Medium |
| CVE-2026-91922 | Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render | steedos-platform | 5.3 (v4.0) | Medium |
| CVE-2026-92584 | AVideo through 29.0 Stored Cross-Site Scripting via User-Agent Header | AVideo | 5.3 (v4.0) | Medium |
| CVE-2011-10037 | Nagios XI < 2011R1.9 XSS via xiwindow Variables Affecting Permalinks | nagios xi | 5.1 (v4.0) | Medium |
| CVE-2012-20003 | Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php | Custom Tables | 5.1 (v4.0) | Medium |
| CVE-2014-125131 | DedeCMS 5.6 / 5.7 Reflected XSS via adminDirHand in config.php | DedeCMS | 5.1 (v4.0) | Medium |
| CVE-2014-125132 | Blogroll Fun WordPress Plugin < 0.8.5 Reflected XSS via blogroll.php | Blogroll Fun | 5.1 (v4.0) | Medium |
| CVE-2017-20288 | QCubed 3.1.1 Reflected XSS via installer step_2.php | QCubed | 5.1 (v4.0) | Medium |
| CVE-2017-20290 | Discourse < 1.9.0.beta13 Reflected XSS via /email/unsubscribed | Discourse | 5.1 (v4.0) | Medium |
| CVE-2018-25248 | MyBB Downloads Plugin 2.0.3 Persistent XSS via downloads.php | mybb downloads | 5.1 (v4.0) | Medium |
| CVE-2018-25349 | userSpice 4.3.24 Cross-Site Scripting via X-Forwarded-For Header | userSpice | 5.1 (v4.0) | Medium |
| CVE-2020-37235 | WordPress Theme Wibar 1.1.8 Stored Cross-Site Scripting via Brand Component | Theme Wibar | 5.1 (v4.0) | Medium |
| CVE-2020-37284 | Sickbeard build-507 Reflected XSS via testNaming pattern Parameter | Sickbeard | 5.1 (v4.0) | Medium |
| CVE-2021-47931 | Exponent CMS 2.6 Multiple Vulnerabilities Stored XSS Authentication | Exponent CMS | 5.1 (v4.0) | Medium |
| CVE-2021-47947 | Projectsend r1295 Stored Cross-Site Scripting via files-edit.php | Projectsend | 5.1 (v4.0) | Medium |
| CVE-2021-47983 | WordPress Plugin Stripe Payments 2.0.39 Stored XSS via currency_code | Accept Stripe Payments | 5.1 (v4.0) | Medium |
| CVE-2022-50943 | Moodle LMS 4.0 Cross-Site Scripting via course search.php | moodle | 5.1 (v4.0) | Medium |
| CVE-2022-50961 | WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS | IP2Location Country Blocker | 5.1 (v4.0) | Medium |
| CVE-2022-50962 | uBidAuction 2.0.1 myOrders Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50963 | uBidAuction 2.0.1 myAuctions active Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50964 | uBidAuction 2.0.1 myAuctions loose Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50965 | uBidAuction 2.0.1 posts manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50966 | uBidAuction 2.0.1 news manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50968 | uBidAuction 2.0.1 auctions manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50969 | uBidAuction 2.0.1 mailingLog manage Reflected XSS | uBidAuction | 5.1 (v4.0) | Medium |
| CVE-2022-50970 | WordPress Plugin AAWP 3.16 Reflected XSS via tab Parameter | WordPress Plugin AAWP | 5.1 (v4.0) | Medium |
| CVE-2023-54358 | WordPress adivaha Travel Plugin 2.3 Reflected XSS via isMobile | WordPress adivaha Travel Plugin | 5.1 (v4.0) | Medium |
| CVE-2023-54361 | Joomla iProperty Real Estate 4.1.1 Reflected XSS via filter_keyword | Joomla iProperty Real Estate | 5.1 (v4.0) | Medium |
| CVE-2023-54362 | Joomla VirtueMart Shopping-Cart 4.0.12 Reflected XSS via keyword | Cart | 5.1 (v4.0) | Medium |
| CVE-2023-54413 | WPML Multilingual CMS WordPress Plugin < 4.6.1 Reflected XSS via wp-login.php wp_lang | WPML Multilingual CMS | 5.1 (v4.0) | Medium |
| CVE-2024-13992 | Nagios XI < 2024R1.1 XSS via Missing Page / 404 | nagios xi | 5.1 (v4.0) | Medium |
| CVE-2024-58394 | Retool 3.88.0 XSS via /api/imageProxy SVG Proxying | Retool | 5.1 (v4.0) | Medium |
| CVE-2025-10354 | Reflected Cross-Site Scripting (XSS) in Semantic MediaWiki | Semantic MediaWiki | 5.1 (v4.0) | Medium |
| CVE-2025-10945 | nuz007 smsboom d.php cross site scripting | smsboom | 5.1 (v4.0) | Medium |
| CVE-2025-10946 | nuz007 smsboom dy.php cross site scripting | smsboom | 5.1 (v4.0) | Medium |
| CVE-2025-12264 | Wisencode Create Support Ticket create cross site scripting | Wisencode | 5.1 (v4.0) | Medium |
| CVE-2025-13415 | icret EasyImages SVG Image upload.php cross site scripting | easyimages2.0 | 5.1 (v4.0) | Medium |
| CVE-2025-34032 | Moodle LMS Jmol Plugin <= 6.1 - Cross-Site Scripting | jmol | 5.1 (v4.0) | Medium |
| CVE-2025-34257 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/defined | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34258 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/plan | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34259 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicemap/building | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34260 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via action/schedule | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34261 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devicegroups/ | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34262 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via devices/name/{agent_id} | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34263 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/dashboards/menus | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34264 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via dog/{agentId} | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34265 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via rule-engines | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34266 | Advantech WISE-DeviceOn Server < 5.4 Authenticated Stored XSS via plugin-config/addins/menus | wise-deviceon server | 5.1 (v4.0) | Medium |
| CVE-2025-34301 | IPFire < v2.29 Stored XSS via Location Group Creation | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34302 | IPFire < v2.29 Stored XSS via Service Creation | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34303 | IPFire < v2.29 Stored XSS via Whitelisted Host Creation | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34305 | IPFire < v2.29 Stored XSS via Multiple Methods in cleanhtml() | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34306 | IPFire < v2.29 Stored XSS via Default IP Search Value | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34307 | IPFire < v2.29 Stored XSS via Default Country Search | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34308 | IPFire < v2.29 Stored XSS via Default Time Sync | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34309 | IPFire < v2.29 Stored XSS via Dynamic DNS Host | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34310 | IPFire < v2.29 Stored XSS via Quality of Service (QoS) Settings | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34313 | IPFire < v2.29 Stored XSS via User Quota Rule URL Filter | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34314 | IPFire < v2.29 Stored XSS via Time Constraint Rule URL Filter | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34315 | IPFire < v2.29 Stored XSS via Remote Syslog Server Address | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34316 | IPFire < v2.29 Stored XSS via Mail Server Settings | ipfire | 5.1 (v4.0) | Medium |
| CVE-2025-34318 | IPFire < v2.29 Stored XSS via DNS Creation (proxy.cgi) | IPFire | 5.1 (v4.0) | Medium |
| CVE-2025-40638 | Reflected Cross-Site Scripting (XSS) in Eventobot | eventobot | 5.1 (v4.0) | Medium |
| CVE-2025-40640 | Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker | energy crm | 5.1 (v4.0) | Medium |
| CVE-2025-40642 | Reflected Cross-Site Scripting (XSS) in WebWork | WebWork PHP script | 5.1 (v4.0) | Medium |
| CVE-2025-40643 | Stored Cross-Site Scripting (XSS) in Energy CRM by Status Tracker | energy crm | 5.1 (v4.0) | Medium |
| CVE-2025-40647 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel products | Issabel | 5.1 (v4.0) | Medium |
| CVE-2025-40681 | Cross-Site Scripting (XSS) in xCally Omnichannel | Omnichannel | 5.1 (v4.0) | Medium |
| CVE-2025-40693 | Cross Site Scripting in PHPGurukul Online Fire Reporting System | online fire reporting system | 5.1 (v4.0) | Medium |
| CVE-2025-40702 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40703 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40704 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40705 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40706 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40707 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40708 | Cross-Site Scripting (XSS) vulnerability in OpenAtlas by ACDH-CH | openatlas | 5.1 (v4.0) | Medium |
| CVE-2025-40989 | Stored XSS in Creativeitem Ekushey CRM | ekushey project manager crm | 5.1 (v4.0) | Medium |
| CVE-2025-40990 | Stored XSS in Creativeitem Ekushey CRM | ekushey project manager crm | 5.1 (v4.0) | Medium |
| CVE-2025-40992 | Stored XSS in Creativeitem Sociopro | Sociopro | 5.1 (v4.0) | Medium |
| CVE-2025-41001 | Cross-Site Scripting (XSS) in SOPlanning | soplanning | 5.1 (v4.0) | Medium |
| CVE-2025-41011 | HTML injection in PHP Point Of Sale | php point of sale | 5.1 (v4.0) | Medium |
| CVE-2025-41021 | Stored Cross-Site Scripting (XSS) vulnerability in Sergestec's Exito | exito | 5.1 (v4.0) | Medium |
| CVE-2025-41036 | Stored Cross-Site Scripting vulnerability in appRain CMF | apprain | 5.1 (v4.0) | Medium |
| CVE-2025-41079 | Multiple vulnerabilities in Seafile | seafile | 5.1 (v4.0) | Medium |
| CVE-2025-41080 | Multiple vulnerabilities in Seafile | seafile | 5.1 (v4.0) | Medium |
| CVE-2025-41101 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | rise ultimate project manager | 5.1 (v4.0) | Medium |
| CVE-2025-41104 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | rise ultimate project manager | 5.1 (v4.0) | Medium |
| CVE-2025-41105 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | rise ultimate project manager | 5.1 (v4.0) | Medium |
| CVE-2025-41106 | Multiple vulnerabilities in Fairsketch's RISE CRM Framework | rise ultimate project manager | 5.1 (v4.0) | Medium |
| CVE-2025-41107 | Stored XSS in Smart School | smart school | 5.1 (v4.0) | Medium |
| CVE-2025-41393 | Ricoh Web Image Monitor - Reflected XSS | Multiple laser printers and MFPs which implement Web Image Monitor | 5.1 (v4.0) | Medium |
| CVE-2025-53533 | Pi-hole Reflected XSS in 404-Error Page | web interface | 5.1 (v4.0) | Medium |
| CVE-2025-59750 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59756 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59758 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59767 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-59769 | Multiple vulnerabilities in AndSoft's e-TMS | e-tms | 5.1 (v4.0) | Medium |
| CVE-2025-61599 | Emlog is Vulnerable to Stored Cross-Site Scripting (XSS) in "Twitter" Feature via Markdown Input | emlog | 5.1 (v4.0) | Medium |
| CVE-2025-64716 | Anubis vulnerable to possible XSS via redir parameter when using subrequest auth mode | anubis | 5.1 (v4.0) | Medium |
| CVE-2025-71385 | Netdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg Endpoint | netdata | 5.1 (v4.0) | Medium |
| CVE-2025-71404 | better-auth before 1.1.16 Reflected XSS via error parameter | better-auth | 5.1 (v4.0) | Medium |
