CWE-79: Cross-site Scripting vulnerabilities

WeGIA, a web manager for charitable institutions, has a stored DOM cross-site scripting (XSS) vulnerability in versions prior to 3.8.7. The flaw exists in the handling of the 'texto' field in the memorandum dispatch feature, where sanitization is undone by decoding before insertion into the DOM via jQuery. This allows attackers to inject malicious scripts that execute when other users view the memorandum thread, potentially leading to session token theft and account takeover. The vulnerability is fixed in version 3.8.7.

CVE-2026-108494 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Bob's Chained Quiz plugin versions up to and including 1.4.1. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of other users, potentially leading to data theft or session hijacking.

CVE-2026-61995 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting emarket-design's YouTube Showcase product in versions up to and including 4.1.0. This vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to data theft, session hijacking, or other malicious actions. The vulnerability requires no authentication but does require user interaction (UI:R).

CVE-2026-61993 is a high severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Blockonomics version 3.11.0. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a user's browser, potentially leading to data theft or session hijacking. The vulnerability requires no authentication but does require user interaction to trigger the script execution.

CVE-2026-61989 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Easy Property Listings versions up to and including 3.5.25. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of a victim's browser, potentially leading to data theft or session hijacking.

CVE-2026-61988 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Auction Nudge – Your eBay on Your Site versions up to 8.4.0. This vulnerability allows an attacker to execute arbitrary scripts in the context of the affected application without requiring authentication.

CVE-2026-54866 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Razorpay Payment Button Elementor Plugin versions up to 1.2.8. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to data theft or session hijacking.

CVE-2026-54865 is a cross-site scripting (XSS) vulnerability affecting Podamibe Custom User Gravatar versions up to 1.0.8. This vulnerability allows a subscriber-level user to inject malicious scripts, potentially impacting confidentiality, integrity, and availability. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-54864 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting nicashmu Post Video Players versions up to 1.165. This vulnerability allows attackers to inject malicious scripts that execute in the context of users' browsers, potentially leading to data theft or session hijacking.

CVE-2026-42692 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting WP Crowdfunding versions up to 2.2.2. This vulnerability allows attackers to inject malicious scripts that can execute in the context of users' browsers, potentially leading to data theft, session hijacking, or other malicious actions.

CVE-2026-27394 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting Jyothis Joy Eventer versions up to 0.1.1. This vulnerability allows attackers to inject malicious scripts that can execute in the context of other users. The flaw impacts confidentiality, integrity, and availability of the affected application.

CVE-2026-118085 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting GlobalPayments WooCommerce versions up to and including 1.23.3. This vulnerability allows an attacker to inject malicious scripts that execute in the context of the victim's browser, potentially leading to data theft or session hijacking.

Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Classic UI. Due to insufficient sanitization of the From header value, a remote attacker can send a crafted email containing a malicious From header with an embedded JavaScript payload. When the victim opens the message in Classic UI and clicks Reply while composing in HTML mode with reply headers disabled, the unsanitized From header content is rendered as HTML and the JavaScript payload executes in the victim's browser, potentially allowing the attacker to steal session information or perform actions on behalf of the victim. This issue was fixed in version 10.1.21

Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due to lack of sanitization of the Content-Location header, an attacker can set it to a javascript: URI. An unauthenticated remote attacker can send a crafted email to a victim; when the victim opens the email in the Zimbra web interface and clicks the attachment name, the JavaScript payload executes in the victim's browser context. This issue was fixed in version 10.1.21

CVE-2026-113697 is a reflected cross-site scripting (XSS) vulnerability in the agent query feature of BMC Helix Operations Management version 25.4.00. This flaw allows authenticated attackers to execute arbitrary scripts in the browsers of other users who open a specially crafted link. The vulnerability has a medium severity rating with a CVSS score of 4.8. No patch or remediation information is currently provided by the vendor.

CVE-2026-113695 is a reflected cross-site scripting (XSS) vulnerability in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to inject malicious script content into HTML responses viewed by other users. The vulnerability has a medium severity with a CVSS score of 4.8. No public exploits or patches are currently documented.

CVE-2026-113691 is a stored cross-site scripting (XSS) vulnerability in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to inject malicious scripts that execute in other users' browsers. The vulnerability has a medium severity score of 5.1 and requires user interaction with low privileges.

CVE-2026-113690 is a stored cross-site scripting (XSS) vulnerability in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to upload script content that executes in other users' browsers. The vulnerability has a medium severity with a CVSS score of 4.8.

CVE-2026-113689 is a stored cross-site scripting (XSS) vulnerability in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to inject malicious scripts that execute in other users' browsers. The vulnerability has a medium severity with a CVSS 4.0 base score of 5.1.

The NewsmanApp WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.7.29. This flaw arises from insufficient input sanitization and output escaping of the 'billing_first_name' and 'billing_last_name' parameters. Exploitation requires the Newsman Remarketing feature to be enabled with a configured Remarketing ID. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages.