Search: xss.is

Highcharts JS versions from 10.0.0 up to but not including 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because breadcrumbs.style is applied as SVG attributes without filtering attribute names, allowing attackers controlling chart configuration to inject event-handler keys. This leads to execution of malicious scripts in the context of the hosting page when users interact with breadcrumb buttons. Styled-mode charts are not affected. The vulnerability is fixed in versions 11.4.9, 12.6.1, and 13.1.1.

Stage File Proxy is a Drupal module designed to fetch production files on development servers. It is not intended for use on production sites. A vulnerability exists due to insufficient validation of file URLs during fallback retrieval, leading to a cross-site scripting (XSS) vulnerability. Exploitation requires the module to be enabled on the target site and the attacker to have the ability to upload a malicious file to the configured origin server. Fixed versions 3.1.7 and 4.0.1 address this issue.

The Sign widget module for Drupal allows users to create and save signatures as SVG images. A vulnerability exists due to insufficient sanitization of user-supplied content before saving it to the public file system. This flaw can lead to a cross-site scripting (XSS) vulnerability if a maliciously crafted file is uploaded. The issue is fixed in version 1.15.0 of the module.

CVE-2026-118242 is a cross-site scripting (XSS) vulnerability in Highcharts JS versions from 2.3.0 up to but not including 3.2.0. The issue arises because Highcharts Grid creates SVG path elements from icon definitions and copies child keys with setAttribute, allowing an attacker controlling the Grid configuration to inject event-handler attributes. This can lead to script execution in the context of the hosting page when a user interacts with the malicious icon. The vulnerability is fixed in version 3.2.0.

The Drupal AI module has a cross-site scripting (XSS) vulnerability due to insufficient sanitization of certain HTMX attributes. This flaw affects versions prior to 1.4.11 and versions from 1.5.0 up to but not including 1.5.2. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module contains a vulnerability where insufficient validation of Markdown links under certain conditions can lead to cross-site scripting (XSS). This flaw allows attackers to inject malicious scripts via Markdown links. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module includes an AI Chatbot submodule that under certain configurations does not properly filter user input before rendering, leading to a potential cross-site scripting (XSS) vulnerability. Exploitation requires attacker access to administer blocks, limiting the attack surface. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal AI module contains a cross-site scripting (XSS) vulnerability due to insufficient restrictions on HTML rendering. Exploitation requires the attacker to have access to a text format that permits HTML rendering. Fixed versions 1.4.11 and 1.5.2 address this issue.

The Drupal Commerce Stripe module versions 2.0.0 up to but not including 2.2.3 contain a cross-site scripting (XSS) vulnerability that may be exposed under rare circumstances. Exploitation requires the attacker to have administrator permissions to configure payment gateways and also depends on the compromise of an external service. The vulnerability has been fixed in version 2.2.3.

A stored cross-site scripting (XSS) vulnerability exists in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier. The flaw arises because text shown in the tooltips of breadcrumb bar overflow menu entries is not properly escaped. Attackers with Overall/Read permission can exploit this vulnerability.

A cross-site scripting (XSS) vulnerability exists in Jenkins 2.587 and earlier, including LTS 2.580.1 and earlier. This flaw allows agents to send exceptions implementing the Stapler HttpResponse interface to the controller, which can be exploited by attackers controlling agent processes.

A cross-site scripting (XSS) vulnerability exists in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier. The flaw arises because Jenkins computes the URL of links shown in the workspace browser on the agent side, which can be exploited by attackers controlling agent processes to inject malicious scripts.

A vulnerability in Jenkins versions 2.587 and earlier, including LTS 2.580.1 and earlier, allows attackers with access to POST config.xml API endpoints to submit crafted configuration files that bypass item type restrictions after deserialization. This can lead to stored cross-site scripting (XSS) vulnerabilities.

A stored cross-site scripting (XSS) vulnerability exists in WP Discussion Board versions up to 2.6.0. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity impact with potential confidentiality, integrity, and availability consequences.

A stored cross-site scripting (XSS) vulnerability exists in SliceWP versions up to 1.2.13 due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of other users. The flaw affects confidentiality, integrity, and availability of the affected system.

A stored cross-site scripting (XSS) vulnerability exists in Stiofan GetPaid invoicing software, affecting versions up to 2.8.62. This vulnerability allows improper neutralization of input during web page generation, which can lead to script injection. The flaw has a high severity rating with a CVSS score of 7.1.

A stored cross-site scripting (XSS) vulnerability exists in Crowd Favorite DXP ToolKit up to version 2.0.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a high severity score of 7.1 (CVSS 3.1) and affects confidentiality, integrity, and availability.

A reflected Cross-site Scripting (XSS) vulnerability exists in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) versions up to 2.0.24. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the affected web application.

A reflected Cross-site Scripting (XSS) vulnerability exists in impleCode eCommerce Product Catalog versions up to 3.6.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in the context of a user's browser session.

CVE-2026-112356 is a cross-site scripting (XSS) vulnerability in the Webmail component of GFI KerioConnect before version 10.0.9 Patch 2. It allows remote attackers to inject malicious HTML or script by sending crafted emails that exploit the link auto-formatter's improper handling of already-linked text. This can lead to script execution in the context of an authenticated victim's Webmail session.