Search: xss.is

A cross-site scripting (XSS) vulnerability identified as CVE-2026-114538 affects Microsoft product version 3.0. The vulnerability is categorized as moderately critical and relates to the Bootstrap component. No CVSS score or detailed technical impact information is provided.

A stored cross-site scripting (XSS) vulnerability exists in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin versions from 5.16.2 up to but not including 5.16.5. The plugin does not properly escape certain customer-supplied order fields, such as billing and shipping addresses and customer order notes, in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to inject malicious scripts that execute when a shop administrator views these documents.

AdminNeo versions prior to 5.5.1 are vulnerable to a cross-site scripting (XSS) attack due to unsanitized insertion of the MySQL server version string into a script tag with a valid Content Security Policy (CSP) nonce. An attacker controlling a reachable MySQL server can craft a malicious version string that breaks out of the JavaScript context and executes arbitrary code in the victim's browser. This vulnerability requires no authentication when combined with login CSRF. A fix is available in version 5.5.1.

A Cross-site Scripting (XSS) vulnerability exists in phoenix_html, a component of the Phoenix Framework, due to improper neutralization of input during web page generation. The vulnerability arises because attribute names are not properly escaped, allowing an attacker controlling attribute names to inject malicious attributes and scripts into rendered HTML. This affects phoenix_html versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0. The issue occurs when untrusted input is used to build attribute keys rendered through HEEx <tag {@attrs}>, content_tag/3, or direct calls. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits in the wild or patch information is provided.

WIT SynApps Runtime versions through 1.4.11 have a pre-authentication reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Exploitation can lead to credential harvesting, manipulation of the login process, access to browser-visible data, and same-origin requests to internal controller endpoints, including origin-switching in Cloud RIA scenarios.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in All In One Login versions up to and including 2.4.1. This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser without requiring authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in BA Book Everything versions up to and including 1.8.33. This vulnerability allows an attacker to inject malicious scripts without authentication.

CVE-2026-48201 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting Fast Velocity Minify versions up to and including 3.5.7. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity with a CVSS score of 7.1.

A Cross-Site Scripting (XSS) vulnerability exists in the Divi Contact Form 7 plugin (cf7-styler-for-divi) up to version 4.1.0. This vulnerability allows improper neutralization of script-related HTML tags, enabling code injection. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation details are provided in the available data.

A stored cross-site scripting (XSS) vulnerability exists in Brainstorm Force Ultimate Addons for Elementor - Lite header-footer-elementor plugin versions up to 2.9.5. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A Cross-Site Scripting (XSS) vulnerability exists in the ithemelandco GIFTiT – Free Gifts for WooCommerce plugin, allowing improper neutralization of script-related HTML tags. This vulnerability affects versions up to 4.5 and can lead to code injection. The issue has a medium severity rating with a CVSS score of 5.3.

CVE-2026-54855 is an unauthenticated cross-site scripting (XSS) vulnerability affecting Profile Builder versions up to and including 4.0.5. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in VikRentCar versions up to and including 1.4.10. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of the affected system.

A Cross Site Scripting (XSS) vulnerability exists in the user registration functionality of Subscriber versions up to and including 5.3.0. This vulnerability allows an attacker with limited privileges to execute scripts in the context of other users, potentially leading to partial confidentiality, integrity, and availability impacts.

A Cross Site Scripting (XSS) vulnerability affects WP Customer Area versions up to and including 8.4.0, allowing subscribers to potentially execute malicious scripts. This vulnerability is identified as CVE-2026-116854 and has a medium severity rating with a CVSS score of 6.5.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Mang Board WP versions up to and including 2.4.6. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of the affected system.

CVE-2026-116851 is an unauthenticated Cross Site Scripting (XSS) vulnerability affecting eCommerce Product Catalog versions up to and including 3.6.5. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of users' browsers without requiring authentication.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in VikRentCar versions up to and including 1.4.9. This vulnerability allows attackers to inject malicious scripts without authentication, potentially leading to partial confidentiality, integrity, and availability impacts.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Ad Inserter versions up to and including 2.8.19. This vulnerability allows attackers to inject malicious scripts that can execute in the context of the victim's browser. The flaw affects confidentiality, integrity, and availability to a limited extent.

A Cross Site Scripting (XSS) vulnerability affects MultiVendorX versions up to and including 5.0.20. This vulnerability allows a subscriber-level user to execute malicious scripts in the context of other users. The flaw is identified as CWE-79 and has a medium severity rating with a CVSS score of 6.5.