| CVE-2025-9655 | O2OA Personal Profile person cross site scripting | o2oa | 5.1 (v4.0) | Medium |
| CVE-2026-100174 | Stored Cross-Site Scripting (XSS) in AIL Framework Tag Selector via Unescaped Tag Names | ail framework | 5.1 (v4.0) | Medium |
| CVE-2026-100521 | Cotonti through 1.0.0 Reflected XSS via search highlight parameter | Cotonti | 5.1 (v4.0) | Medium |
| CVE-2026-100522 | Cotonti through 1.0.0 Reflected XSS via message.php lng parameter | Cotonti | 5.1 (v4.0) | Medium |
| CVE-2026-100630 | AVideo Stored XSS via HTML Entity Bypass in trailer1 Field | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-100904 | amirsanni mini-inventory-and-sales-management-system Items Management Items.php cross site scripting | mini-inventory-and-sales-management-system | 5.1 (v4.0) | Medium |
| CVE-2026-102755 | DataEase Datasource/Dataset Folder Name Stored Cross-Site Scripting | dataease | 5.1 (v4.0) | Medium |
| CVE-2026-102756 | DataEase bar-horizontal Axis Label Tooltip Stored Cross-Site Scripting | dataease | 5.1 (v4.0) | Medium |
| CVE-2026-103587 | QloApps through 1.7.0 Reflected XSS via Book Now Search Parameters | QloApps | 5.1 (v4.0) | Medium |
| CVE-2026-103589 | QloApps through 1.7.0 Reflected XSS via Room Type Editor | QloApps | 5.1 (v4.0) | Medium |
| CVE-2026-103590 | QloApps through 1.7.0 Reflected XSS via Length of Stay Fields | QloApps | 5.1 (v4.0) | Medium |
| CVE-2026-104461 | YesWiki before 4.6.7 Stored XSS via Unsanitized SVG Upload in Bazar FileField | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-104465 | YesWiki before 4.6.7 Reflected XSS via field Parameter in mail Handler | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-104473 | YesWiki before 4.5.3 Multiple Reflected XSS via BazaR and listpages | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-105224 | YesWiki before 4.6.7 Stored XSS via Bazar valeur Action | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-107799 | Jivejdon through 5.0 Stored XSS via messageListBody.jsp Forum Message Rendering | jivejdon | 5.1 (v4.0) | Medium |
| CVE-2026-109300 | Open WebUI 0.6.31 before 0.11.4 Stored XSS via Tool-Call Embeds | open-webui | 5.1 (v4.0) | Medium |
| CVE-2026-109327 | Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 Reflected XSS via system/redirect.php | admidio | 5.1 (v4.0) | Medium |
| CVE-2026-110101 | Koillection through 1.8.4 Stored XSS via Datum File Attachment Uploads | Koillection | 5.1 (v4.0) | Medium |
| CVE-2026-110625 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php | clipbucket-v5 | 5.1 (v4.0) | Medium |
| CVE-2026-111168 | LibreDesk before 2.9.0-rc.8 Stored XSS via SVG Upload Content-Type Parameter | libredesk | 5.1 (v4.0) | Medium |
| CVE-2026-112097 | SourceCodester Inventory System Sales Management transactions_handler.php save_sale cross site scripting | Inventory System | 5.1 (v4.0) | Medium |
| CVE-2026-113683 | VPL for Moodle before 5.0.0 Reflected XSS via similarity/diff.php filename | moodle-mod vpl | 5.1 (v4.0) | Medium |
| CVE-2026-114407 | e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter | e107 | 5.1 (v4.0) | Medium |
| CVE-2026-116169 | SiYuan 2.10.0 before 3.8.7 Stored XSS via KaTeX \href in Math Blocks | siyuan | 5.1 (v4.0) | Medium |
| CVE-2026-116202 | YesWiki before 4.7.0 Stored XSS via ImageField SVG Upload | yeswiki | 5.1 (v4.0) | Medium |
| CVE-2026-116891 | SemanticMediaWiki 4.2.0 before 7.2.1 Reflected XSS via Special:FacetedSearch cstate | SemanticMediaWiki | 5.1 (v4.0) | Medium |
| CVE-2026-117535 | REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool | core | 5.1 (v4.0) | Medium |
| CVE-2026-11982 | Stored XSS via missing XSS safety check in Admin2 Pages API partial validation | grav-plugin-api | 5.1 (v4.0) | Medium |
| CVE-2026-1630 | Reflected XSS in WEBCON BPS | WEBCON BPS | 5.1 (v4.0) | Medium |
| CVE-2026-19434 | Stored Cross-site Scripting in Pentestify finding severity field | Pentestify | 5.1 (v4.0) | Medium |
| CVE-2026-19716 | Stored Cross-site Scripting in Pentestify user account deletion via unescaped username | Pentestify | 5.1 (v4.0) | Medium |
| CVE-2026-22675 | OCS Inventory NG Server Stored XSS via User-Agent | ocs inventory server | 5.1 (v4.0) | Medium |
| CVE-2026-25557 | Evoluted PHP Directory Listing Script 4.0.5 Reflected XSS via dir parameter | PHP Directory Listing Script | 5.1 (v4.0) | Medium |
| CVE-2026-27176 | MajorDoMo - Cross-Site Scripting | majordomo | 5.1 (v4.0) | Medium |
| CVE-2026-32856 | Ellucian Banner Self-Service Reflected XSS via dateConverter | Banner Self-Service | 5.1 (v4.0) | Medium |
| CVE-2026-3317 | Reflected Cross-Site Scripting in Navigate CMS application | Navigate CMS | 5.1 (v4.0) | Medium |
| CVE-2026-34416 | OSCAL-GUI Reflected XSS via project parameter in oscal.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34417 | OSCAL-GUI Reflected XSS via project parameter in oscal-forms.php | OSCAL-GUI | 5.1 (v4.0) | Medium |
| CVE-2026-34429 | Vvveb < 1.0.8.1 Stored XSS via Media Upload and Rename | Vvveb | 5.1 (v4.0) | Medium |
| CVE-2026-34798 | Endian Firewall /cgi-bin/routing.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34799 | Endian Firewall /manage/dnsmasq/hosts/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34800 | Endian Firewall /cgi-bin/uplinkeditor.cgi NAME Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34801 | Endian Firewall /manage/dhcp/fixed_leases/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34802 | Endian Firewall /cgi-bin/salearn.cgi remark user ham spam Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34803 | Endian Firewall /manage/qos/classes/ name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34804 | Endian Firewall /manage/qos/rules/ dscp Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34805 | Endian Firewall /cgi-bin/dnat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34806 | Endian Firewall /cgi-bin/snat.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34807 | Endian Firewall /cgi-bin/incoming.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34808 | Endian Firewall /cgi-bin/outgoingfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34809 | Endian Firewall /cgi-bin/zonefw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34810 | Endian Firewall /cgi-bin/vpnfw.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34811 | Endian Firewall /cgi-bin/xtaccess.cgi remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34812 | Endian Firewall /cgi-bin/proxypolicy.cgi mimetypes Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34813 | Endian Firewall /cgi-bin/proxyuser.cgi user Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34814 | Endian Firewall /cgi-bin/proxygroup.cgi group Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34815 | Endian Firewall /cgi-bin/smtpdomains.cgi DOMAIN Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34816 | Endian Firewall /manage/smtpscan/domainrouting/ domain Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34817 | Endian Firewall /cgi-bin/smtprouting.cgi ADDRESS BCC Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34818 | Endian Firewall /manage/dnsmasq/localdomains/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34819 | Endian Firewall /cgi-bin/openvpnclient.cgi REMARK Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34820 | Endian Firewall /manage/ipsec/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34821 | Endian Firewall /manage/vpnauthentication/user/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34822 | Endian Firewall /manage/ca/certificate/ new_cert_name Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-34823 | Endian Firewall /manage/password/web/ remark Stored Cross-Site Scripting | firewall community | 5.1 (v4.0) | Medium |
| CVE-2026-35007 | Open ISES Tickets < 3.44.2 Reflected XSS via single_unit.php id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35008 | Open ISES Tickets < 3.44.2 Reflected XSS via single.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35009 | Open ISES Tickets < 3.44.2 Reflected XSS via add_note.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35010 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_JF.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35011 | Open ISES Tickets < 3.44.2 Reflected XSS via opena.php frm_call Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35012 | Open ISES Tickets < 3.44.2 Reflected XSS via add_facnote.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35014 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_nm.php ticket_id Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35015 | Open ISES Tickets < 3.44.2 Reflected XSS via do_unit_mail.php the_ticket Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-35016 | Open ISES Tickets < 3.44.2 Reflected XSS via search.php frm_query Parameter | tickets | 5.1 (v4.0) | Medium |
| CVE-2026-40508 | OpenEMR < 8.3.0 Stored XSS via Patient Portal Template Import Handler | openemr | 5.1 (v4.0) | Medium |
| CVE-2026-41456 | Bludit CMS <= 3.20.0 - Cross-Site Scripting | bludit | 5.1 (v4.0) | Medium |
| CVE-2026-42840 | ERPNext 16.16.0 - Stored XSS in POS customer section via unescaped template literals | ERPNext | 5.1 (v4.0) | Medium |
| CVE-2026-4316 | Reflected Cross-Site Scripting in software IsMyGym by Zuinq Studio | IsMyGym | 5.1 (v4.0) | Medium |
| CVE-2026-45228 | Quark Drive (quark-auto-save) < 0.8.5 Stored XSS via System Configuration | quark-auto-save | 5.1 (v4.0) | Medium |
| CVE-2026-45551 | Group-Office: Authenticated Stored XSS in Administrator Context via Arbitrary Cross-User Setting Write | groupoffice | 5.1 (v4.0) | Medium |
| CVE-2026-45616 | Vvveb: Stored XSS in Posts allows privilege escalation via post editor | Vvveb | 5.1 (v4.0) | Medium |
| CVE-2026-46363 | phpMyFAQ - Stored XSS in FAQ Question/Answer via Encode-Decode Bypass | phpmyfaq | 5.1 (v4.0) | Medium |
| CVE-2026-47106 | Ellucian Banner Self-Service Stored XSS via getFacultyMeetingTimes API | Banner Self-Service | 5.1 (v4.0) | Medium |
| CVE-2026-48214 | Open ISES Tickets < 3.44.2 Reflected XSS via add_nm.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48215 | Open ISES Tickets < 3.44.2 Reflected XSS via circle.php frm_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48218 | Open ISES Tickets < 3.44.2 Reflected XSS via icons/buttons/landb.php frm_name and frm_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48219 | Open ISES Tickets < 3.44.2 Reflected XSS via ics202.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48220 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48221 | Open ISES Tickets < 3.44.2 Reflected XSS via ics205a.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48222 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48223 | Open ISES Tickets < 3.44.2 Reflected XSS via ics213rr.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48224 | Open ISES Tickets < 3.44.2 Reflected XSS via ics214.php frm_add_str Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48225 | Open ISES Tickets < 3.44.2 Reflected XSS via landb.php _type Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48226 | Open ISES Tickets < 3.44.2 Reflected XSS via os_watch.php ref and mode_orig Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48227 | Open ISES Tickets < 3.44.2 Reflected XSS via patient.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48228 | Open ISES Tickets < 3.44.2 Reflected XSS via patient_w.php id and ticket_id Parameters | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48229 | Open ISES Tickets < 3.44.2 Reflected XSS via routes_i.php ticket_id Parameter | Tickets | 5.1 (v4.0) | Medium |
