Search: xss.is

A Cross-Site Scripting (XSS) vulnerability exists in Themeum Kirki kirki up to version 6.4.0 due to improper neutralization of script-related HTML tags. This vulnerability allows an attacker with low privileges to inject code that can be executed in the context of other users' browsers. The vulnerability has a medium severity rating with a CVSS score of 4.3. No public exploits or patches are currently documented.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Post Video Players versions up to and including 1.165. This vulnerability allows attackers to inject malicious scripts without authentication.

CVE-2026-27394 is an unauthenticated cross-site scripting (XSS) vulnerability affecting Eventer versions up to and including 0.1.1. This vulnerability allows an attacker to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in WP Crowdfunding versions up to and including 2.2.2. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in GlobalPayments WooCommerce versions up to and including 1.23.3. This vulnerability allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability of affected systems.

A stored cross-site scripting (XSS) vulnerability exists in The Plus Addons for Elementor Page Builder Lite up to version 6.5.3. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in Chained Quiz versions up to and including 1.4.1. This flaw allows attackers to inject malicious scripts without authentication, potentially impacting confidentiality, integrity, and availability.

Keycloak versions prior to 26.6.4 contain a cross-site scripting (XSS) vulnerability that allows a remote attacker with administrative privileges and specific permissions to bypass client URI validation. This is done by registering a malicious client with a specially crafted redirect URI using a case-insensitive javascript: or data: scheme. The vulnerability enables arbitrary code execution in the Keycloak origin when a victim interacts with crafted links, such as during logout or in the Admin Console. A fix is available in version 26.6.4.

Parse Server versions prior to 9.10.0-alpha.2 and 8.6.84 are vulnerable to a stored cross-site scripting (XSS) issue via malformed Content-Type headers in file uploads. The vulnerability arises because malformed Content-Type values that do not conform to the type/subtype format can bypass the file extension blocklist and be stored unchanged. When served from storage adapters that preserve the Content-Type header (e.g., Amazon S3, Google Cloud Storage, Azure Blob Storage), browsers may MIME-sniff the file content and execute embedded scripts, leading to stored XSS. The default GridFS adapter is not affected due to recomputing Content-Type and using X-Content-Type-Options: nosniff. Patches are available that validate Content-Type headers for well-formedness and reject malformed values.

A DOM-Based Cross-site Scripting (XSS) vulnerability exists in David Lingren's Media Library Assistant up to version 3.42. This vulnerability involves improper neutralization of input during web page generation, which can lead to execution of malicious scripts in the context of the affected web application.

A stored cross-site scripting (XSS) vulnerability exists in Crocoblock JetElements For Elementor up to version 2.9.2.6. This flaw involves improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that can impact confidentiality, integrity, and availability. The vulnerability has a CVSS 3.1 score of 6.5, indicating medium severity.

A stored cross-site scripting (XSS) vulnerability exists in weDevs Happy Addons for Elementor up to version 3.50.1. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences. No patch or fix information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins Flash & HTML5 Video html5-video-player up to version 2.14.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in the Gutenberg Blocks by Kadence Blocks plugin for WordPress, affecting versions up to 3.8.0.2. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in bPlugins StreamCast through version 2.4.6 due to improper neutralization of input during web page generation. This vulnerability allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users. The flaw impacts confidentiality, integrity, and availability to a limited extent. No patch information is currently provided.

A stored cross-site scripting (XSS) vulnerability exists in the Strong Testimonials plugin by WP Chill, affecting versions up to 3.3.15. This vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in PublishPress Authors up to version 4.17.0. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of another user. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A stored cross-site scripting (XSS) vulnerability exists in Brainstorm Force SureDash versions up to 1.12.3. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A Cross-Site Scripting (XSS) vulnerability exists in the Brave browser's brave-popup-builder component due to improper neutralization of script-related HTML tags. This vulnerability allows code injection. It affects Brave versions up to 0.8.8. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits in the wild or patches are currently documented.

A stored cross-site scripting (XSS) vulnerability exists in Codection Import and export users and customers import-users-from-csv-with-meta component, affecting versions up to 2.5.9. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts that execute in the context of affected users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.