Search: xss.is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress PublishPress Authors publishpress-authors allows Stored XSS.This issue affects PublishPress Authors: from n/a through 4.17.0.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force SureForms sureforms allows Code Injection.This issue affects SureForms: from n/a through 2.12.9.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave brave-popup-builder allows Code Injection.This issue affects Brave: from n/a through 0.8.8.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User Registration user-registration allows Code Injection.This issue affects User Registration: from n/a through 5.3.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6.2.

CVE-2026-113695 is a reflected cross-site scripting (XSS) vulnerability in the SmartIT inline-image attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and 26.1.01. It allows authenticated users to inject malicious script content into HTML responses viewed by other users. The vulnerability has a medium severity with a CVSS score of 4.8. No public exploits or patches are currently documented.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import and export users and customers import-users-from-csv-with-meta allows Stored XSS.This issue affects Import and export users and customers: from n/a through 2.5.9.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poster pdf-poster allows Stored XSS.This issue affects PDF Poster: from n/a through 2.6.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali Forms kali-forms allows Stored XSS.This issue affects Kali Forms: from n/a through 2.4.27.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gallery Block video-gallery-block allows Stored XSS.This issue affects Video Gallery Block: from n/a through 1.6.0.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Blocks cozy-addons allows Stored XSS.This issue affects Cozy Blocks: from n/a through 2.2.27.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a through 8.3.5.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The Post Grid the-post-grid allows Stored XSS.This issue affects The Post Grid: from n/a through 7.9.7.

The NEX-Forms – Ultimate Forms Plugin for WordPress is vulnerable to a stored cross-site scripting (XSS) flaw via the 'type' parameter in all versions up to and including 9.3.2. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.

A stored Cross-Site Scripting (XSS) vulnerability exists in the SABBATIC application, specifically in the 'companyName' parameter of the /empresa endpoint. This flaw allows an attacker to inject and store malicious JavaScript code that executes in the browser of any user who views the affected page. The vulnerability has a medium severity rating with a CVSS score of 4.8.

The NewsmanApp plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'billing_first_name' and 'billing_last_name' parameters. This affects all versions up to and including 3.7.29. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the Newsman Remarketing feature to be enabled with a configured Remarketing ID. The CVSS score is 7.2, indicating a high severity risk.

The Meta Box plugin for WordPress up to version 5.15.2 is vulnerable to stored cross-site scripting (XSS) via the 'profile_background' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when a page is viewed. Exploitation depends on a consuming plugin or theme that exposes this background field and renders stored values insecurely.

A stored Cross-Site Scripting (XSS) vulnerability exists in the SABBATIC application at the /mis-gastos endpoint via the 'observaciones' parameter. This flaw allows attackers to inject and store malicious JavaScript code that executes in the browser of any user who views the affected page. The vulnerability has a medium severity rating with a CVSS score of 4.8. No affected versions or patches are specified in the available data.