| CVE-2026-48530 | GFI Archiver < 15.13 Stored XSS via CategorizationPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48531 | GFI Archiver < 15.13 Stored XSS via RetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48532 | GFI Archiver < 15.13 Stored XSS via FAARetentionPolicyWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48534 | GFI Archiver < 15.13 Stored XSS via ImapServerWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48535 | GFI Archiver < 15.13 Stored XSS via CallHomeSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48536 | GFI Archiver < 15.13 Stored XSS via GeneralSettingsWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48537 | GFI Archiver < 15.13 Stored XSS via FileArchiveAssistantWizard.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48538 | GFI Archiver < 15.13 Stored XSS via ImportSettingsWizard.ashx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48539 | GFI Archiver < 15.13 Stored XSS via MailInsights.aspx | GFI Archiver | 5.1 (v4.0) | Medium |
| CVE-2026-48540 | Krayin CRM 2.2.6 Stored Template Injection XSS via Lead Title | laravel-crm | 5.1 (v4.0) | Medium |
| CVE-2026-48552 | Nagios Core / XI DOM-based XSS via jsonquery.js | Nagios Core | 5.1 (v4.0) | Medium |
| CVE-2026-48559 | Lightweight Music Server 3.76.0 Stored XSS via Media File Metadata Tags | lms | 5.1 (v4.0) | Medium |
| CVE-2026-5010 | Reflected Cross-Site Scripting (XSS) in Sanoma’s Clickedu | Clickedu | 5.1 (v4.0) | Medium |
| CVE-2026-50230 | Lyrion Music Server <= 9.2.0 - Cross-Site Scripting | Lyrion Music Server | 5.1 (v4.0) | Medium |
| CVE-2026-50701 | Frappe Framework 17.0.0-dev - Reflected DOM XSS in dashboard-view breadcrumb rendering | Frappe Framework | 5.1 (v4.0) | Medium |
| CVE-2026-53555 | Stored XSS via SVG Upload | SQLBot | 5.1 (v4.0) | Medium |
| CVE-2026-53992 | Reflected XSS in ProjectSend thumbnails-regenerate.php via start_date / end_date Parameters | ProjectSend | 5.1 (v4.0) | Medium |
| CVE-2026-54386 | marimo < 0.23.9 XSS via file Query Parameter in assets.py | marimo | 5.1 (v4.0) | Medium |
| CVE-2026-56126 | pfSense Plus < 26.07 / CE < 2.9.0 Stored XSS via status_monitoring.php | pfSense Plus | 5.1 (v4.0) | Medium |
| CVE-2026-57857 | Flow Payment Plugin for WordPress Reflected Cross-Site Scripting via error_message Parameter | Flow Payment | 5.1 (v4.0) | Medium |
| CVE-2026-57958 | Mixpost 2.6.0 - Reflected XSS via OAuth Callback Error Parameter | mixpost | 5.1 (v4.0) | Medium |
| CVE-2026-58579 | RAGFlow < 0.26.3 - Stored Cross-Site Scripting via Agent Pipeline Node Name | ragflow | 5.1 (v4.0) | Medium |
| CVE-2026-60092 | AVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants Panel | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-6082 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-6083 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-6084 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-6085 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-6086 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-6087 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-6088 | Stored Cross-Site Scripting in StockAgile by Novadigits technologies | StockAgile | 5.1 (v4.0) | Medium |
| CVE-2026-61453 | Grav before 2.0.1 XSS via Twig String Concatenation | grav | 5.1 (v4.0) | Medium |
| CVE-2026-61504 | Rejetto HFS < 3.2.1 Stored XSS via File Names in Basic Web Listing | hfs | 5.1 (v4.0) | Medium |
| CVE-2026-64628 | Grav Stored Cross-Site Scripting via Shortcode Attribute Handlers | grav | 5.1 (v4.0) | Medium |
| CVE-2026-65697 | Fathom Lite 1.3.1 Stored XSS via /collect Endpoint | fathom | 5.1 (v4.0) | Medium |
| CVE-2026-66296 | Reflected XSS in oaskit's default HTML error handler | oaskit | 5.1 (v4.0) | Medium |
| CVE-2026-67333 | better-auth before 1.6.13 Stored XSS via javascript redirect_uri | better-auth | 5.1 (v4.0) | Medium |
| CVE-2026-68583 | luci-app-adblock-fast before 1.2.4-4 Stored XSS via file_url.name | luci | 5.1 (v4.0) | Medium |
| CVE-2026-6954 | Multiple vulnerabilities in Intermark IT's WebControl CMS | WebControl CMS | 5.1 (v4.0) | Medium |
| CVE-2026-71503 | Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template | dolibarr | 5.1 (v4.0) | Medium |
| CVE-2026-72743 | SQLBot 1.10.0 SQText Dashboard Component Stored XSS via v-html | SQLBot | 5.1 (v4.0) | Medium |
| CVE-2026-72747 | AVideo Stored Cross-Site Scripting via Unauthenticated Registration | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-72821 | Grav Form Plugin before 9.1.15 Stored XSS via Radio Toggle | grav | 5.1 (v4.0) | Medium |
| CVE-2026-73319 | XenForo < 2.3.13 XSS via Dynamic Redirect Handler | xenforo | 5.1 (v4.0) | Medium |
| CVE-2026-75831 | Grav before 2.0.15 Stored XSS via audio/video source URL | grav | 5.1 (v4.0) | Medium |
| CVE-2026-84477 | AVideo Stored XSS via Live Schedule Title Description | AVideo | 5.1 (v4.0) | Medium |
| CVE-2026-85593 | phpMyFAQ before 4.1.8 Stored XSS via html_entity_decode | phpMyFAQ | 5.1 (v4.0) | Medium |
| CVE-2026-85600 | Grav Admin before 2.0.21 Stored XSS via username | grav-plugin-admin2 | 5.1 (v4.0) | Medium |
| CVE-2026-86197 | Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox | grav | 5.1 (v4.0) | Medium |
| CVE-2026-90529 | DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting | DataEase | 5.1 (v4.0) | Medium |
| CVE-2026-90563 | maliangnansheng bbs-springboot ArticleController.java utils.toToc cross site scripting | bbs-springboot | 5.1 (v4.0) | Medium |
| CVE-2026-90567 | quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting | shiyi-blog | 5.1 (v4.0) | Medium |
| CVE-2026-90568 | moxi624 Mogu Blog v2 blogSort Endpoint info.ftl BlogSortServiceImpl.addBlogSort cross site scripting | Mogu Blog v2 | 5.1 (v4.0) | Medium |
| CVE-2026-90602 | Anil-matcha Open-Generative-AI Studio Components ImageStudio.js renderHistory cross site scripting | Open-Generative-AI | 5.1 (v4.0) | Medium |
| CVE-2026-90931 | LaraDashboard 0.9.0 through 1.2.2 Stored XSS via SVG Upload | laradashboard | 5.1 (v4.0) | Medium |
| CVE-2026-91944 | crawl4ai before 0.9.3 DOM-based XSS via Playground UI | crawl4ai | 5.1 (v4.0) | Medium |
| CVE-2026-96535 | Cross-Site Scripting in the YouMind web application | YouMind web application | 5.1 (v4.0) | Medium |
| CVE-2011-4898 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 5.0 (v2.0) | Medium |
| CVE-2012-5192 | Bitweaver overlay_type Directory Traversal | bitweaver | 5.0 (v2.0) | Medium |
| CVE-2013-4615 | Canon Wireless Printer Denial Of Service | mg3100 printer | 5.0 (v2.0) | Medium |
| CVE-2013-6043 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 5.0 (v2.0) | Medium |
| CVE-2015-4666 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 5.0 (v2.0) | Medium |
| CVE-2026-43979 | Local Deep Research: HTML Injection via Unescaped User Input in PDF Export (pdf_service.py:_markdown_to_html) | local-deep-research | 5.0 (v3.1) | Medium |
| CVE-2026-107757 | Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name | Gallery Custom Links | 4.9 (v3.1) | Medium |
| CVE-2013-20009 | Linksys WAG200G through 1.01.06 Stored XSS via policy_name Parameter | WAG200G | 4.8 (v4.0) | Medium |
| CVE-2017-14651 | WSO2 Data Analytics Server 3.1.0 - Cross-Site Scripting | api manager | 4.8 (v3.1) | Medium |
| CVE-2018-1000856 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-1186 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1187 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1188 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1189 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1201 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-1202 | Dell EMC Isilon OneFS - Multiple Vulnerabilities | emc isilon | 4.8 (v3.0) | Medium |
| CVE-2018-19749 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19751 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19752 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19892 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19914 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-19915 | DomainMOD <=4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20009 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20010 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20011 | DomainMOD 4.11.01 - Cross-Site Scripting | domainmod | 4.8 (v3.0) | Medium |
| CVE-2018-20418 | Craft CMS 3.0.25 - Cross-Site Scripting | craft cms | 4.8 (v3.0) | Medium |
| CVE-2019-15829 | Gallery Photoblocks < 1.1.43 - Cross-Site Scripting | gallery photoblocks | 4.8 (v3.0) | Medium |
| CVE-2020-29240 | LEPTON CMS 4.7.0 - 'URL' Persistent Cross-Site Scripting | leptoncms | 4.8 (v3.1) | Medium |
| CVE-2020-29470 | OpenCart 3.0.3.6 - 'subject' Stored Cross-Site Scripting | opencart | 4.8 (v3.1) | Medium |
| CVE-2020-29475 | nopCommerce Store 4.30 - 'name' Stored Cross-Site Scripting | store | 4.8 (v3.1) | Medium |
| CVE-2020-29477 | Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting | community | 4.8 (v3.1) | Medium |
| CVE-2020-35241 | Flatpress Add Blog 1.0.3 - Persistent Cross-Site Scripting | flatpress | 4.8 (v3.1) | Medium |
| CVE-2021-46068 | Vehicle Service Management System - Stored Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46069 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46071 | ehicle Service Management System 1.0 - Cross-Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46072 | Vehicle Service Management System 1.0 - Stored Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2021-46073 | Vehicle Service Management System 1.0 - Cross Site Scripting | vehicle service management system | 4.8 (v3.1) | Medium |
| CVE-2023-0563 | Bank Locker Management System - Cross-Site Scripting | bank locker management system | 4.8 (v3.1) | Medium |
| CVE-2023-2178 | Aajoda Testimonials < 2.2.2 - Cross-Site Scripting | aajoda testimonials | 4.8 (v3.1) | Medium |
| CVE-2023-27624 | WordPress Redirect After Login <= 0.1.9 - Admin Stored XSS | redirect after login | 4.8 (v3.1) | Medium |
| CVE-2024-11921 | Give WP Plugin < 3.19.0 - Cross-Site Scripting | givewp | 4.8 (v3.1) | Medium |
| CVE-2024-31839 | Chaos RAT XSS to RCE | chaos | 4.8 (v3.1) | Medium |
| CVE-2024-3822 | Base64 Encoder/Decoder <= 0.9.2 - Reflected XSS | base64 encoderdecoder | 4.8 (v3.1) | Medium |
| CVE-2024-50857 | GestioIP - Reflected Cross-Site Scripting | gestioip | 4.8 (v3.1) | Medium |
| CVE-2025-15669 | Bit Form < 3.1.4 - Admin+ Stored XSS via Conversational Form Progress Label | Bit Form | 4.8 (v3.1) | Medium |
