CWE-79: Cross-site Scripting vulnerabilities

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web application of the Castile-La Mancha Regional Parliament’s video library. This flaw allows user-supplied content to be embedded without proper sanitization, enabling remote attackers to execute arbitrary JavaScript in the browsers of users who interact with crafted content. The vulnerability has a medium severity rating and a CVSS 4.0 score of 5.1. A fix was released in October 2026.

A cross-site scripting (XSS) vulnerability exists in the GiveWP WordPress plugin versions before 4.19.0.1. The plugin fails to properly sanitize and escape a donation form template setting before outputting it inside an HTML attribute. This allows users with a custom form-editing role to inject arbitrary scripts that execute in the browsers of visitors or administrators who open the affected donation form.

CVE-2025-15705 is a cross-site scripting (XSS) vulnerability in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The flaw arises because the plugin does not properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can cross privilege boundaries when administrators lack the unfiltered_html capability. The issue is fixed in version 1.8.0.

CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the 'Notes' field of the Checklists feature in Cervantes version v1.3-beta. This flaw could allow an attacker with limited privileges to execute arbitrary code in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

The WPVR WordPress plugin before 9.0.3 does not properly sanitise and escape some of its tour hotspot content before storing it and outputting it on the front end, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected tour.

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any user viewing the affected content.

The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site before fetching it client-side and rendering part of the response in the page, which allows unauthenticated attackers to execute arbitrary JavaScript in the browser of any user who is tricked into clicking a crafted link.

The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its AJAX actions, and exposes the nonce protecting it to any user able to access the admin dashboard, allowing users with a role as low as Contributor to overwrite the Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3's tracking configuration and have arbitrary JavaScript executed in the browsers of all visitors, including administrators.

A cross-site scripting (XSS) vulnerability exists in the yahoo serialize-javascript library prior to version 7.1.3. The flaw arises because the function-source escaping logic fails to neutralize a bare closing-script prefix when attacker-controlled function source text ends exactly at that prefix. This can allow an attacker who controls a serialized function's source text to inject malicious markup that becomes live in the page. The issue is fixed in version 7.1.3.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the registration module of phpBB versions 3.3.0 through 3.3.18 due to improper input sanitization. This flaw allows attackers to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to data theft or session hijacking.

An authenticated stored cross-site scripting (XSS) vulnerability exists in the Phoca Gallery extension for Joomla versions 4.5.0 through 6.1.5. The flaw allows injection of malicious HTML attributes, potentially leading to high-impact client-side code execution when a user views the affected content.

CVE-2026-55486 is a critical cross-site scripting (XSS) vulnerability in the intranda goobi-viewer-core web application. It affects versions from 25.08 up to but not including 26.05. The vulnerability arises because the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without proper validation, which is then embedded unsafely into the Content-Security-Policy header and HTML response body, enabling reflected XSS attacks. The issue has been fixed in version 26.05.

baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because global shortcode expansion processes the entire rendered page, including HTML-escaped blog comments from unauthenticated users. An attacker can inject a malicious script URL via the BcBaser.getGoogleMaps shortcode in a comment, which executes when an administrator or visitor views the affected article. Other shortcodes like Mail.getForm can embed active forms with valid CSRF tokens. The vulnerability is patched in versions 5.3.2 and 5.4.2.

CVE-2026-93638 is a reflected cross-site scripting (XSS) vulnerability in the login page of Zimbra Collaboration Suite (ZCS) versions up to 10.1.17. It allows an unauthenticated attacker to inject JavaScript via the zrememberme parameter in a crafted relogin URL. This causes attacker-controlled script execution under the legitimate Zimbra origin, potentially enabling credential theft through a fake login form. The attack logs out any existing session before rendering the payload, so it does not grant access to the victim's mailbox.

CVE-2026-93633 is a cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) versions up to 10.1.20. It arises from improper sanitization of CSS stylesheets containing non-ASCII characters, allowing an authenticated user with Briefcase access to publish documents that can display attacker-controlled content under the Zimbra origin. This can enable attackers to share crafted documents that load external resources and present credential-collection forms using Zimbra's own visual assets. Exploitation requires the victim to open the malicious document in a browser that renders the content inline, and credential theft requires user form submission.

CVE-2026-10632 is a reflected cross-site scripting (XSS) vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) version 10.1.16 and earlier. The flaw occurs due to improper HTML encoding of the packages parameter in the /h/rest document editor, allowing JavaScript injection. When combined with CVE-2026-50053, an attacker with a valid Zimbra account can craft a URL that executes JavaScript in another signed-in user's browser session, enabling unauthorized mailbox data access and authenticated actions. This vulnerability was fixed in ZCS version 10.1.17.

CVE-2026-55422 is a cross-site scripting (XSS) vulnerability in the conda-forge.github.io website, which is part of the conda-forge GitHub organization. The issue arises because two React components render externally sourced strings directly as HTML using dangerouslySetInnerHTML without sanitization. These strings include raw output from build logs and other process outputs embedded in JSON files generated by the conda-forge autotick bot. At the time of disclosure, no patches are publicly available.