Highcharts JS versions prior to 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because the credits.href property is assigned directly to the window location without validating the URL scheme, allowing an attacker controlling the chart configuration to inject a javascript: URL. This can lead to script execution in the context of the hosting page when a user clicks the credits label. The vulnerability affects Highcharts and its related packages Highcharts Stock, Maps, and Gantt. Fixed versions are 11.4.9, 12.6.1, and 13.1.1.
Highcharts JS versions from 10.0.0 up to but not including 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because breadcrumbs.style is applied as SVG attributes without filtering attribute names, allowing attackers controlling chart configuration to inject event-handler keys. This leads to execution of malicious scripts in the context of the hosting page when users interact with breadcrumb buttons. Styled-mode charts are not affected. The vulnerability is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
CVE-2026-118245 is a high severity cross-site scripting (XSS) vulnerability in Highcharts JS, a JavaScript charting library. Versions from 1.0.0 up to but not including 4.2.3 are affected. The flaw arises because Highcharts Dashboards uses an unchecked property lookup to invoke chart constructors, allowing an attacker controlling dashboard configuration to execute arbitrary markup and event handlers in the hosting page's origin without user interaction. This issue is fixed in versions 4.2.3 and 13.1.0.
Highcharts JS versions from 12.0.0 up to but not including 12.6.1, and from 13.0.0 up to but not including 13.1.0, are vulnerable to a Cross-site Scripting (XSS) issue. This occurs because the library falls back to assigning raw markup to innerHTML before applying an allow-list when DOMParser fails. In Chromium browsers, this can lead to execution of untrusted HTML event handlers during printing, affecting various HTML-rendered chart elements. The vulnerability is fixed in versions 12.6.1 and 13.1.0.
CVE-2026-118242 is a cross-site scripting (XSS) vulnerability in Highcharts JS versions from 2.3.0 up to but not including 3.2.0. The issue arises because Highcharts Grid creates SVG path elements from icon definitions and copies child keys with setAttribute, allowing an attacker controlling the Grid configuration to inject event-handler attributes. This can lead to script execution in the context of the hosting page when a user interacts with the malicious icon. The vulnerability is fixed in version 3.2.0.
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column configuration can add event-handler attributes to every rendered row or to the control created when a cell enters edit mode. Script then runs in the hosting page origin when a user hovers over or focuses an input or begins editing. This issue is fixed in Grid Pro 3.2.0.
Highcharts JS versions from 10.3.2 up to but not including 11.4.9, from 12.0.0 up to but not including 12.6.2, and from 13.0.0 up to but not including 13.1.1 contain a cross-site scripting (XSS) vulnerability. This occurs because the SVG anchor xlink:href attribute is accepted without applying the allowed-scheme check used for href and src attributes. An attacker controlling chart text options can embed a javascript URL that executes script when the exported or server-rendered SVG is parsed and the link is activated. The issue is fixed in versions 11.4.9, 12.6.2, and 13.1.1.
HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an attacker to upload malicious or unauthorized files and directly access or download sensitive uploaded content, potentially leading to information disclosure, unauthorized access, or system compromise.
Acronis Cyber Protect 17 versions before build 42587 contain a cross-site scripting (XSS) vulnerability due to improper input validation. This vulnerability could allow an attacker with high privileges and user interaction to execute arbitrary code in the context of the affected application. The issue has been fixed in build 42587.
CVE-2026-16020 is a stored cross-site scripting (XSS) vulnerability in the Fazile BACAK DefterAsist Financial Advisor Platform. The flaw arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. This vulnerability affects versions up to and including 2026-10-27. The CVSS score is 5.4, indicating a medium severity level.
The Echo Knowledge Base plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability in versions up to and including 17.214.0. This flaw arises from improper input sanitization and output escaping of the 'new_kb_config' parameter, allowing attacker-controlled JSON data to be injected into a style element. Exploitation requires tricking a user with Editor-level or higher privileges to perform an action such as clicking a crafted link, leading to script execution in their browser.
The Cozy Blocks plugin for WordPress versions up to 2.2.27 is vulnerable to stored cross-site scripting (XSS) via certain block attribute parameters due to insufficient input sanitization and output escaping. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because wp_kses_post does not fully neutralize quote-only attribute-breakout payloads lacking '<' characters, leaving exploitable JSON attributes intact at render time.
The Hustle plugin for WordPress versions up to 7.8.14.3 is vulnerable to stored cross-site scripting (XSS) via the 'content[cta_label]' parameter. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. By default, only administrators have the capability to edit modules, but this can be delegated to lower roles such as Subscribers, potentially allowing exploitation at lower privilege levels.
The Document Embedder plugin for WordPress up to version 2.4.0 is vulnerable to stored DOM-based cross-site scripting (XSS). Authenticated users with contributor-level access or higher can inject malicious scripts via the content parameter. The exploit triggers when a user clicks the embedded document's Download button, causing execution of attacker-controlled scripts due to improper input sanitization and output escaping.
The Post Snippets – Custom WordPress Code Snippets Customizer plugin up to version 4.2.4 is vulnerable to stored cross-site scripting (XSS) via shortcode attributes. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because entity-encoded payloads bypass WordPress's wp_kses_post sanitization and are decoded by the plugin's shortcode filter at render time. This requires snippet shortcodes to be enabled for exploitation.
The Hustle plugin for WordPress versions up to 7.8.14.3 contains a stored cross-site scripting (XSS) vulnerability in the 'content[title]' parameter. This flaw allows authenticated users with custom-level access and the 'Create and Update Modules' capability granted via the plugin's permissions settings to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires explicit permission delegation by an administrator and is not enabled by default.
The Product Addons for Woocommerce – Product Options with Custom Fields WordPress plugin up to version 3.1.8 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of the 'fields[section][fields][row][col][type]' parameter. Authenticated users with shop manager-level privileges or higher can exploit this to inject malicious scripts that execute when other users view the affected pages.
CMB2, a WordPress plugin by jtsternberg, contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 2.13.4. The flaw exists in the 'cmb43ex1_grp[0][txt]' wysiwyg field inside a repeatable group, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the plugin's front-end form helper with this specific field configuration to be rendered on a publicly accessible page. The vulnerability arises from insufficient input sanitization and output escaping.
The easy.jobs WordPress plugin up to version 2.8.2 contains a stored cross-site scripting (XSS) vulnerability in the 'icon' attribute of its Gutenberg block. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping of user-supplied attributes.