| CVE-2025-40648 | Stored Cross-Site Scripting (XSS) vulnerability in Issabel products | Issabel | 4.8 (v4.0) | Medium |
| CVE-2025-43817 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 4.8 (v4.0) | Medium |
| CVE-2025-61996 | OPEXUS FOIAXpress stored XSS via annual report template | foiaxpress | 4.8 (v4.0) | Medium |
| CVE-2025-62263 | digital experience platform Cross-Site Scripting Vulnerability | digital experience platform | 4.8 (v4.0) | Medium |
| CVE-2025-62411 | Stored XSS in Alert Transport name field in LibreNMS | librenms | 4.8 (v3.1) | Medium |
| CVE-2025-62414 | bagisto - Cross Site Scripting (XSS) in Create New Customer | bagisto | 4.8 (v3.1) | Medium |
| CVE-2025-9823 | Reflected XSS in lead:addLeadTags - Quick Add | Mautic | 4.8 (v4.0) | Medium |
| CVE-2026-111232 | Netgate pfSense CE 2.3.0 through 2.9.0 Stored XSS via Separator Color | pfsense | 4.8 (v4.0) | Medium |
| CVE-2026-113712 | Cachet has Stored XSS in Incident Component | cachet | 4.8 (v4.0) | Medium |
| CVE-2026-116888 | SemanticMediaWiki 3.2.0 before 7.3.1 Stored XSS via Special:Browse Group Heading | SemanticMediaWiki | 4.8 (v4.0) | Medium |
| CVE-2026-22674 | Hashgraph Guardian Stored XSS via branding companyName field | guardian | 4.8 (v4.0) | Medium |
| CVE-2026-26211 | Ekushey Project Manager CRM 5.0 Stored XSS via System Name Field | Ekushey Project Manager CRM | 4.8 (v4.0) | Medium |
| CVE-2026-34096 | Guardian Language-System XSS via name Parameter in designer.php | language-system | 4.8 (v4.0) | Medium |
| CVE-2026-34097 | Guardian Language-System XSS via id Parameter in text_file.php | language-system | 4.8 (v4.0) | Medium |
| CVE-2026-34098 | Guardian Language-System XSS via id Parameter in media.php | language-system | 4.8 (v4.0) | Medium |
| CVE-2026-34246 | CtrlPanel: Stored XSS in Admin Role Management via Unescaped DataTable HTML Output | panel | 4.8 (v3.1) | Medium |
| CVE-2026-39390 | CI4MS has Stored XSS via srcdoc attribute bypass in Google Maps iframe setting | ci4ms | 4.8 (v3.1) | Medium |
| CVE-2026-39392 | CI4MS has Stored XSS in Pages Content Due to Missing html_purify Sanitization | ci4ms | 4.8 (v3.1) | Medium |
| CVE-2026-46516 | Frogman vulnerable to stored XSS in chat console formatter (escalation vector in multi-admin deployments) | frogman | 4.8 (v4.0) | Medium |
| CVE-2026-50708 | Frappe Framework 17.0.0-dev - Stored XSS in Multi Select Dialog result rendering | Frappe Framework | 4.8 (v4.0) | Medium |
| CVE-2026-56283 | Capgo - HTML Injection Leading to Open Redirection in Organization Settings | Capgo | 4.8 (v4.0) | Medium |
| CVE-2026-58657 | Grav - Stored CSS Injection via Markdown Image resize() Action | Grav | 4.8 (v4.0) | Medium |
| CVE-2026-59659 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59660 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59661 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59662 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59663 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59664 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59665 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59666 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59667 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59668 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59669 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59670 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59672 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-59673 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-63001 | REDAXO: Stored XSS via Unescaped Media Manager Type Name in mediaIsInUse() | redaxo | 4.8 (v3.1) | Medium |
| CVE-2026-63002 | REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames | redaxo | 4.8 (v3.1) | Medium |
| CVE-2026-6623 | BichitroGan ISP Billing Software Profile users-view cross site scripting | ISP Billing Software | 4.8 (v4.0) | Medium |
| CVE-2026-67612 | OpenEMR 8.2.0 Stored XSS via import_template.php Template Management | openemr | 4.8 (v4.0) | Medium |
| CVE-2026-67617 | Microweber CMS 2.0.20 Stored XSS via tag_names Parameter | microweber | 4.8 (v4.0) | Medium |
| CVE-2026-70560 | Ultimate POS Stored XSS via First Name Field in Leave Notifications | Ultimate POS (Stock Management & Point of Sale) | 4.8 (v4.0) | Medium |
| CVE-2026-7171 | Stored Cross-Site Scripting (XSS) in TPVEnlanube | Cloud Web application | 4.8 (v4.0) | Medium |
| CVE-2026-7172 | Stored Cross-Site Scripting (XSS) in TPVEnlanube | Cloud Web application | 4.8 (v4.0) | Medium |
| CVE-2026-7173 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium |
| CVE-2026-7174 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium |
| CVE-2026-7175 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium |
| CVE-2026-7176 | Multiple vulnerabilities in Entradium by Crocantickets | Entradium | 4.8 (v4.0) | Medium |
| CVE-2026-79663 | Ech0 before 4.7.3 Stored XSS via RSS feed tag names | Ech0 | 4.8 (v4.0) | Medium |
| CVE-2026-79670 | Ech0 before 4.4.3 Stored XSS via SVG Upload | Ech0 | 4.8 (v4.0) | Medium |
| CVE-2026-84188 | librenms before 26.7.0 Stored XSS via graph_descr settings | librenms | 4.8 (v4.0) | Medium |
| CVE-2026-85293 | InvoicePlane: Stored Cross-Site Scripting (XSS) via Client Email in Invoice and Quote Mailer Forms | InvoicePlane | 4.8 (v3.1) | Medium |
| CVE-2026-90569 | linlinjava litemall Admin Topic index.vue AdminTopicController.validate cross site scripting | litemall | 4.8 (v4.0) | Medium |
| CVE-2026-90570 | linlinjava litemall Product Detail index.vue AdminGoodsService.validate cross site scripting | litemall | 4.8 (v4.0) | Medium |
| CVE-2026-95662 | Multiple vulnerabilities in the Repasat application | Repasat application | 4.8 (v4.0) | Medium |
| CVE-2026-9577 | Post Status Notifier Lite < 1.13.0 - Reflected XSS via mod Parameter | Post Status Notifier Lite | 4.8 (v3.1) | Medium |
| CVE-2023-45671 | Frigate < 0.13.0 Beta 3 - Cross-Site Scripting | frigate | 4.7 (v3.1) | Medium |
| CVE-2024-13627 | OWL Carousel Slider - Cross-Site Scripting | owl carousel slider | 4.7 (v3.1) | Medium |
| CVE-2024-24050 | Workout Journal App 1.0 - Stored XSS | workout journal app | 4.7 (v3.1) | Medium |
| CVE-2026-3093 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab | gitlab | 4.7 (v3.1) | Medium |
| CVE-2026-4406 | Gravity Forms <= 2.9.30 - Reflected Cross-Site Scripting via 'form_ids' Parameter | Gravity Forms | 4.7 (v3.1) | Medium |
| CVE-2011-4642 | Splunk Search Remote Code Execution | splunk | 4.6 (v2.0) | Medium |
| CVE-2013-3630 | Moodle Authenticated Spelling Binary RCE | moodle | 4.6 (v2.0) | Medium |
| CVE-2025-61074 | mitarbeiter portal Cross-Site Scripting Vulnerability | mitarbeiter portal | 4.6 (v3.1) | Medium |
| CVE-2025-65229 | lyrion music server Cross-Site Scripting Vulnerability | lyrion music server | 4.6 (v3.1) | Medium |
| CVE-2025-67342 | ruoyi Cross-Site Scripting Vulnerability | ruoyi | 4.6 (v3.1) | Medium |
| CVE-2025-67344 | jsherp Cross-Site Scripting Vulnerability | jsherp | 4.6 (v3.1) | Medium |
| CVE-2026-16273 | Narrative Publisher <= 1.0.7 - Contributor+ Stored XSS via narrative_post_script Post Meta | Narrative Publisher | 4.6 (v3.1) | Medium |
| CVE-2026-50700 | Frappe Framework 17.0.0-dev - Stored XSS in frappe.get_avatar image rendering | Frappe Framework | 4.6 (v4.0) | Medium |
| CVE-2026-50710 | Frappe Framework 17.0.0-dev - Stored XSS via eval in Number Card filters_config | Frappe Framework | 4.6 (v4.0) | Medium |
| CVE-2026-53468 | Typemill has Stored HTML Attribute Injection in Metadata Fields | typemill | 4.6 (v3.1) | Medium |
| CVE-2026-56393 | Craft CMS - Multiple Stored Cross-Site Scripting in Settings Names and Field Options | cms | 4.6 (v4.0) | Medium |
| CVE-2026-75331 | tamguo 1.5.3 Cross-Site Scripting Vulnerability | - | 4.6 (v3.1) | Medium |
| CVE-2026-42887 | Audiobookshelf: Stored Cross-Site Scripting in Login Page Custom Message | audiobookshelf | 4.5 (v3.1) | Medium |
| CVE-2025-12034 | Fast Velocity Minify <= 3.5.1 - Authenticated (Admin+) Stored Cross-Site Scripting | Fast Velocity Minify | 4.4 (v3.1) | Medium |
| CVE-2026-0743 | WP Content Permission <= 1.2 - Cross-Site Scripting | WP Content Permission | 4.4 (v3.1) | Medium |
| CVE-2026-10100 | Simple Custom Login Page <= 1.0.3 - Authenticated (Admin+) Stored Cross-Site Scripting | Simple Custom Login Page | 4.4 (v3.1) | Medium |
| CVE-2005-3128 | SquirrelMail Address Add 1.4.2 - Cross-Site Scripting | address add plugin | 4.3 (v2.0) | Medium |
| CVE-2005-4385 | Cofax <=2.0RC3 - Cross-Site Scripting | cofax | 4.3 (v2.0) | Medium |
| CVE-2007-2449 | Apache Tomcat 4.x-7.x - Cross-Site Scripting | tomcat | 4.3 (v2.0) | Medium |
| CVE-2007-5728 | phpPgAdmin <=4.1.1 - Cross-Site Scripting | phppgadmin | 4.3 (v2.0) | Medium |
| CVE-2008-2398 | AppServ Open Project <=2.5.10 - Cross-Site Scripting | appserv | 4.3 (v2.0) | Medium |
| CVE-2008-6465 | Parallels H-Sphere 3.0.0 P9/3.1 P1 - Cross-Site Scripting | h-sphere | 4.3 (v2.0) | Medium |
| CVE-2008-6982 | Devalcms 1.4a - Cross-Site Scripting | devalcms | 4.3 (v2.0) | Medium |
| CVE-2009-1872 | Adobe Coldfusion <=8.0.1 - Cross-Site Scripting | coldfusion | 4.3 (v2.0) | Medium |
| CVE-2011-4624 | GRAND FlAGallery 1.57 - Cross-Site Scripting | grand flagallery | 4.3 (v2.0) | Medium |
| CVE-2011-5106 | WordPress Plugin Flexible Custom Post Type < 0.1.7 - Cross-Site Scripting | flexible custom post type | 4.3 (v2.0) | Medium |
| CVE-2011-5107 | Alert Before Your Post <= 0.1.1 - Cross-Site Scripting | alert before you post | 4.3 (v2.0) | Medium |
| CVE-2011-5265 | Featurific For WordPress 1.6.2 - Cross-Site Scripting | featurific-for-wordpress | 4.3 (v2.0) | Medium |
| CVE-2012-0782 | WordPress Core 3.3.1 - Multiple Vulnerabilities | WordPress | 4.3 (v2.0) | Medium |
| CVE-2012-1835 | WordPress Plugin All-in-One Event Calendar 1.4 - Cross-Site Scripting | all-in-one event calendar | 4.3 (v2.0) | Medium |
| CVE-2012-2371 | WP-FaceThumb 0.1 - Cross-Site Scripting | wp-facethumb | 4.3 (v2.0) | Medium |
| CVE-2012-4242 | WordPress Plugin MF Gig Calendar 0.9.2 - Cross-Site Scripting | mf gig calendar | 4.3 (v2.0) | Medium |
| CVE-2012-4273 | 2 Click Socialmedia Buttons < 0.34 - Cross-Site Scripting | 2-click-social-media-buttons | 4.3 (v2.0) | Medium |
| CVE-2012-4547 | AWStats 6.95/7.0 - 'awredir.pl' Cross-Site Scripting | awstats | 4.3 (v2.0) | Medium |
| CVE-2012-4768 | WordPress Plugin Download Monitor < 3.3.5.9 - Cross-Site Scripting | download monitor | 4.3 (v2.0) | Medium |
| CVE-2012-4889 | ManageEngine Firewall Analyzer 7.2 - Cross-Site Scripting | firewall analyzer | 4.3 (v2.0) | Medium |
| CVE-2012-5684 | ZPanel 10.0.1 - Cross-Site Request Forgery / Cross-Site Scripting / SQL Injection / Password Reset | zpanel | 4.3 (v2.0) | Medium |
| CVE-2012-5913 | WordPress Integrator 1.32 - Cross-Site Scripting | wordpress integrator | 4.3 (v2.0) | Medium |
| CVE-2013-2287 | WordPress Plugin Uploader 1.0.4 - Cross-Site Scripting | uploader | 4.3 (v2.0) | Medium |
| CVE-2013-3526 | WordPress Plugin Traffic Analyzer - 'aoid' Cross-Site Scripting | trafficanalyzer | 4.3 (v2.0) | Medium |
