The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the listing description (post_content) in versions up to, and including, 2.8.199 This is due to insufficient input sanitization on save (the bundled geodir_kses_safe_embed_attributes() helper only neutralises data-embed-url, data-src and data-embed, while WordPress core wp_kses_post permits data-* attributes on standard HTML tags) combined with the AyeCode UI library initializing every [data-bs-toggle="popover-html"] element with { html: true, sanitize: false }, which inserts the attacker-controlled data-bs-content value into the popover body as HTML at render time. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater field of Custom Font (tb_cf) posts in versions up to, and including, 7.8.4. This is due to insufficient input sanitization and output escaping on the variations post meta: Themify_Metabox::_save_meta() only passes the value through wp_kses_data() when the field type is 'textbox' or 'textarea', so the 'repeater' field writes attacker-controlled sub-fields (style, woff/woff2/ttf/svg/eot URLs) to update_post_meta() verbatim, and Themify_Custom_Fonts::render_columns() later echoes those values unescaped inside a <style> block on the Custom Fonts admin listing. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page (specifically, the Custom Fonts admin listing).
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the 'Parse Vimeo and YouTube links' option to be enabled and a site administrator to approve the comment containing the malicious shortcode; execution is then triggered for any visitor who interacts with the video player on that page.
The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' parameter in all versions up to, and including, 2.15.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Independent Analytics Pro build to be active, as the free build nulls campaign parameters; additionally, the attacker must first visit a frontend page to obtain a server-signed payload that can be replayed with a crafted utm_campaign value against the unauthenticated /iawp/search REST endpoint, since the signature check does not cover utm_* fields.
The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cover_letter' parameter in all versions up to, and including, 2.8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful execution requires an administrator to open the affected candidate's Application tab and click the attacker-crafted link, at which point WHATWG URL parsing collapses the encoded scheme back to javascript: and executes the payload.
The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.5.15 via the multi_media field. This is due to the field's renderer printing the stored value into an href attribute, a hidden input value and an HTML element without escaping, while every neighbouring attribute in the same method is wrapped in esc_attr(). It is compounded by Redux_Extension_Users::user_meta_save() evaluating a field's 'permissions' requirement against a user id taken from the request body ('checkuser_id') rather than the current user, so a Subscriber can write a field declared for 'manage_options'. This makes it possible for authenticated attackers with Subscriber-level access and above to inject arbitrary web scripts into their own profile record that execute when an administrator views that user's profile in the dashboard. Requires a theme or plugin that registers a multi_media field through the Redux Users API.
The FV Flowplayer Video Player WordPress plugin up to version 7.5.55.7212 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can inject malicious scripts via the 'fv_player_videos[_fv_player_user_video][]' parameter if the administrator has enabled the profile video upload feature. These scripts execute when any user accesses the affected pages, potentially compromising user interactions.
The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Inbound Email Body in all versions up to, and including, 1.17.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The inbound email router's only gate is a regex match on the References header for a reply token whose hash is never cryptographically validated, meaning any external party who received or can mimic a CRM outbound email can satisfy the check without a WordPress account.
The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute) in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerable code path is only reachable when a gallery item is rendered as a link (i.e., link_href is non-empty), and exploitation relies on the fact that WordPress's sanitize_text_field() strips angle-bracketed tags but preserves double quotes, allowing an attacker to break out of the aria-label attribute context and inject event-handler attributes such as onclick.
The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_IP (Client-IP header)' parameter in all versions up to, and including, 2.6.64 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires the site administrator to have disabled the default 'Be GDPR compliant' option, which would otherwise hash stored IP values and neutralize the payload. Successful exploitation additionally requires an action by an administrator — the attacker cannot trigger the vulnerability on their own.
The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting to be enabled by an administrator, which causes the plugin to register do_shortcode on the comment_text filter, allowing attacker-supplied shortcode attributes stored in comments to be rendered unescaped to all subsequent visitors.
