A Stored Cross-Site Scripting (XSS) vulnerability exists in the Enable SVG, WebP, and ICO Upload WordPress plugin versions 1.1.3 through before 1.1.6. The plugin fails to properly sanitize uploaded SVG files when their content is not detected as SVG, allowing users with author role or higher to inject malicious scripts that are stored and served as SVG images.
CVE-2026-105258 is a cross-site scripting (XSS) vulnerability in the Appointment Booking Plugin for WordPress versions before 5.7.6. It allows high-privilege users, such as administrators, to inject JavaScript code into booking-form step content settings that is then executed in the browsers of visitors who load the public booking form. On multisite WordPress installations where administrators lack the unfiltered_html capability, this vulnerability escalates privileges by enabling unauthenticated visitors to be affected.
CVE-2024-3586 is a stored cross-site scripting (XSS) vulnerability in the LetterPress WordPress plugin versions before 2.4.0. The flaw arises because some plugin settings are not properly sanitized and escaped, allowing high-privilege users such as administrators to inject malicious scripts. This vulnerability can be exploited even when the unfiltered_html capability is disabled, such as in multisite WordPress setups. The issue is fixed in version 2.4.0.
The Password Protected WordPress plugin up to version 2.8.4 contains a stored cross-site scripting (XSS) vulnerability via the Freemius SDK's purchase-completion handler. Authenticated users with subscriber-level access or higher can inject malicious scripts through the 'purchased_plan' parameter, which are then stored and executed when administrators view certain admin pages.
The Schema App Structured Data plugin for WordPress versions up to and including 2.3.2 is vulnerable to stored cross-site scripting (XSS) via the 'Remove Microdata' output filter. This vulnerability arises from insufficient input sanitization and output escaping of comment content, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires that an administrator enables the 'Remove Microdata' option and approves the malicious comment, which then executes scripts when users access the affected page.
The Food Store – Online Food Delivery & Pickup WordPress plugin (versions up to 1.5.5) contains a stored cross-site scripting (XSS) vulnerability via the 'service_type' cookie. An unauthenticated attacker can inject malicious scripts by supplying a payload through the ?type= query parameter on the public checkout page. This payload is stored in the cookie, persisted to order metadata, and rendered without proper escaping in the admin panel, leading to script execution in administrators' browsers.
The DSGVO All in one for WP WordPress plugin is vulnerable to a stored cross-site scripting (XSS) flaw in all versions up to 5.0. This vulnerability arises from insufficient input sanitization and output escaping in the comment content handling when specific plugin options are enabled. Exploitation requires that the 'Google Tag Manager' integration and the 'Replace integration automatically [Beta]' option be enabled, and that a crafted comment be approved by an administrator. Successful exploitation allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages.
CVE-2026-113409 is a stored cross-site scripting (XSS) vulnerability in the Ortto plugin for WordPress versions before 1.0.25. The flaw occurs because the plugin did not properly escape stored settings on its admin settings page. An attacker who can modify the plugin's configuration could inject arbitrary JavaScript that executes in an administrator's browser when visiting the affected page. This vulnerability has a medium severity score of 4.8 and was fixed in version 1.0.25.
A stored cross-site scripting (XSS) vulnerability exists in Apereo Foundation openEQUELLA versions from 2019.1 up to but not including 2026.2. The pre-login notice is stored as HTML and rendered on the legacy login page without proper encoding or sanitization. A user with EDIT_SYSTEM_SETTINGS permission can inject arbitrary scripts via the pre-login notice API endpoint. If this permission is granted to unauthenticated users such as guest or Everyone, exploitation can occur without authentication. The issue is fixed in version 2026.2.
A cross-site scripting (XSS) vulnerability exists in WWBN AVideo-Encoder versions prior to 8.1.0. The vulnerability arises because the application improperly handles the filename extracted from a user-controlled fileURI parameter, allowing an attacker to inject HTML with event handlers. This malicious content can execute in the browser of privileged users, such as administrators or operators, when viewing the encoder queue. The issue is fixed in version 8.1.0.
CVE-2026-61573 is a cross-site scripting (XSS) vulnerability in WWBN AVideo-Encoder versions prior to 8.1.0. The anonymous login interface improperly reflects user input into HTML and JavaScript contexts without adequate output encoding or filtering. This allows an unauthenticated attacker to craft a malicious login link that executes arbitrary JavaScript in the encoder's origin, potentially stealing session identifiers and login credentials. The issue is fixed in version 8.1.0.