| CVE-2013-4117 | WordPress Plugin Category Grid View Gallery 2.3.1 - Cross-Site Scripting | category-grid-view-gallery | 4.3 (v2.0) | Medium |
| CVE-2013-4341 | Moodle Authenticated Spelling Binary RCE | moodle | 4.3 (v2.0) | Medium |
| CVE-2013-4625 | WordPress Plugin Duplicator < 0.4.5 - Cross-Site Scripting | duplicator | 4.3 (v2.0) | Medium |
| CVE-2013-6042 | Webuzo 2.1.3 - Multiple Vulnerabilities | webuzo | 4.3 (v2.0) | Medium |
| CVE-2014-2908 | Siemens SIMATIC S7-1200 CPU - Cross-Site Scripting | simatic s7 cpu 1200 firmware | 4.3 (v2.0) | Medium |
| CVE-2014-3110 | Honeywell XL Web Controller - Cross-Site Scripting | falcon xlweb linux controller | 4.3 (v2.0) | Medium |
| CVE-2014-4513 | ActiveHelper LiveHelp Server 3.1.0 - Cross-Site Scripting | activehelper livehelp live chat | 4.3 (v2.0) | Medium |
| CVE-2014-9094 | WordPress DZS-VideoGallery Plugin Cross-Site Scripting | video gallery | 4.3 (v2.0) | Medium |
| CVE-2014-9444 | Frontend Uploader <= 0.9.2 - Cross-Site Scripting | frontend uploader | 4.3 (v2.0) | Medium |
| CVE-2015-1389 | Aruba ClearPass Policy Manager - Persistent Cross-Site Scripting | clearpass policy manager | 4.3 (v2.0) | Medium |
| CVE-2015-1880 | Fortinet FortiOS <=5.2.3 - Cross-Site Scripting | fortios | 4.3 (v2.0) | Medium |
| CVE-2015-2068 | Magento Server Mass Importer - Cross-Site Scripting | magmi | 4.3 (v2.0) | Medium |
| CVE-2015-2275 | WoltLab Community Gallery - Persistent Cross-Site Scripting | community gallery | 4.3 (v2.0) | Medium |
| CVE-2015-2807 | Navis DocumentCloud <0.1.1 - Cross-Site Scripting | navis documentcloud | 4.3 (v2.0) | Medium |
| CVE-2015-4127 | WordPress Church Admin <0.810 - Cross-Site Scripting | church admin | 4.3 (v2.0) | Medium |
| CVE-2015-4420 | Opsview 4.6.2 - Multiple Cross-Site Scripting Vulnerabilities | opsview | 4.3 (v2.0) | Medium |
| CVE-2015-4665 | Xceedium Xsuite - Multiple Vulnerabilities | xsuite | 4.3 (v2.0) | Medium |
| CVE-2015-6402 | Cisco EPC 3928 - Multiple Vulnerabilities | epc3928 docsis 3.0 8x4 wireless residential gateway with embedded digital voice adapter | 4.3 (v2.0) | Medium |
| CVE-2015-6920 | WordPress sourceAFRICA <=0.1.3 - Cross-Site Scripting | sourceafrica | 4.3 (v2.0) | Medium |
| CVE-2018-6225 | Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities | email encryption gateway | 4.3 (v3.0) | Medium |
| CVE-2020-7318 | McAfee ePolicy Orchestrator <5.10.9 Update 9 - Cross-Site Scripting | epolicy orchestrator | 4.3 (v3.1) | Medium |
| CVE-2024-34061 | Changedetection.io <=v0.45.21 - Cross-Site Scripting | changedetection.io | 4.3 (v3.1) | Medium |
| CVE-2024-35321 | mynet Cross-Site Scripting Vulnerability | mynet | 4.3 (v3.1) | Medium |
| CVE-2025-41228 | VMware vSphere Client 8.0.3.0 - Reflected Cross-Site Scripting (XSS) | vCenter Server | 4.3 (v3.1) | Medium |
| CVE-2025-9703 | Ultimate Addons for Elementor Lite < 2.5.0 - Author+ Stored XSS | Ultimate Addons for Elementor (Formerly Elementor Header & Footer Builder) | 4.3 (v3.1) | Medium |
| CVE-2026-12724 | Kirki < 6.0.12 - Unauthenticated HTML Injection in Password Reset Email via kirki-forgot-password | Kirki | 4.3 (v3.1) | Medium |
| CVE-2026-32250 | NamelessMC has Reflected Cross-Site Scripting (XSS) in id parameter of /index.php?route=/queries/user/ | Nameless | 4.3 (v3.1) | Medium |
| CVE-2026-55566 | Yamcs: DOM XSS in Extension Routing | yamcs | 4.3 (v3.1) | Medium |
| CVE-2026-102576 | Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page | Red Hat Quay 3 | 4.2 (v3.1) | Medium |
| CVE-2026-55592 | Dashy <= 4.3.6 - Reflected XSS via Workspace | dashy | 3.9 (v3.1) | Low |
| CVE-2026-17011 | Nexter Blocks < 5.0.2 - Contributor+ Stored CSS Injection | Nexter Blocks | 3.8 (v3.1) | Low |
| CVE-2026-113657 | ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS) | apostrophe | 3.7 (v3.1) | Low |
| CVE-2025-66040 | Spotipy has a XSS vulnerability in OAuth callback server | spotipy | 3.6 (v3.1) | Low |
| CVE-2010-4275 | Radius Manager 3.8.0 - Multiple Cross-Site Scripting Vulnerabilities | radius manager | 3.5 (v2.0) | Low |
| CVE-2015-4063 | NewStatPress <0.9.9 - Cross-Site Scripting | newstatpress | 3.5 (v2.0) | Low |
| CVE-2021-25075 | WordPress Duplicate Page or Post <1.5.1 - Cross-Site Scripting | duplicate page or post | 3.5 (v3.1) | Low |
| CVE-2024-7083 | Email Encoder < 2.3.4 - Admin+ Stored XSS | Email Encoder | 3.5 (v3.1) | Low |
| CVE-2025-15677 | GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories | GeoDirectory | 3.5 (v3.1) | Low |
| CVE-2026-10827 | Spectra (Ultimate Addons for Gutenberg) < 2.20.0 - Contributor+ Stored CSS Injection via Block Attributes | Spectra Legacy | 3.5 (v3.1) | Low |
| CVE-2026-13393 | ElementsKit Lite < 3.10.01 - Subsite Administrator+ Stored XSS via Megamenu Menu-Item Settings (Multisite) | ElementsKit Elementor Addons | 3.5 (v3.1) | Low |
| CVE-2026-9060 | Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style | Store Locator WordPress | 3.5 (v3.1) | Low |
| CVE-2026-9061 | Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name | Store Locator WordPress | 3.5 (v3.1) | Low |
| CVE-2026-27937 | October: Reflected XSS via DataTable Form Widget | october | 3.1 (v3.1) | Low |
| CVE-2025-0133 | PAN-OS - Reflected Cross-Site Scripting | PAN-OS | 2.7 (v4.0) | Low |
| CVE-2026-52838 | Easy!Appointments disable_booking_message rendered as raw HTML on public booking page — Stored XSS | easyappointments | 2.6 (v3.1) | Low |
| CVE-2026-91165 | Warpgate: Markup injection in SSO form_post return page via unencoded redirect/error values | warpgate | 2.4 (v3.1) | Low |
| CVE-2026-114127 | Astro: Arbitrary CSS injection in Astro View Transitions | astro | 2.3 (v4.0) | Low |
| CVE-2026-66300 | SNOMED International Snowstorm reflected XSS | Snowstorm | 2.3 (v4.0) | Low |
| CVE-2025-10590 | Portabilis i-Educar educar_usuario_det.php cross site scripting | i-educar | 2.1 (v4.0) | Low |
| CVE-2025-10605 | Portabilis i-Educar agenda_preferencias.php cross site scripting | i-educar | 2.1 (v4.0) | Low |
| CVE-2025-10614 | itsourcecode E-Logbook with Health Monitoring System for COVID-19 print_reports_prev.php cross site scripting | e-logbook with health monitoring system for covid-19 | 2.1 (v4.0) | Low |
| CVE-2025-10710 | 07FLYCMS/07FLY-CMS/07FlyCRM index.php cross site scripting | 07FLYCMS | 2.1 (v4.0) | Low |
| CVE-2025-10711 | 07FLYCMS/07FLY-CMS/07FlyCRM Login cross site scripting | 07FLYCMS | 2.1 (v4.0) | Low |
| CVE-2025-11112 | PHPGurukul Employee Record Management System myprofile.php cross site scripting | employee record management system | 2.1 (v4.0) | Low |
| CVE-2025-11119 | itsourcecode Hostel Management System POST Request index.php cross site scripting | hostel management system | 2.1 (v4.0) | Low |
| CVE-2025-11306 | qianfox FoxCMS Search cross site scripting | foxcms | 2.1 (v4.0) | Low |
| CVE-2025-11512 | code-projects Voting System voters_add.php cross site scripting | voting system | 2.1 (v4.0) | Low |
| CVE-2025-12244 | code-projects Simple E-Banking System register.php cross site scripting | simple e-banking system | 2.1 (v4.0) | Low |
| CVE-2025-12289 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 1001 cross site scripting | Suishang Enterprise-Level B2B2C Multi-User Mall System | 2.1 (v4.0) | Low |
| CVE-2025-12290 | Sui Shang Information Technology Suishang Enterprise-Level B2B2C Multi-User Mall System 359 cross site scripting | Suishang Enterprise-Level B2B2C Multi-User Mall System | 2.1 (v4.0) | Low |
| CVE-2025-12298 | code-projects Simple Food Ordering System editcategory.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low |
| CVE-2025-12299 | code-projects Simple Food Ordering System addproduct.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low |
| CVE-2025-12300 | code-projects Simple Food Ordering System addcategory.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low |
| CVE-2025-12302 | code-projects Simple Food Ordering System editproduct.php cross site scripting | simple food ordering system | 2.1 (v4.0) | Low |
| CVE-2025-13244 | code-projects Student Information System register.php cross site scripting | student information system | 2.1 (v4.0) | Low |
| CVE-2025-14962 | code-projects Simple Stock System chatuser.php cross site scripting | simple stock system | 2.1 (v4.0) | Low |
| CVE-2025-15093 | sunkaifei FlyCMS Admin Login IndexAdminController.java cross site scripting | flycms | 2.1 (v4.0) | Low |
| CVE-2025-15094 | sunkaifei FlyCMS User Login UserController.java userLogin cross site scripting | flycms | 2.1 (v4.0) | Low |
| CVE-2025-15144 | dayrui XunRuiCMS JSONP Callback Init.php dr_exit_msg cross site scripting | xunruicms | 2.1 (v4.0) | Low |
| CVE-2025-15220 | SohuTV CacheCloud LoginController.java init cross site scripting | cachecloud | 2.1 (v4.0) | Low |
| CVE-2025-9647 | mtons mblog list cross site scripting | mblog | 2.1 (v4.0) | Low |
| CVE-2025-9656 | PHPGurukul Directory Management System add-directory.php cross site scripting | directory management system | 2.1 (v4.0) | Low |
| CVE-2025-9773 | RemoteClinic edit.php cross site scripting | remote clinic | 2.1 (v4.0) | Low |
| CVE-2026-0586 | code-projects Online Product Reservation System prod.php cross site scripting | online product reservation system | 2.1 (v4.0) | Low |
| CVE-2026-100313 | mathurvishal CloudClassroom-PHP-Project updatequery.php cross site scripting | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low |
| CVE-2026-100877 | mathurvishal CloudClassroom-PHP-Project registrationform.php cross site scripting | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low |
| CVE-2026-10153 | westboy CicadasCMS AbstractCacheManager.java search cross site scripting | CicadasCMS | 2.1 (v4.0) | Low |
| CVE-2026-10173 | Orthanc Explorer 2 URL StudyList.vue cross site scripting | Explorer 2 | 2.1 (v4.0) | Low |
| CVE-2026-102366 | mall4j through 4.0 Unrestricted File Upload in Admin File Endpoints | mall4j | 2.1 (v4.0) | Low |
| CVE-2026-10289 | code-projects Hotel and Tourism Reservation System tour.php cross site scripting | Hotel and Tourism Reservation System | 2.1 (v4.0) | Low |
| CVE-2026-105288 | feelec-yishu feelcrm-os Crm Endpoint functions.php index cross site scripting | feelcrm-os | 2.1 (v4.0) | Low |
| CVE-2026-105291 | feelec-yishu feelcrm-os Department Search Endpoint GroupController.class.php index cross site scripting | feelcrm-os | 2.1 (v4.0) | Low |
| CVE-2026-105705 | SourceCodester Drug Recommendation System add_drug.php cross site scripting | Drug Recommendation System | 2.1 (v4.0) | Low |
| CVE-2026-105708 | imgproxy SVG svg.go sanitizeElement cross site scripting | imgproxy | 2.1 (v4.0) | Low |
| CVE-2026-105809 | SourceCodester Simple Student Information System Profile Field register.php cross site scripting | Simple Student Information System | 2.1 (v4.0) | Low |
| CVE-2026-108931 | Netcore NR268 DHCP dhcp_dynamicip_show.cgi eval cross site scripting | NR268 | 2.1 (v4.0) | Low |
| CVE-2026-108932 | Netcore NR268 DHCP Hostname filter_hosts_dump.cgi eval cross site scripting | NR268 | 2.1 (v4.0) | Low |
