CVE-2026-62990 is a high-severity cross-site scripting (XSS) vulnerability in the Shopper headless e-commerce admin panel. Authenticated back-office staff with content-upload permissions can upload executable media files, including SVG and HTML, which execute scripts in the administrator's session when opened. This can lead to unauthorized creation of attacker-controlled administrator accounts with full access to sensitive data and management functions. The vulnerability affects versions from 2.0.0 prior to 2.10.1 and prerelease versions 3.0.0-beta.1 and beta.2. It is fixed in versions 2.10.1 and 3.0.0-beta.3.
CVE-2026-117645 is a cross-site scripting (XSS) vulnerability in the phoenix_html library of the phoenixframework. It arises from improper neutralization of input during web page generation, specifically in the handling of attribute names in HTML rendering functions. The vulnerability affects phoenix_html versions from 1.0.0 up to but not including 3.3.5, and from 4.0.0 up to but not including 4.4.0. The issue allows an attacker controlling attribute names to inject malicious attributes and scripts into rendered HTML. This occurs because attribute names are not properly escaped, enabling injection via constructs like HEEx <tag {@attrs}>, content_tag/3, or direct calls. Fixed versions are 3.3.5 and 4.4.0.
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.17.10. This flaw arises from insufficient input sanitization and output escaping of the inbound email body. An unauthenticated attacker can exploit this by injecting arbitrary web scripts that execute when a user views the affected page. The vulnerability is facilitated by the inbound email router relying solely on a regex match for a reply token in the References header, without cryptographic validation, allowing external parties to bypass authentication checks.
The Meow Gallery plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 5.5.1. This flaw arises from insufficient sanitization and escaping of the attachment alt text used in the aria-label attribute. Authenticated users with author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability requires that gallery items are rendered as links and exploits how WordPress sanitizes text fields, allowing injection of event-handler attributes.
Axigen Mail Server WebMail versions before 10.6.39 and 10.7.1 have a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated remote attackers to inject malicious scripts via unescaped sender display names in the conversation view. When a recipient opens the affected folder, the injected script executes, potentially leading to mailbox content theft or redirection.
The GeoDirectory WordPress plugin (including WP Business Directory and Classified Listings Directory) up to version 2.8.199 is vulnerable to stored cross-site scripting (XSS) via the listing description field. This occurs due to insufficient sanitization of input on save combined with unsafe rendering of popover HTML content, allowing authenticated users with Subscriber-level access or higher to inject arbitrary scripts that execute when the affected page is viewed.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve a malicious comment containing a crafted shortcode. Once approved, the injected script executes for any visitor interacting with the video player on the affected page.
The CP Multi View Events Calendar plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'Subject' parameter. This affects all versions up to and including 1.4.43. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. The exploit requires access to a nonce localized to any published page with the calendar shortcode, making the attack feasible for authenticated users.
The Like Button Rating ♥ LikeBtn plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the HTTP_CLIENT_IP header parameter. This affects all versions up to and including 2.6.64. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which normally hashes IP addresses to prevent payload execution. Additionally, an administrator action is necessary to trigger the vulnerability, as attackers cannot exploit it independently.
The Themify Builder plugin for WordPress versions up to and including 7.8.4 contains a stored cross-site scripting (XSS) vulnerability in the 'variations' repeater field of Custom Font posts. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with contributor-level access or higher to inject arbitrary scripts. These scripts execute when a user views the Custom Fonts admin listing page.
The easy.jobs WordPress plugin up to version 2.8.4 is vulnerable to stored cross-site scripting (XSS) via the 'cover_letter' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected candidate's Application tab and clicks a crafted link. The issue arises from insufficient input sanitization and output escaping, enabling exploitation through WHATWG URL parsing to execute JavaScript payloads.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the 'comment' shortcode attribute 'align' in all versions up to and including 7.5.55.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts into comments. Exploitation requires the plugin's 'Parse Vimeo and YouTube links' setting to be enabled, which causes shortcode attributes in comments to be rendered unescaped, affecting all users who view the injected content.
The Independent Analytics Pro WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw via the 'utm_campaign' parameter in all versions up to and including 2.15.5. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. Exploitation requires the Pro build to be active and involves replaying a server-signed payload with a crafted utm_campaign value against an unauthenticated REST endpoint.
The FV Flowplayer Video Player plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.5.55.7212. This flaw arises from insufficient input sanitization and output escaping of the 'fv_player_videos[_fv_player_user_video][]' parameter. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts into pages, which execute when accessed by other users. Exploitation requires that an administrator has enabled the 'Allow visitors to upload videos to their profile' setting.
The Redux Framework plugin for WordPress versions up to and including 4.5.15 contains a stored cross-site scripting (XSS) vulnerability via the multi_media field. This occurs because the field's renderer outputs stored values into multiple HTML contexts without proper escaping. Additionally, a flaw in permission checking allows authenticated users with Subscriber-level access to inject scripts into their own profile, which execute when an administrator views that profile. Exploitation requires a theme or plugin that registers a multi_media field through the Redux Users API.
A Cross Site Scripting (XSS) vulnerability exists in BeeHome MyBeeHome versions before 2025-11-01. This flaw allows a remote attacker to execute arbitrary code through the Profile editing functionality and the chat messaging component.
A stored cross-site scripting (XSS) vulnerability exists in the Media Player Addons for Elementor plugin for WordPress, specifically in the Media Player widget. This vulnerability affects versions up to and including 1.1.10. It allows improper neutralization of input during web page generation, which could lead to execution of malicious scripts in the context of the affected site.
A stored cross-site scripting (XSS) vulnerability exists in The Events Calendar plugin by Liquid Web / StellarWP, affecting versions up to 6.18.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute scripts in the context of other users. The vulnerability has a CVSS score of 6.5, indicating a medium severity impact.
A Cross-Site Scripting (XSS) vulnerability exists in Crocoblock JetFormBuilder up to version 3.6.7.1 due to improper neutralization of script-related HTML tags. This allows an attacker to inject code into web pages generated by the affected software. The vulnerability has a medium severity rating with a CVSS score of 5.3.
An authenticated cross-site scripting (XSS) vulnerability exists in the /spina/embeddable.rb component of Spina CMS version 2.21.0. This flaw allows authenticated attackers to inject crafted URLs that execute arbitrary web scripts or HTML within the context of the application.