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' parameter in all versions up to, and including, 1.4.43 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The required nonce is localized to any published page carrying the calendar shortcode, making the adddetails endpoint reachable by any authenticated user with Subscriber-level access or above.
myTinyWMS versions prior to 1.6.4 contain a stored cross-site scripting (XSS) vulnerability in the 'name' parameter used in product and category management. Authenticated attackers can inject malicious JavaScript, which executes in the browsers of other users viewing affected pages. This can lead to session theft and compromise of administrative accounts. The vulnerability is fixed in version 1.6.4.
A stored cross-site scripting (XSS) vulnerability exists in Frappe Learning Management System (LMS) versions prior to 2.52.0. An authenticated user with course editing privileges can inject malicious JavaScript via meta tag fields in the Course Management module. The injected script is stored without proper HTML sanitization and is rendered unsafely, enabling XSS attacks. This vulnerability is fixed in version 2.52.0.
CVE-2026-105454 is a cross-site scripting (XSS) vulnerability in Best Practical Solutions Request Tracker. The flaw arises because the automatic URL link creation in HTML ticket content does not properly HTML-escape URLs, allowing crafted URLs to inject scripts. An attacker who can add HTML content to a ticket, including unauthenticated senders of HTML email to queues with permissive permissions, can exploit this. The malicious script executes in the context of any user viewing the ticket, acting with that user's privileges. This vulnerability was fixed in versions 5.0.11 and 6.0.4.
A Cross-site Scripting (XSS) vulnerability exists in Best Practical Solutions RT for Incident Response (RTIR) versions 6.0.0 through before 6.0.4. The vulnerability occurs because ticket creation forms render the subject of related tickets without HTML escaping, allowing script injection. Since RTIR grants all users the right to create Incident Reports by default, an unauthenticated attacker can send an emailed report with a malicious script in the subject. This script executes in the session of the incident handler who processes the report, potentially allowing actions with that user's privileges. The issue is fixed in version 6.0.4, and RTIR 5.0 is not affected.
CVE-2026-105456 is a cross-site scripting (XSS) vulnerability in Best Practical Solutions RT for Incident Response (RTIR). The vulnerability arises because RTIR extends RT's HTML scrubber to allow internal link placeholders, but this extension permits any link containing the placeholder, including javascript: scheme links. This affects the entire RT instance once RTIR is installed. An attacker who can add HTML content to a ticket, including unauthenticated senders of HTML email to the Incident Reports queue (open by default), can store malicious links. When a user clicks such a link, the script runs with that user's session and authority. The issue is fixed in RTIR versions 5.0.11 and 6.0.4.
CVE-2026-48164 is a cross-site scripting (XSS) vulnerability in Collabora Online affecting versions prior to 24.04.18 and 25.04.11. The issue arises because the host_session_id parameter is inserted into the cool.html editor page without proper HTML encoding. This allows an attacker to craft a URL that, when loaded by a victim, can execute scripts in the context of the Collabora Online iframe, potentially exposing session tokens and page contents. The vulnerability is mitigated if a reverse proxy preserves the Content Security Policy header. Fixed versions 24.04.18 and 25.04.11 address this issue.
Chamilo LMS versions 2.0.0 up to but not including 2.0.1 contain a stored cross-site scripting (XSS) vulnerability in the user profile page accessible via GET /user/{username}. Six user-editable profile fields are rendered without proper server-side sanitization, allowing a ROLE_STUDENT attacker to inject malicious HTML. This can lead to execution of arbitrary scripts in the browsers of visitors, including administrators, potentially enabling account takeover through session or token theft. The vulnerability is fixed in version 2.0.1.
CVE-2026-61728 is a critical cross-site scripting (XSS) vulnerability in socfortress CoPilot versions prior to 0.1.76. It allows authenticated portal users to submit stored markup that is rendered without proper sanitization, leading to persistent script execution when viewed by other users. This can result in theft of authentication tokens and enable persistent privileged account takeover, cross-tenant data access, and manipulation of incidents. The vulnerability affects multiple components rendering user input unsafely. Fixes were introduced in versions 0.1.70 and fully contained in 0.1.76.