CVE-2026-56840 is a high-severity cross-site scripting (XSS) vulnerability in MervinPraison's PraisonAI multi-agent teams system. Versions from 4.5.2 up to but not including 4.6.59 are affected. The vulnerability occurs because the HTTPApproval component renders attacker-controlled tool approval arguments directly into the approval dashboard HTML without proper sanitization. This allows an attacker to inject JavaScript that executes in the context of the dashboard when a human reviews the approval request. The injected script can automatically approve the tool request by sending a POST request to the approval endpoint. The issue has been fixed in version 4.6.59.
CGM CLININET contains a reflected Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input. An unauthenticated remote attacker can craft a malicious URL that executes JavaScript or HTML in a victim's browser, potentially allowing session cookie theft and unauthorized actions within the application. The vulnerability affects versions up to 2025.MS3. The product is a cloud service, and a patch is available.
CVE-2026-4952 is a cross-site scripting (XSS) vulnerability in the VertiGIS Ltd. WebOrderSystem (AuftragsManager) version 7.0.8.6 and earlier. Authenticated users can inject JavaScript code into a business reference field via the ASMobile web interface. While initially this self-XSS affects only the user entering the data, the malicious script is stored and later executed when a highly privileged user views the order in the OrderAdministration portal. No patch information is provided by the vendor.
CVE-2026-4951 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) version 7.0.8.6 and earlier. The vulnerability arises from improper handling of the "searchValue" URL parameter in the CustomerAdministration portal, allowing JavaScript code injection. An unauthenticated attacker can craft a malicious URL that executes script code in the browser of a privileged user who opens the link. Since administrative users can change other users' passwords without requiring the old password, exploitation could lead to account takeover or user lockout.
CVE-2026-4950 is a cross-site scripting (XSS) vulnerability in VertiGIS Ltd.'s WebOrderSystem (KundenManager) portal. Privileged users can inject JavaScript code into user properties such as the "secondName" parameter. This malicious code is stored and executed in the browsers of other privileged users who view the affected user entries or user group overviews. The vulnerability affects version 7.0.8.6 and earlier versions up to 0. No information on patches or fixed versions has been provided by the vendor.
The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress plugin before 0.9.2.8 does not validate or escape some of its form shortcode attributes, which can be pointed at values taken from the visitor's own request and are then output without escaping, allowing users with a role as low as contributor to have arbitrary script run in the browser of anyone led to open a crafted link or page, including a logged-in administrator.
This is an incomplete fix for CVE-2023-5292, whose deny-list covers only the three HTML wrapper attributes.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet content, so it can delete the markup that closes an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comments are published to inject event-handler attributes that run JavaScript in the browser of any visitor, including a logged-in administrator, viewing front-end pages while the optimization is enabled.
The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet content, so it removes a quote that terminates an attribute in the rendered page, and combined with unescaped comment author output this allows unauthenticated users whose comment is published to inject attributes that execute JavaScript in the browser of any visitor, including a logged-in administrator, who views front-end pages while the affected option is enabled.
A stored cross-site scripting (XSS) vulnerability exists in the User Profile Builder WordPress plugin versions before 4.0.5. The flaw arises because one shortcode attribute is not properly sanitized or escaped before being output in a redirect message. This allows users with contributor-level roles to inject malicious scripts that execute in the context of higher-privileged users who submit the affected form.
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVE-2026-109936 is a stored Cross-Site Scripting (XSS) vulnerability in the Otter Blocks WordPress plugin versions before 3.2.8. The flaw arises because the plugin does not properly limit a pattern used to rewrite dynamic-content tokens, allowing the pattern to consume the closing quote of an HTML attribute and inject unescaped data as new attributes. This enables unauthenticated attackers to inject malicious scripts that execute in the browsers of any visitors viewing the affected pages, including administrators.
CVE-2026-109933 is a cross-site scripting (XSS) vulnerability in the Otter Blocks WordPress plugin before version 3.2.8. It occurs because the plugin does not properly sanitize and escape user-supplied block styling values before embedding them into inline stylesheets. This flaw allows users with contributor-level access or higher to inject arbitrary scripts that execute when any visitor, including administrators, views the affected post. The vulnerability is fixed in version 3.2.8.
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 6.89.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires user registration to be open on the site, and script execution is triggered when an Administrator subsequently runs the plugin's user-spam scan and views the resulting Non-checkable users or Spam users tab — the plugin's own documented workflow.
CVE-2026-59188 is a cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.3. The server incorrectly sanitizes SVG files based on the file extension rather than the actual content type, allowing authenticated attackers to upload malicious SVG files disguised with non-SVG extensions. When users view these attachments inline, the embedded JavaScript executes in the context of the Part-DB origin. This vulnerability has been fixed in version 2.12.3.
CVE-2026-55600 is a stored cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.2. The issue arises because Part-DB renders BOM validation messages using Twig's |raw filter, allowing user-controlled Part names containing HTML markup to be injected. Although JavaScript execution is blocked by the Content Security Policy, arbitrary HTML elements such as links, forms, images, and CSS can still be injected into trusted pages. This vulnerability has been fixed in version 2.12.2.
CVE-2026-54615 is a stored cross-site scripting (XSS) vulnerability in Part-DB-server versions prior to 2.12.1. The flaw arises from a missing HTML escaping step in the CollectionElementDeleted branch of LogEntryExtraFormatter, allowing user-controlled names of deleted collection sub-elements to be injected as raw HTML in activity log and element history tables. This enables a low-privileged user to inject malicious scripts that execute in the browsers of higher-privileged users viewing the logs. The vulnerability is mitigated by Content Security Policy (CSP) restrictions that block inline JavaScript under normal conditions. The issue has been fixed in version 2.12.1.
Agent Zero versions before 1.15 contain a cross-site scripting (XSS) vulnerability in the Web UI. The flaw arises because user input in chat messages or file uploads is not properly sanitized. This allows attackers to inject JavaScript code that executes within the context of an authenticated user's session when the content is rendered in the chat interface. The vulnerability is fixed in version 1.15.