CWE-79: Cross-site Scripting vulnerabilities

CVE-2026-119680 is a stored cross-site scripting (XSS) vulnerability in ManageEngine SharePoint Manager Plus affecting the chart feature. It results from improper sanitization and HTML encoding of user-controlled data such as users' full names, site names, or group names. An attacker can inject malicious HTML or JavaScript that is stored and executed in other users' browsers when viewing affected charts. This vulnerability has been fixed in client application build 4508.

A stored cross-site scripting (XSS) vulnerability exists in ARKETEAM Protectel modules PROTECTELMAJ and BDF within their note editor components. An attacker with low privileges can inject arbitrary HTML and JavaScript code into notes, which will execute when other users view the affected module. This vulnerability has been fixed in PROTECTELMAJ version 6.5.19 and BDF version 6.4.67.

CVE-2026-85268 is a high-severity Cross-Site Scripting (XSS) vulnerability in the auth/handler component of Google Cloud Identity Platform and Firebase Authentication on iOS. It affects versions prior to 2026-08-14 and allows unauthenticated remote attackers to execute arbitrary JavaScript by leveraging a malicious iOS bundle ID. This vulnerability has been fixed as of version 2026-08-14. The service is cloud-hosted, and Google manages the remediation.

The Food Store – Online Food Delivery & Pickup WordPress plugin versions up to 1.5.5 contain a stored cross-site scripting (XSS) vulnerability via the 'service_time' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires a specific non-default configuration where 'Enable Checkout Service Fields' is disabled and 'Enable Pickup/Delivery Service' is enabled.

Gravity Forms plugin for WordPress versions up to and including 3.1.2 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the List Field. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the injected entry and confirms a dialog. Exploitation requires administrator interaction to trigger the malicious script execution.

Gravity Forms plugin for WordPress versions up to and including 3.1.1 is vulnerable to stored cross-site scripting (XSS) due to insufficient input sanitization and output escaping in certain fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user accesses the affected page. The issue arises because some fields permit raw HTML submissions and an entity-encoded payload bypasses sanitization, later decoded by the browser into executable code.

A stored cross-site scripting (XSS) vulnerability exists in the Firelight Lightbox WordPress plugin versions before 2.3.23. The plugin does not properly escape URLs of links opened in its Classic lightbox, allowing users with Contributor role or higher to inject malicious scripts. This can lead to execution of arbitrary code in the context of users who click crafted links.

Joinchat WordPress plugin versions 6.3.2 up to but not including 6.4.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises because the plugin does not properly escape the message content of its button block before rendering it in an HTML attribute on the front end. Users with Author role or higher can exploit this to inject malicious scripts that execute in the browsers of visitors, including administrators. The vulnerability is fixed in version 6.4.2.

A Cross-site Scripting (XSS) vulnerability exists in the WP Visitor Statistics (Real Time Traffic) WordPress plugin versions before 8.8. The plugin fails to sanitize and escape tracking data from public visitor requests before storing and displaying it in the admin dashboard. This allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the statistics pages.

A reflected cross-site scripting (XSS) vulnerability exists in the User Frontend WordPress plugin before version 4.3.14. The flaw arises because some user-supplied values are not properly sanitized or escaped before being included in HTML attributes in an AJAX response accessible to the public. This vulnerability affects logged-out visitors due to an anonymous nonce that only validates for unauthenticated requests. The issue was fixed in version 4.3.14.

The Events Made Easy WordPress plugin up to version 3.3.1 contains a stored cross-site scripting (XSS) vulnerability via the 'width' parameter. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.

The Cool FormKit Lite – Advanced Form Builder for Elementor WordPress plugin is vulnerable to stored DOM-based cross-site scripting (XSS) via the '_elementor_data.form_fields[].custom_id' parameter in all versions up to and including 2.7.9. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises due to insufficient input sanitization and output escaping, specifically because the esc_html() function is bypassed by the HTML fragment-serialization process in jQuery, allowing injected scripts to break out of HTML attribute contexts.

CVE-2026-107252 is a Cross-Site Scripting (XSS) vulnerability in the Drupal MathJax: LaTeX module. It affects all versions from 0.0.0 up to but not including 4.1.2. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of the affected site. The issue has been fixed in version 4.1.2.

CVE-2026-107265 is a stored Cross-site Scripting (XSS) vulnerability in the Drupal Leaflet module. It affects Leaflet versions from 0.0.0 up to but not including 10.4.13. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This issue has been fixed in Leaflet version 10.4.13.

CVE-2026-107306 is a stored cross-site scripting (XSS) vulnerability in the Drupal Menu Link Attributes module. It affects versions from 0.0.0 up to but not including 1.8.0. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with high privileges to inject malicious scripts. The issue has been fixed in version 1.8.0. The CVSS score is 3.8, indicating a low severity impact.

CVE-2026-107308 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Country module. It affects versions from 0.0.0 up to but not including 2.1.3, and from 2.2.0 up to but not including 2.2.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling XSS attacks. The issue has been fixed in versions 2.1.3 and 2.2.1.

CVE-2026-110738 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Gin Admin Theme. It affects versions from 0.0.0 up to but not including 4.1.4, and from 5.0.0 up to but not including 5.0.16. The vulnerability arises from improper neutralization of input during web page generation. This flaw allows an attacker with low privileges to execute scripts in the context of the affected application, potentially impacting confidentiality, integrity, and availability. The issue has been fixed in versions 4.1.4 and 5.0.16. The CVSS v3.1 base score is 6.5, indicating a medium severity level.

CVE-2026-108515 is a Cross-site Scripting (XSS) vulnerability in Drupal core affecting multiple version ranges from 8.9.0 up to but not including 10.6.19, 11.0.0 up to 11.3.19, 11.4.0 up to 11.4.10, and 12.0.0-alpha1 up to 12.0.0-beta2. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in a user's browser. The issue has been fixed in Drupal core versions 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2. The CVSS score is 6.5, indicating a medium severity level. No known exploits in the wild have been reported.

CVE-2026-108514 is a Cross-Site Scripting (XSS) vulnerability in Drupal core affecting multiple versions from 10.3.0 up to but not including 10.6.19, 11.0.0 up to but not including 11.3.19, 11.4.0 up to but not including 11.4.10, and 12.0.0-alpha1 up to but not including 12.0.0-beta2. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker to execute arbitrary scripts in the context of the affected site. The issue has been fixed in versions 10.6.19, 11.3.19, 11.4.10, and 12.0.0-beta2. The CVSS score is 6.5, indicating a medium severity level. No known exploits in the wild have been reported.

CVE-2026-114527 is a Cross-Site Scripting (XSS) vulnerability in the Drupal UI Icons component. It affects versions from 0.0.0 up to but not including 1.1.3, and from 2.0.0 up to but not including 2.0.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in the context of the affected application.