| CVE-2026-110627 | ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter | clipbucket-v5 | 2.1 (v4.0) | Low |
| CVE-2026-111877 | dext34-morgan Books4Cash search.php cross site scripting | Books4Cash | 2.1 (v4.0) | Low |
| CVE-2026-111942 | hrisikeshpal Blood_Bank_Management_System abs.php cross site scripting | Blood Bank Management System | 2.1 (v4.0) | Low |
| CVE-2026-111984 | AUTOMATIC1111 stable-diffusion-webui Card Builder ui_extra_networks.py create_item_html cross site scripting | stable-diffusion-webui | 2.1 (v4.0) | Low |
| CVE-2026-112093 | subhajitkhan online-clinic-management-system feedback.php cross site scripting | online-clinic-management-system | 2.1 (v4.0) | Low |
| CVE-2026-11337 | tittuvarghese CollegeManagementSystem fetch.php cross site scripting | CollegeManagementSystem | 2.1 (v4.0) | Low |
| CVE-2026-113741 | itsourcecode Online Cake Ordering System 404.php cross site scripting | Online Cake Ordering System | 2.1 (v4.0) | Low |
| CVE-2026-11436 | Mage AI Sign-in Flow index.tsx useMutation cross site scripting | Mage AI | 2.1 (v4.0) | Low |
| CVE-2026-11512 | itsourcecode Hospital Management System billing.php cross site scripting | Hospital Management System | 2.1 (v4.0) | Low |
| CVE-2026-11518 | SourceCodester Inventory System User Management users.php cross site scripting | Inventory System | 2.1 (v4.0) | Low |
| CVE-2026-115534 | gedelumbung HospitalManagement Contact Form contact.php kirim cross site scripting | HospitalManagement | 2.1 (v4.0) | Low |
| CVE-2026-115982 | phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting | phpIPAM | 2.1 (v4.0) | Low |
| CVE-2026-116047 | Privoce Vocechat Query Parameter widget.html cross site scripting | Vocechat | 2.1 (v4.0) | Low |
| CVE-2026-116097 | CloudClassroom-PHP-Project addnewstudent.php cross site scripting | CloudClassroom-PHP-Project | 2.1 (v4.0) | Low |
| CVE-2026-13499 | yashpokharna2555 restaurent-management-system Registration login_register.php cross site scripting | restaurent-management-system | 2.1 (v4.0) | Low |
| CVE-2026-13554 | itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting | Online Hotel Management System | 2.1 (v4.0) | Low |
| CVE-2026-13556 | itsourcecode Online Hotel Management System POST Request controller.php edit cross site scripting | Online Hotel Management System | 2.1 (v4.0) | Low |
| CVE-2026-13557 | itsourcecode Online Hotel Management System POST Request controller.php add cross site scripting | Online Hotel Management System | 2.1 (v4.0) | Low |
| CVE-2026-13567 | code-projects Online Music Site POST Request Feedback.php cross site scripting | Online Music Site | 2.1 (v4.0) | Low |
| CVE-2026-14634 | kirilkirkov Ecommerce-CodeIgniter-Bootstrap Subscribed Emails Admin MY_Controller.php checkForPostRequests cross site sc | Ecommerce-CodeIgniter-Bootstrap | 2.1 (v4.0) | Low |
| CVE-2026-14656 | code-projects Assessment Management remove-user.php cross site scripting | Assessment Management | 2.1 (v4.0) | Low |
| CVE-2026-14704 | stephen-kruger bluebox cross site scripting | bluebox | 2.1 (v4.0) | Low |
| CVE-2026-15595 | SourceCodester Class and Exam Timetabling System forsubject.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-15596 | SourceCodester Class and Exam Timetabling System subject.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-15715 | SourceCodester Class and Exam Timetabling System exam.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-16220 | code-projects Online Examination System account.php cross site scripting | Online Examination System | 2.1 (v4.0) | Low |
| CVE-2026-16485 | SourceCodester Class and Exam Timetabling System class.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-16486 | SourceCodester Class and Exam Timetabling System BSIS.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-18968 | ttttonyhe OBlog tags.php cross site scripting | OBlog | 2.1 (v4.0) | Low |
| CVE-2026-19378 | code-projects Task Management System CommentSave.php cross site scripting | Task Management System | 2.1 (v4.0) | Low |
| CVE-2026-19998 | code-projects Online Shopping System offersmail.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low |
| CVE-2026-5255 | code-projects Simple Laundry System Parameter delstaffinfo.php cross site scripting | simple laundry system | 2.1 (v4.0) | Low |
| CVE-2026-5825 | code-projects Simple Laundry System delmemberinfo.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-5826 | code-projects Simple IT Discussion Forum edit-category.php cross site scripting | Simple IT Discussion Forum | 2.1 (v4.0) | Low |
| CVE-2026-59727 | Astro: Cross-site scripting via unescaped transition:* directive values on hydrated islands | astro | 2.1 (v4.0) | Low |
| CVE-2026-6032 | code-projects Simple Laundry System checkcheckout.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-6035 | code-projects Vehicle Showroom Management System ServiceAndSalesReport.php cross site scripting | Vehicle Showroom Management System | 2.1 (v4.0) | Low |
| CVE-2026-6150 | code-projects Simple Laundry System checkupdatestatus.php cross site scripting | Simple Laundry System | 2.1 (v4.0) | Low |
| CVE-2026-66882 | Reflected XSS in AshAuthentication confirmation and magic link interaction forms | ash authentication | 2.1 (v4.0) | Low |
| CVE-2026-7089 | code-projects Home Service System Appointment Booking booking.php cross site scripting | Home Service System | 2.1 (v4.0) | Low |
| CVE-2026-7116 | code-projects Employee Management System mark.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-7129 | SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting | Pharmacy Sales and Inventory System | 2.1 (v4.0) | Low |
| CVE-2026-7401 | SourceCodester CET Automated Grading System with AI Predictive Analytics Registration index.php register cross site scri | CET Automated Grading System with AI Predictive Analytics | 2.1 (v4.0) | Low |
| CVE-2026-75077 | SourceCodester Class and Exam Timetabling System BSCE2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-75078 | SourceCodester Class and Exam Timetabling System BSHRM1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78054 | SourceCodester Class and Exam Timetabling System BSIS1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78055 | SourceCodester Class and Exam Timetabling System BSIT2.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-78059 | SourceCodester Stock Management System printOrder.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low |
| CVE-2026-78060 | SourceCodester Stock Management System getOrderReport.php cross site scripting | Stock Management System | 2.1 (v4.0) | Low |
| CVE-2026-79793 | code-projects Online Shopping System sumit_form.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low |
| CVE-2026-82601 | SeaCMS err.php cross site scripting | SeaCMS | 2.1 (v4.0) | Low |
| CVE-2026-82625 | code-projects Simple Inventory System User Registration register.php cross site scripting | Simple Inventory System | 2.1 (v4.0) | Low |
| CVE-2026-82664 | yaojingang GEOFlow JSON-LD Theme HomeController.php cross site scripting | GEOFlow | 2.1 (v4.0) | Low |
| CVE-2026-82700 | code-projects Online Shopping System Newsletter Subscription offersmail.php cross site scripting | Online Shopping System | 2.1 (v4.0) | Low |
| CVE-2026-85021 | langgenius dify Splash Layout splash.tsx router.replace cross site scripting | dify | 2.1 (v4.0) | Low |
| CVE-2026-85382 | light0011 cms Chapter Content Output oneChapter.tpl htmlspecialchars_decode cross site scripting | cms | 2.1 (v4.0) | Low |
| CVE-2026-86216 | code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting | Hotel and Tourism Reservation in PHP | 2.1 (v4.0) | Low |
| CVE-2026-86244 | FastAdmin User Controller User.php login cross site scripting | FastAdmin | 2.1 (v4.0) | Low |
| CVE-2026-86668 | aircheng-org iWebShop-5 pic.php uploadFile cross site scripting | iWebShop-5 | 2.1 (v4.0) | Low |
| CVE-2026-90615 | SourceCodester Class and Exam Timetabling System subject1.php cross site scripting | Class and Exam Timetabling System | 2.1 (v4.0) | Low |
| CVE-2026-91854 | code-projects Record Management System reg.php cross site scripting | Record Management System | 2.1 (v4.0) | Low |
| CVE-2026-94035 | SourceCodester Drug Recommendation System index.php cross site scripting | Drug Recommendation System | 2.1 (v4.0) | Low |
| CVE-2026-9415 | code-projects Employee Management System eloginwel.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9416 | code-projects Employee Management System myprofile.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9417 | code-projects Employee Management System myprofileup.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9418 | code-projects Employee Management System changepassemp.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9419 | code-projects Employee Management System empproject.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9448 | code-projects Employee Management System applyleave.php cross site scripting | Employee Management System | 2.1 (v4.0) | Low |
| CVE-2026-9518 | hemant6488 CodeIgniter-StudentManagementSystem Students Controller view_students.php addStudent cross site scripting | CodeIgniter-StudentManagementSystem | 2.1 (v4.0) | Low |
| CVE-2026-9519 | stonith404 pingvin-share Sign-in Auto-Redirect signIn.tsx getServerSideProps cross site scripting | pingvin-share | 2.1 (v4.0) | Low |
| CVE-2026-9520 | blitz-js blitz Sign-in LoginForm.tsx cross site scripting | blitz | 2.1 (v4.0) | Low |
| CVE-2026-9527 | itsourcecode Electronic Judging System judges.php cross site scripting | Electronic Judging System | 2.1 (v4.0) | Low |
| CVE-2026-9566 | teableio teable Sign-up LoginPage.tsx cross site scripting | teable | 2.1 (v4.0) | Low |
| CVE-2023-4547 | SPA-Cart eCommerce CMS 1.9.0.3 - Cross-Site Scripting | ecommerce cms | 2.0 (v4.0) | Low |
| CVE-2025-10074 | Portabilis i-Educar tipos cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-10117 | SourceCodester Simple To-Do List System Add New Task fetch_tasks.php cross site scripting | simple to-do list system | 2.0 (v4.0) | Low |
| CVE-2025-10584 | Portabilis i-Educar educar_calendario_anotacao_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-10591 | Portabilis i-Educar Editar Função educar_funcao_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-10837 | code-projects Simple Food Ordering System order.php cross site scripting | simple food ordering system | 2.0 (v4.0) | Low |
| CVE-2025-11124 | code-projects Project Monitoring System postjob.php cross site scripting | project monitoring system | 2.0 (v4.0) | Low |
| CVE-2025-11308 | Vanderlande Baggage 360 messages cross site scripting | Baggage 360 | 2.0 (v4.0) | Low |
| CVE-2025-11332 | CmsEasy URL view.php cross site scripting | cmseasy | 2.0 (v4.0) | Low |
| CVE-2025-11421 | code-projects Voting System candidates_edit.php cross site scripting | voting system | 2.0 (v4.0) | Low |
| CVE-2025-11433 | itsourcecode Leave Management System Query Parameter controller.php redirect cross site scripting | leave management system | 2.0 (v4.0) | Low |
