Search: xss.is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Stored XSS.This issue affects VikRentCar: from n/a through 1.4.10.

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.

CVE-2026-39739 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force Ultimate Addons for Elementor - Lite, specifically in the header-footer-elementor component. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability affects versions from initial release up to 2.9.5 and has been fixed in version 2.9.6.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ithemelandco GIFTiT &#8211; Free Gifts for WooCommerce ithemeland-free-gifts-for-woo allows Code Injection.This issue affects GIFTiT &#8211; Free Gifts for WooCommerce: from n/a through 4.5.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Fahim Reza Divi Contact Form 7 cf7-styler-for-divi allows Code Injection.This issue affects Divi Contact Form 7: from n/a through 4.1.0.

Mythic versions 3.2.16 through 3.4.0.61 contain a stored cross-site scripting (XSS) vulnerability. Attackers who control target endpoint files can embed malicious HTML in files named with a .pdf extension. When an operator previews such a file in the Mythic UI, the malicious HTML executes with the same origin, allowing theft of localStorage JWT tokens. These tokens grant full GraphQL and REST API access, potentially compromising the system.

Axigen Mail Server WebMail versions before 10.6.39 and 10.7.1 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated remote attackers to inject malicious scripts via unescaped sender display names in the conversation view. Exploitation occurs when a recipient opens a folder containing a crafted email, potentially leading to mailbox content theft or redirection. The vulnerability is fixed in versions 10.6.39 and 10.7.1.

The FV Flowplayer Video Player WordPress plugin up to version 7.5.55.7212 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can inject malicious scripts via the 'fv_player_videos[_fv_player_user_video][]' parameter if the administrator has enabled the profile video upload feature. These scripts execute when any user accesses the affected pages, potentially compromising user interactions.

A stored cross-site scripting (XSS) vulnerability exists in myTinyWMS versions prior to 1.6.4. The 'name' parameter in product and category management is not properly sanitized, allowing authenticated attackers to inject malicious JavaScript. This script executes in the browsers of other users viewing affected pages, potentially leading to session theft and administrative account compromise. The issue is fixed in version 1.6.4.

CVE-2026-119365 is a stored cross-site scripting (XSS) vulnerability in the Media Player Addons for Elementor – Media Player widget for WordPress. The flaw is due to improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. Versions from initial release up to 1.1.10 are affected. The vulnerability has a medium severity with a CVSS score of 6.5. It was fixed in version 1.1.11.

CVE-2026-119369 is a stored cross-site scripting (XSS) vulnerability in The Events Calendar plugin by Liquid Web / StellarWP. It affects versions from initial releases up to 6.18.2. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 6.18.3.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Code Injection.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.

Chamilo LMS versions 2.0.0 up to but not including 2.0.1 contain a stored cross-site scripting (XSS) vulnerability in the user profile page. The vulnerability arises because six user-editable profile fields are rendered without proper server-side sanitization, allowing a user with the ROLE_STUDENT role to inject malicious HTML. This malicious content executes in the browsers of visitors viewing the profile, including administrators, potentially enabling account takeover through session or token theft. The issue is fixed in version 2.0.1.

CVE-2026-61728 is a critical stored cross-site scripting (XSS) vulnerability in socfortress CoPilot versions prior to 0.1.76. It allows authenticated portal users to inject malicious scripts via incident comments and other fields, which are rendered without proper sanitization. Exploitation can lead to theft of authentication tokens, enabling persistent privileged account takeover, cross-tenant data access, and manipulation of incidents. The vulnerability is fixed starting from version 0.1.76.

CVE-2026-119680 is a stored cross-site scripting (XSS) vulnerability in ManageEngine SharePoint Manager Plus affecting the chart feature. It arises from improper sanitization and HTML encoding of user-controlled data such as users' full names, site names, or group names. Malicious HTML or JavaScript injected by an attacker is stored and executed in other users' browsers when viewing affected charts. The vulnerability has been fixed in client application build 4508.