CVE-2026-96368 is a stored cross-site scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. This flaw has a medium severity rating with a CVSS score of 4.6. Fixed versions 6.2.12 and 6.3.1 address the issue.
CVE-2026-96357 is a stored cross-site scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and versions from 6.3.0 up to but not including 6.3.1. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96379 is a stored cross-site scripting (XSS) vulnerability in the Drupal CookieCuttr module. It affects versions from 2.0.0 up to but not including 2.0.3. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in version 2.0.3. The CVSS score is 3.5, indicating a low severity impact.
CVE-2026-96382 is a stored cross-site scripting (XSS) vulnerability in the Drupal Diba carousel slider module. It affects versions from 0.0.0 up to but not including 3.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has a medium severity with a CVSS score of 4.6. A fix is available in version 3.0.2.
CVE-2026-107588 is a high-severity cross-site scripting (XSS) vulnerability in Vaadin Charts, which uses a pinned version of the Highcharts library. The vulnerability arises from multiple vectors in the chart configuration, including Object.prototype writes via series.keys paths and XSS through credits.href, breadcrumbs.style, HTML text parsing during printing, and xlink:href attributes in exported charts. Applications are vulnerable if attacker-controlled data reaches these chart configuration options. Vaadin has released fixed versions that apply Highsoft's recommended workarounds while keeping the same Highcharts versions.
A stored cross-site scripting (XSS) vulnerability exists in Nuxt versions from 3.13.0 up to but not including 4.6.2. The issue arises because the server-island renderer improperly serializes raw useHeadSafe input without preserving its safe-input marker, allowing attacker-controlled data to be injected into the page head. This can lead to execution of malicious scripts in the context of the affected application. The vulnerability is fixed in Nuxt version 4.6.2.
A cross-site scripting (XSS) vulnerability exists in Nuxt versions prior to 4.6.0. This flaw arises from an incomplete fix for a previous issue (CVE-2026-53722) where an attacker can craft a script-capable URL by prefixing attacker-controlled input with an ASCII C0 control character. The no-pages router misclassifies such input as an internal route and renders it in an anchor href, which browsers then interpret as a javascript: URL after removing the control character. Exploitation requires a victim to click the malicious link, leading to script execution within the application's origin. The vulnerability is fixed in Nuxt version 4.6.0.
Astro versions prior to 7.3.2 contain a cross-site scripting (XSS) vulnerability in their JSX and MDX rendering pipeline. The vulnerability arises because string children of script and style elements are treated as trusted HTML without proper distinction between compiler-generated literals and dynamic expressions. This allows attacker-controlled data to inject arbitrary HTML and JavaScript if passed directly as dynamic children. The issue is fixed in version 7.3.2.
CVE-2026-114127 is a low-severity cross-site scripting (XSS) vulnerability in the Astro web framework versions 7.1.0 through 7.3.2. The issue arises from Astro's server-side View Transition CSS generator, which improperly handles string animation properties, allowing attacker-controlled input to inject additional CSS rules. Although the injection cannot break out of the style element or inject HTML/JavaScript directly, it can manipulate the page's appearance and potentially expose data through CSS-based techniques. This vulnerability is fixed in version 7.3.3.
A Cross-site Scripting (XSS) vulnerability exists in odf-kit versions from 0.6.0 up to but not including 0.14.2. The issue arises because certain inline CSS style attributes are not properly escaped when rendered into HTML, allowing malicious input to break out of style attributes and inject executable code. This vulnerability was patched in version 0.14.2.
CVE-2024-5139 is a cross-site scripting (XSS) vulnerability in the Authentication Endpoint of WSO2 Enterprise Integrator. The endpoint improperly encodes user input, allowing attackers to inject malicious JavaScript. Exploitation can lead to browser redirection, UI manipulation, or theft of sensitive browser information. Session hijacking is prevented by the httpOnly flag on session cookies. Multiple versions prior to specific fixed releases are affected.
The Jane Menu WordPress plugin before 1.5.1 does not have any capability or nonce checks on one of its form handlers, which is reachable by unauthenticated users, allowing them to bind any published page to a remote document of their choosing. The plugin then fetches that document and outputs its head and body into the page without escaping, so an unauthenticated attacker can run arbitrary JavaScript in the browser of any visitor to that page, including an administrator.
The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a page when rewriting links for a translated language, and reverses the encoding that was applied to them beforehand, allowing unauthenticated users to store a payload which executes in the browser of anyone viewing the page in a translated language.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking only their elements and attributes, allowing users with the Contributor role and above to store a payload which breaks out when the SVG is rendered inline in a page and executes in the browser of any user viewing it. Execution is specific to Chromium-based browsers; Firefox is not affected.
The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route, allowing users with the Author role and above to upload a file containing JavaScript, which will run in the browser of any user who opens it. Exploitation requires unfiltered file uploads to be enabled in the Elementor Website Builder WordPress plugin before 4.3.5 settings, which is not the default.
The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG before sanitising it, allowing users granted file-manager access by an administrator to store a file containing script that is not stripped and that runs in the browser of anyone who opens it, including an administrator.
The User Profile Builder WordPress plugin before 4.0.1 does not escape the current page URL before outputting it in a JavaScript context on one of its admin pages, leading to Reflected Cross-Site Scripting against high-privilege users.
The Redirection for Contact Form 7 WordPress plugin before 3.2.12 does not sanitise or escape submitted form data stored as lead entries before outputting it in the lead debug metabox, allowing unauthenticated attackers to store a malicious script that executes when a logged-in user views the entry with the Redirection for Contact Form 7 WordPress plugin before 3.2.12's debug mode enabled.