| CVE-2025-11851 | Apeman ID71 set_alias.cgi cross site scripting | ID71 | 2.0 (v4.0) | Low |
| CVE-2025-11946 | LogicalDOC Community Edition Add Contact frontend.jsp cross site scripting | logicaldoc | 2.0 (v4.0) | Low |
| CVE-2025-12224 | Iqbolshoh php-business-website contact.php cross site scripting | php-business-website | 2.0 (v4.0) | Low |
| CVE-2025-12227 | projectworlds Gate Pass Management System add-pass.php cross site scripting | gate pass management system | 2.0 (v4.0) | Low |
| CVE-2025-13178 | Bdtask/CodeCanyon SalesERP User Profile edit_profile cross site scripting | saleserp | 2.0 (v4.0) | Low |
| CVE-2025-13180 | Bdtask/CodeCanyon Wholesale Inventory Control and Inventory Management System edit_profile cross site scripting | wholesale | 2.0 (v4.0) | Low |
| CVE-2025-13181 | pojoin h3blog add cross site scripting | h3blog | 2.0 (v4.0) | Low |
| CVE-2025-13182 | pojoin h3blog addtitle cross site scripting | h3blog | 2.0 (v4.0) | Low |
| CVE-2025-13245 | code-projects Student Information System editprofile.php cross site scripting | student information system | 2.0 (v4.0) | Low |
| CVE-2025-13343 | SourceCodester Interview Management System editQuestion.php cross site scripting | interview management system | 2.0 (v4.0) | Low |
| CVE-2025-13450 | SourceCodester Online Shop Project register.php cross site scripting | online shop project | 2.0 (v4.0) | Low |
| CVE-2025-14006 | dayrui XunRuiCMS Add Data Validation admind45f74adbd95.php cross site scripting | xunruicms | 2.0 (v4.0) | Low |
| CVE-2025-14194 | code-projects Employee Profile Management System view_personnel.php cross site scripting | employee profile management system | 2.0 (v4.0) | Low |
| CVE-2025-14538 | yangshare warehouseManager 仓库管理系统 CustomerManageHandler.java addCustomer cross site scripting | warehouseManager 仓库管理系统 | 2.0 (v4.0) | Low |
| CVE-2025-15052 | code-projects Student Information System profile.php cross site scripting | student information system | 2.0 (v4.0) | Low |
| CVE-2025-15134 | yourmaileyes MOOC Submission MainController.java subreview cross site scripting | MOOC | 2.0 (v4.0) | Low |
| CVE-2025-15171 | SohuTV CacheCloud ServerController.java index cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15172 | SohuTV CacheCloud RedisConfigTemplateController.java preview cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15173 | SohuTV CacheCloud InstanceController.java advancedAnalysis cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15174 | SohuTV CacheCloud AppManageController.java doAppAuditList cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15175 | SohuTV CacheCloud AppController.java appCommandAnalysis cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15201 | SohuTV CacheCloud WebResourceController.java redirectNoPower cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15219 | SohuTV CacheCloud MachineManageController.java doPodList cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-15221 | SohuTV CacheCloud AppDataMigrateController.java index cross site scripting | cachecloud | 2.0 (v4.0) | Low |
| CVE-2025-32785 | Pi-hole Admin Interface vulnerable to persistent XSS on Subscribed lists group management (Adress Field) | web interface | 2.0 (v4.0) | Low |
| CVE-2025-62653 | Stored XSS through system messages in PollNY | MediaWiki PollNY extension | 2.0 (v4.0) | Low |
| CVE-2025-7872 | Portabilis i-Diario justificativas-de-falta cross site scripting | i-diario | 2.0 (v4.0) | Low |
| CVE-2025-8786 | Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting | i-diario | 2.0 (v4.0) | Low |
| CVE-2025-8787 | Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting | i-diario | 2.0 (v4.0) | Low |
| CVE-2025-9646 | O2OA calendarConfig cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9652 | Portabilis i-Educar Cadastrar tipo de transferência educar_transferencia_tipo_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-9653 | Portabilis i-Educar Cadastrar projeto educar_projeto_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-9657 | O2OA Personal Profile script cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9658 | O2OA Personal Profile dict cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9659 | O2OA Personal Profile widget cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9680 | O2OA Personal Profile page cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9681 | O2OA Personal Profile agent cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9682 | O2OA Personal Profile appdict cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9683 | O2OA Personal Profile form cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9715 | O2OA Personal Profile script cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9716 | O2OA Personal Profile form cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9717 | O2OA Personal Profile unit cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9718 | O2OA Personal Profile process cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9719 | O2OA Personal Profile script cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9721 | Portabilis i-Educar edit cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-9722 | Portabilis i-Educar educar_tipo_ocorrencia_disciplinar_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-9723 | Portabilis i-Educar educar_tipo_regime_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2025-9734 | O2OA Personal Profile stat cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9735 | O2OA Personal Profile table cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9736 | O2OA Personal Profile statement cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9737 | O2OA Personal Profile importmodel cross site scripting | o2oa | 2.0 (v4.0) | Low |
| CVE-2025-9738 | Portabilis i-Educar educar_tipo_ensino_cad.php cross site scripting | i-educar | 2.0 (v4.0) | Low |
| CVE-2026-0588 | Xinhu Rainrock RockOA API rockfun.php cross site scripting | rockoa | 2.0 (v4.0) | Low |
| CVE-2026-100880 | zhistaredu StarTraining Upload Endpoint MimeTypeUtils.java cross site scripting | StarTraining | 2.0 (v4.0) | Low |
| CVE-2026-101141 | Eleveo Call Recording Software Play Audio audio.jsp cross site scripting | Call Recording Software | 2.0 (v4.0) | Low |
| CVE-2026-102264 | mwasikz robo-cafe-rms Edit Profile Feature update-account.php cross site scripting | robo-cafe-rms | 2.0 (v4.0) | Low |
| CVE-2026-10228 | raisulislamg4 student_management_system_by_php admission_form_check.php cross site scripting | student management system by php | 2.0 (v4.0) | Low |
| CVE-2026-10234 | Mettle sendportal Campaign webview cross site scripting | sendportal | 2.0 (v4.0) | Low |
| CVE-2026-10244 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10245 | SourceCodester Pharmacy Sales and Inventory System main create_supplier cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10246 | SourceCodester Pharmacy Sales and Inventory System main create_medicine_presentation cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-10247 | SourceCodester Pharmacy Sales and Inventory System main create_generic_name cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-105289 | feelec-yishu feelcrm-os Create Customer Endpoint CrmDefineFormModel.class.php htmlspecialchars_decode cross site scripti | feelcrm-os | 2.0 (v4.0) | Low |
| CVE-2026-105808 | SourceCodester Simple Student Information System searchresults.php clean cross site scripting | Simple Student Information System | 2.0 (v4.0) | Low |
| CVE-2026-112096 | SourceCodester Inventory System Purchase Records transactions_handler.php save_purchase cross site scripting | Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-116385 | Bdtask Garage 24 Garage Management Software Profile edit_profile cross site scripting | Garage 24 Garage Management Software | 2.0 (v4.0) | Low |
| CVE-2026-116482 | subhajitkhan online-clinic-management-system patientregistration.php cross site scripting | online-clinic-management-system | 2.0 (v4.0) | Low |
| CVE-2026-116639 | MD-MAFUJUL-HASAN Online-Payroll-Management-System chat.php cross site scripting | Online-Payroll-Management-System | 2.0 (v4.0) | Low |
| CVE-2026-116640 | Saruf-Ratul HR-Payroll-Management-System chat.php cross site scripting | HR-Payroll-Management-System | 2.0 (v4.0) | Low |
| CVE-2026-15678 | code-projects Online Job Portal DetailJob.php cross site scripting | Online Job Portal | 2.0 (v4.0) | Low |
| CVE-2026-16155 | SourceCodester Class and Exam Timetabling System schoolyr.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16156 | SourceCodester Class and Exam Timetabling System forexam.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16202 | SourceCodester Class and Exam Timetabling System CYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-16203 | SourceCodester Class and Exam Timetabling System forCYS.php cross site scripting | Class and Exam Timetabling System | 2.0 (v4.0) | Low |
| CVE-2026-19922 | code-projects Online Shopping System checkout.php cross site scripting | Online Shopping System | 2.0 (v4.0) | Low |
| CVE-2026-5810 | SourceCodester Sales and Inventory System GET Parameter delete.php cross site scripting | Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-6162 | PHPGurukul Company Visitor Management System bwdates-reports-details.php cross site scripting | Company Visitor Management System | 2.0 (v4.0) | Low |
| CVE-2026-6493 | lukevella rallly Reset Password reset-password-form.tsx cross site scripting | rallly | 2.0 (v4.0) | Low |
| CVE-2026-7222 | code-projects Coaching Management System Complaint Form complaint.php cross site scripting | Coaching Management System | 2.0 (v4.0) | Low |
| CVE-2026-7390 | SourceCodester Pharmacy Sales and Inventory System index.php customer cross site scripting | Pharmacy Sales and Inventory System | 2.0 (v4.0) | Low |
| CVE-2026-8139 | Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName | concrete cms | 2.0 (v4.0) | Low |
| CVE-2026-82483 | coppermine-gallery Coppermine Photo Gallery Hidden Album Update Endpoint db_input.php cross site scripting | Coppermine Photo Gallery | 2.0 (v4.0) | Low |
| CVE-2026-82488 | Beetel 450TC3 User Management cross site scripting | 450TC3 | 2.0 (v4.0) | Low |
| CVE-2026-82622 | code-projects Employee Leave Managing System Employee Profile Update editaction.php cross site scripting | Employee Leave Managing System | 2.0 (v4.0) | Low |
| CVE-2026-82665 | yaojingang GEOFlow Image Library Cleanup ImageLibraryController.php unlink path traversal | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82666 | yaojingang GEOFlow Superadmin Theme Editor SiteThemeEditorController.php preview code injection | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-82667 | yaojingang GEOFlow GenericHttpEndpointResolver.php DistributionController.isValidHttpEndpoint server-side request forger | GEOFlow | 2.0 (v4.0) | Low |
| CVE-2026-84437 | OpenCart Autocomplete Workflow address.php cross site scripting | OpenCart | 2.0 (v4.0) | Low |