A reflected cross-site scripting (XSS) vulnerability exists in the labstack echo Go web framework in versions prior to 4.16.0 and between 5.0.0 and before 5.4.0. The vulnerability arises because Context.JSONP and Context.JSONPBlob methods concatenate an unvalidated callback parameter into a JavaScript response, allowing attacker-controlled input to execute script code. This flaw is fixed in versions 4.16.0 and 5.4.0.
FearlessCMS versions prior to 0.1.4 contain multiple unauthenticated debug/test PHP scripts under the admin directory that allow privileged operations without authentication or CSRF protection. These scripts enable attackers to bypass admin login via crafted URIs, perform arbitrary file writes and reads including path traversal, execute stored cross-site scripting, enumerate directories, and cause disk exhaustion. The vulnerability allows site defacement, session theft, and potential full system compromise when PHP runs with elevated privileges. The issue is fixed in version 0.1.4.
CVE-2026-11854 is a cross-site scripting (XSS) vulnerability in the authentication endpoint of WSO2 API Manager. The endpoint reflects unsanitized user input in error messages, allowing attackers to inject malicious scripts that execute in a victim's browser. Exploitation can lead to actions such as redirecting users to malicious sites or modifying the page interface. However, session hijacking is mitigated by the httpOnly flag on session cookies. The vulnerability affects multiple versions of WSO2 API Manager and has been assigned a medium severity rating with a CVSS score of 6.1.
CVE-2026-118257 is a high-severity cross-site scripting (XSS) vulnerability in the vue-i18n internationalization plugin for Vue.js. The flaw exists in versions 9.14.5, 10.0.8, and from 11.1.10 up to but not including 11.4.14, as well as from 12.0.0-alpha.4 up to but not including 12.0.0-alpha.5. The vulnerability arises because the sanitizeTranslatedHtml() function escapes markup and event-handler text inside an iframe srcdoc attribute but leaves the srcdoc attribute active, allowing browsers to parse attacker-controlled content as same-origin HTML and execute scripts when escapeParameter is enabled and translations are rendered as HTML via v-html. This issue is fixed in versions 11.4.14 and 12.0.0-alpha.5.
A cross-site scripting (XSS) vulnerability exists in the vue-i18n internationalization plugin for Vue.js in versions from 9.0.0-beta.5 up to but not including 11.4.14, and from 12.0.0-alpha.1 up to but not including 12.0.0-alpha.5. The issue occurs when escapeParameter (escapeParameterHtml in the Legacy API) is enabled but does not properly escape named interpolation values if both list and named values are supplied in the same translation call. This can allow attacker-controlled HTML markup injection, potentially leading to phishing or script execution when combined with other vulnerabilities or in versions lacking a sanitizer. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.
Highcharts JS versions from 2.0.0 up to but not including 3.2.0, and versions from 3.2.0 up to but not including 4.0.0, as well as versions before 13.0.0-beta.2, contain a cross-site scripting (XSS) vulnerability in the Grid component. This vulnerability arises because the credits.href property is applied without validating the URL scheme, allowing an attacker controlling the Grid configuration to inject a javascript: URL. Activating the credits link then executes arbitrary script in the context of the hosting page, potentially compromising application data and session state. The issue is fixed in versions 3.2.0, 4.0.0, and 13.0.0-beta.2.
Highcharts JS versions from 2.0.0 up to but not including 3.2.0 contain a cross-site scripting (XSS) vulnerability in the Grid pagination language strings. The vulnerability arises because pagination language strings are written into the DOM as markup rather than text, allowing an attacker controlling the Grid language configuration to inject elements with event handlers. This leads to script execution in the context of the hosting page without requiring additional user interaction. The issue is fixed in version 3.2.0 and later.
CVE-2026-118253 is a high-severity cross-site scripting (XSS) vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.3. The issue occurs in Highcharts Dashboards edit mode where fullscreen language labels are parsed as HTML instead of plain text, allowing an attacker controlling language options to inject malicious markup with event handlers. This code executes in the context of the hosting page when the fullscreen control is rendered. The vulnerability is only exploitable when edit mode is enabled and the fullscreen view option is present. It is fixed in version 4.2.3 and later.
Highcharts JS versions from 1.0.0 up to but not including 4.2.3 contain a cross-site scripting (XSS) vulnerability in the Dashboards edit-mode sidebar. The issue arises because component language strings are parsed as HTML instead of text, allowing an attacker controlling the language configuration to inject malicious markup with event handlers. This code executes in the context of the hosting page when the sidebar is opened and the affected labels render. The vulnerability is fixed in version 4.2.3.