| CVE-2026-84438 | OpenCart Autocomplete Workflow edit.php cross site scripting | OpenCart | 2.0 (v4.0) | Low |
| CVE-2026-85022 | langgenius dify WebApp Sign-In mail-and-password-auth.tsx router.replace cross site scripting | dify | 2.0 (v4.0) | Low |
| CVE-2026-85207 | itsourcecode Online Medicine Delivery System index.php cross site scripting | Online Medicine Delivery System | 2.0 (v4.0) | Low |
| CVE-2026-86181 | code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting | Task Management System | 2.0 (v4.0) | Low |
| CVE-2026-86301 | code-projects Hospital Information System Patient Management editPatient.php cross site scripting | Hospital Information System | 2.0 (v4.0) | Low |
| CVE-2026-86644 | star7th showdoc API Page Save Endpoint editormd.js cross site scripting | showdoc | 2.0 (v4.0) | Low |
| CVE-2026-90489 | Xuxueli xxl-job insert cross site scripting | xxl-job | 2.0 (v4.0) | Low |
| CVE-2026-90694 | SourceCodester Inventory Management System Customer Management customers_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low |
| CVE-2026-90695 | SourceCodester Inventory Management System Vendor Management vendors_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low |
| CVE-2026-90696 | SourceCodester Inventory Management System Product Management products_handler.php cross site scripting | Inventory Management System | 2.0 (v4.0) | Low |
| CVE-2026-90845 | PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting | Daily Expense Tracker System | 2.0 (v4.0) | Low |
| CVE-2026-92418 | ChangeWeDer crm Save Endpoint customer.serve.js cross site scripting | crm | 2.0 (v4.0) | Low |
| CVE-2026-93977 | code-projects Assessment Management add-single-mark.php cross site scripting | Assessment Management | 2.0 (v4.0) | Low |
| CVE-2026-94033 | SourceCodester Drug Recommendation System User Management add_user cross site scripting | Drug Recommendation System | 2.0 (v4.0) | Low |
| CVE-2026-94034 | SourceCodester Drug Recommendation System Password Change change_password cross site scripting | Drug Recommendation System | 2.0 (v4.0) | Low |
| CVE-2026-94145 | xuxueli xxl-job Task Management JobInfoController.java cross site scripting | xxl-job | 2.0 (v4.0) | Low |
| CVE-2026-94426 | xuxueli xxl-job insert cross site scripting | xxl-job | 2.0 (v4.0) | Low |
| CVE-2026-96810 | huanzi-qch base-admin Add User CommonController.java save cross site scripting | base-admin | 2.0 (v4.0) | Low |
| CVE-2025-10099 | Portabilis i-Educar Editar usuário educar_usuario_cad.php cross site scripting | i-educar | 1.9 (v4.0) | Low |
| CVE-2025-10234 | Scada-LTS Data Point Edit data_point_edit.shtm cross site scripting | scada-lts | 1.9 (v4.0) | Low |
| CVE-2025-10235 | Scada-LTS Reports reports.shtm cross site scripting | scada-lts | 1.9 (v4.0) | Low |
| CVE-2025-10434 | IbuyuCMS Add Article article.php cross site scripting | IbuyuCMS | 1.9 (v4.0) | Low |
| CVE-2025-11027 | givanz Vvveb SVG File cross site scripting | vvveb | 1.9 (v4.0) | Low |
| CVE-2025-11068 | westboy CicadasCMS save cross site scripting | cicadascms | 1.9 (v4.0) | Low |
| CVE-2025-11069 | westboy CicadasCMS Add Department save cross site scripting | cicadascms | 1.9 (v4.0) | Low |
| CVE-2025-11289 | westboy CicadasCMS Template Management TemplateFileServiceImpl.java save cross site scripting | cicadascms | 1.9 (v4.0) | Low |
| CVE-2025-11425 | projectworlds Advanced Library Management System edit_admin.php cross site scripting | advanced library management system | 1.9 (v4.0) | Low |
| CVE-2025-11485 | SourceCodester Student Grades Management System Manage Users admin.php add_user cross site scripting | student grades management system | 1.9 (v4.0) | Low |
| CVE-2025-12228 | projectworlds Expense Management System Users Page create cross site scripting | expense management system | 1.9 (v4.0) | Low |
| CVE-2025-12229 | projectworlds Expense Management System Roles Page create cross site scripting | expense management system | 1.9 (v4.0) | Low |
| CVE-2025-12230 | projectworlds Expense Management System Currency create cross site scripting | expense management system | 1.9 (v4.0) | Low |
| CVE-2025-12231 | projectworlds Expense Management System Expense Categories create cross site scripting | expense management system | 1.9 (v4.0) | Low |
| CVE-2025-12303 | PHPGurukul Curfew e-Pass Management System admin-profile.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low |
| CVE-2025-12311 | PHPGurukul Curfew e-Pass Management System edit-category-detail.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low |
| CVE-2025-12312 | PHPGurukul Curfew e-Pass Management System view-pass-detail.php cross site scripting | curfew e-pass management system | 1.9 (v4.0) | Low |
| CVE-2025-12332 | SourceCodester Student Grades Management System admin.php delete_user cross site scripting | student grades management system | 1.9 (v4.0) | Low |
| CVE-2025-12920 | qianfox FoxCMS Product.php edit cross site scripting | foxcms | 1.9 (v4.0) | Low |
| CVE-2025-13186 | Bdtask/CodeCanyon Isshue Multi Store eCommerce Shopping Cart Solution manage_customer cross site scripting | isshue | 1.9 (v4.0) | Low |
| CVE-2025-14991 | Campcodes Complete Online Beauty Parlor Management System bwdates-reports-details.php cross site scripting | complete online beauty parlor management system | 1.9 (v4.0) | Low |
| CVE-2025-15145 | SohuTV CacheCloud TotalManageController.java doTotalList cross site scripting | cachecloud | 1.9 (v4.0) | Low |
| CVE-2025-15146 | SohuTV CacheCloud UserManageController.java doUserList cross site scripting | cachecloud | 1.9 (v4.0) | Low |
| CVE-2025-15188 | Campcodes Complete Online Beauty Parlor Management System search-invoices.php cross site scripting | online beauty parlor management system | 1.9 (v4.0) | Low |
| CVE-2025-15200 | SohuTV CacheCloud AppClientDataShowController.java doIndex cross site scripting | cachecloud | 1.9 (v4.0) | Low |
| CVE-2025-15202 | SohuTV CacheCloud TaskController.java taskQueueList cross site scripting | cachecloud | 1.9 (v4.0) | Low |
| CVE-2025-15203 | SohuTV CacheCloud ResourceController.java index cross site scripting | cachecloud | 1.9 (v4.0) | Low |
| CVE-2025-15214 | Campcodes Park Ticketing System admin_class.php save_pricing cross site scripting | park ticketing system | 1.9 (v4.0) | Low |
| CVE-2025-15416 | xnx3 wangmarket Add Global Variable save.do cross site scripting | wangmarket | 1.9 (v4.0) | Low |
| CVE-2025-8538 | Portabilis i-Educar novo cross site scripting | i-educar | 1.9 (v4.0) | Low |
| CVE-2025-8539 | Portabilis i-Educar public_distrito_cad.php cross site scripting | i-educar | 1.9 (v4.0) | Low |
| CVE-2026-0642 | projectworlds House Rental and Property Listing complaint.php cross site scripting | house rental and property listing project | 1.9 (v4.0) | Low |
| CVE-2026-10112 | sambitraj STUDENT-MANAGEMENT-SYSTEM Dashboard cross site scripting | STUDENT-MANAGEMENT-SYSTEM | 1.9 (v4.0) | Low |
| CVE-2026-10529 | westboy CicadasCMS Task Scheduling Management ScheduleJobController.java cross site scripting | CicadasCMS | 1.9 (v4.0) | Low |
| CVE-2026-108908 | Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting | NR268 | 1.9 (v4.0) | Low |
| CVE-2026-112039 | diem-project diem Administrative Console actions.class.php append cross site scripting | diem | 1.9 (v4.0) | Low |
| CVE-2026-11468 | SourceCodester Hospitals Patient Records Management System page room_types cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-115535 | gedelumbung HospitalManagement Settings sistem.php simpan cross site scripting | HospitalManagement | 1.9 (v4.0) | Low |
| CVE-2026-115981 | phpIPAM index.php cross site scripting | phpIPAM | 1.9 (v4.0) | Low |
| CVE-2026-116100 | gougucms User Level Level.php add cross site scripting | gougucms | 1.9 (v4.0) | Low |
| CVE-2026-14655 | code-projects Assessment Management view-users.php cross site scripting | Assessment Management | 1.9 (v4.0) | Low |
| CVE-2026-16205 | Pluck CMS Albums albums.admin.php htmlspecialchars_decode cross site scripting | CMS | 1.9 (v4.0) | Low |
| CVE-2026-19110 | DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting | DataGear | 1.9 (v4.0) | Low |
| CVE-2026-19207 | PHPGurukul Company Visitor Management System manage-newvisitors.php cross site scripting | Company Visitor Management System | 1.9 (v4.0) | Low |
| CVE-2026-6184 | code-projects Simple Content Management System welcome.php cross site scripting | Simple Content Management System | 1.9 (v4.0) | Low |
| CVE-2026-6624 | BichitroGan ISP Billing Software Pool List add cross site scripting | ISP Billing Software | 1.9 (v4.0) | Low |
| CVE-2026-6995 | BDCOM P3310D New User index.asp cross site scripting | P3310D | 1.9 (v4.0) | Low |
| CVE-2026-7269 | SourceCodester Pharmacy Sales and Inventory System index.php cross site scripting | Pharmacy Sales and Inventory System | 1.9 (v4.0) | Low |
| CVE-2026-7281 | SourceCodester Pharmacy Sales and Inventory System index.php supplier cross site scripting | Pharmacy Sales and Inventory System | 1.9 (v4.0) | Low |
| CVE-2026-8136 | SourceCodester Pharmacy Sales and Inventory System index.php users cross site scripting | Pharmacy Sales and Inventory System | 1.9 (v4.0) | Low |
| CVE-2026-90850 | PHPGurukul Hostel Management System manage-students.php cross site scripting | Hostel Management System | 1.9 (v4.0) | Low |
| CVE-2026-93975 | code-projects Assessment Management User Editing edit-user.php cross site scripting | Assessment Management | 1.9 (v4.0) | Low |
| CVE-2026-93976 | code-projects Assessment Management add-user.php cross site scripting | Assessment Management | 1.9 (v4.0) | Low |
| CVE-2026-94016 | SourceCodester Drug Recommendation System add_symptom cross site scripting | Drug Recommendation System | 1.9 (v4.0) | Low |
| CVE-2026-94150 | Omega Solution HRM OS SVG File Upload view cross site scripting | HRM OS | 1.9 (v4.0) | Low |
| CVE-2026-9564 | SourceCodester/oretnom23 Hospitals Patient Records Management System view_patient cross site scripting | Hospitals Patient Records Management System | 1.9 (v4.0) | Low |
| CVE-2026-9608 | QianFox FoxCMS Administrator Backend edit cross site scripting | FoxCMS | 1.9 (v4.0) | Low |
| CVE-2025-15454 | zhanglun lettura RSS ContentRender.tsx cross site scripting | lettura | 1.3 (v4.0) | Low |
| CVE-2026-78187 | Piwigo Public Authentication cross site scripting | Piwigo | 1.3 (v4.0) | Low |
| CVE-2025-14007 | dayrui XunRuiCMS Domain Name Binding admin79f2ec220c7e.php cross site scripting | xunruicms | 1.1 (v4.0) | Low |
| CVE-2023-46391 | WEBIGniter v28.7.23 - Stored Cross Site Scripting (XSS) | - | N/A | N/A |
| CVE-2024-30850 | Chaos RAT XSS to RCE | - | N/A | N/A |
| CVE-2026-58038 | Stored XSS through javascript URLs in SVGs generated by EasyTimeline | mediawiki | 0.0 (v4.0) | None |
Observed CWEs
These CWEs are recorded on published CVEs in the selected observations associated with this rule. They are observational relationships, not a claim that the rule universally blocks every vulnerability assigned to a CWE.