The WP Booking System WordPress plugin before 2.1.0.3 does not validate and escape one of its parameters before reflecting it back in an admin page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as administrators.
The HireZoot WordPress plugin before 4.1.1 does not sanitise and escape some of its stored data before outputting it in the admin dashboard, and additionally reverses the HTML-entity encoding that would otherwise neutralise it, allowing users with the Author role to perform Stored Cross-Site Scripting attacks that execute in the context of a logged-in administrator.
The Falang multilanguage for WordPress plugin before 1.4.6 does not perform a capability check when saving term translations, and exposes a valid nonce to any logged-in user through an unprotected handler, allowing users with Subscriber-level access and above to store content that is later output without proper escaping, leading to Stored Cross-Site Scripting that executes in the context of higher-privileged users such as administrators.
IBM Carbon Charts versions 0.4.0 through 1.27.19 contain a cross-site scripting (XSS) vulnerability in the MeterChart component. The vulnerability arises because the Title.truncateTitle() function unsafely inserts a substring of user-supplied label text into the DOM using innerHTML without proper sanitization. This flaw allows a remote attacker to execute arbitrary JavaScript in the context of the victim's browser session.
Cachet versions 2.4.1 and earlier contain a stored Cross-Site Scripting (XSS) vulnerability in the incident creation form. This flaw allows an authenticated attacker to inject malicious HTML or JavaScript, which executes in the browsers of users viewing the status page. Exploitation could lead to session token theft and account takeover. The issue has been patched in later commits in the cachethq/core repository.
CVE-2026-111088 is a stored Cross-Site Scripting (XSS) vulnerability in the Stormshield Network Security product, specifically affecting the VPN log monitoring screen. The flaw allows an attacker with low privileges to inject malicious scripts that can be executed in the context of other users viewing the logs. The vulnerability affects multiple versions of the product from 4.3.0 through 5.1.3. The CVSS 3.1 base score is 6.5, indicating a medium severity impact primarily on confidentiality. No public exploits or patches are currently documented.
CVE-2026-113810 is a stored Cross-Site Scripting (XSS) vulnerability in the Stormshield Network Security enrollment portal. An attacker can inject malicious scripts via the captive portal when requesting certificate creation for a user. The stored XSS payload is triggered only during validation by an administrator.
CVE-2026-113808 is a stored Cross-Site Scripting (XSS) vulnerability in the Stormshield Network Security (SNS) enrollment portal. An attacker can inject malicious scripts via the captive portal during user creation requests. The stored XSS payload is triggered only when an administrator validates the input. This vulnerability affects multiple versions of the product and has a high severity rating with a CVSS score of 7.1.
ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to unsafe handling of meta refresh elements in the sanitize-html library before version 2.18.0. This flaw allows unsafe script or redirect destinations to be retained in the refresh content value under a non-default configuration. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
ApostropheCMS versions prior to 4.33.0 contain a cross-site scripting (XSS) vulnerability in the admin bundle. An unauthenticated attacker can craft a link with a specially constructed query string that exploits the apos.http.parseQuery function's handling of prototype-related keys. When an authenticated admin user loads a page with this crafted link, malicious script can execute in their session. This vulnerability is fixed in version 4.33.0.
ApostropheCMS versions prior to 4.33.0 and sanitize-html versions from 2.17.7 up to but not including 2.18.0 contain a cross-site scripting (XSS) vulnerability. This occurs due to a bypass in the SMIL URL protection when namespace-prefixed SVG animation elements and certain URL-targeting attributes are allowed, enabling unsafe URI rewriting and script execution upon user interaction. The default sanitizer configuration is not universally affected. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
ApostropheCMS versions prior to 4.33.0 are affected by a cross-site scripting (XSS) vulnerability due to improper sanitization of noscript tag content in the sanitize-html library before version 2.18.0. This flaw allows content intended to be inert to survive sanitization and render in scripting-enabled browsers, potentially enabling XSS attacks. The issue is fixed in sanitize-html 2.18.0 and ApostropheCMS 4.33.0.
SolarWinds Observability Self-Hosted contains a stored Cross-Site Scripting (XSS) vulnerability (CWE-79) that allows authenticated attackers to inject malicious scripts. These scripts execute in the browsers of other authenticated users who visit the affected pages, potentially leading to information disclosure or session manipulation. The vulnerability has a CVSS score of 4.6, indicating medium severity. No specific affected versions or patches have been disclosed yet.
## Summary
ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form `string` style field with a CSS `property` and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget wrapper's `style="..."` attribute without HTML-attribute escaping.
An attacker who can edit the widget can include a double quote in the style value, terminate the `style` attribute, and inject new HTML event-handler attributes. The payload is stored with the widget and executes in the Apostrophe site origin whenever the affected published page is rendered.
This is a sibling of CVE-2026-33889 / `GHSA-97v6-998m-fp4g`. The earlier issue escaped from a `<style>` element through a malicious color value. This variant reaches a different sink related to the automatically generated widget wrapper's inline `style` and `class` attributes.
## Details
### Root Cause 1: Free-form string style values retain HTML metacharacters
The standard string field converter uses `launder.string()` and length validation. This performs type normalization, not output encoding for an HTML attribute context:
[`packages/apostrophe/modules/@apostrophecms/schema/lib/addFieldTypes.js:296-333`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/schema/lib/addFieldTypes.js#L296-L333)
```javascript
self.addFieldType({
name: 'string',
// ...
convert(req, field, data, destination) {
destination[field.name] = self.apos.launder.string(data[field.name]);
destination[field.name] = checkStringLength(
destination[field.name],
field.min,
field.max
);
}
});
```
Quotes therefore remain in a value supplied through a style field.
### Root Cause 2: The value is converted into inline CSS without value validation
For a field with `property` but no `selector` or media query, `renderScopedStyles()` selects inline rendering. The generic extractor concatenates the configured property and editor-controlled value:
[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:171-228`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L171-L228)
[`packages/apostrophe/modules/@apostrophecms/styles/ui/apos/universal/render.mjs:598-647`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/ui/apos/universal/render.mjs#L598-L647)
```javascript
rule = `${property}: ${normalized.value}${normalized.unit}`;
// ...
if (isInline) {
return {
css: '',
classes: [ ...storage.classes ],
inline: stringifyRules(storage.styles, true)
};
}
```
For example, the value below becomes part of a `font-family` declaration:
```text
serif" tabindex="0" autofocus onfocus="document.body.dataset.inline='executed'
```
### Root Cause 3: Attribute values are serialized without HTML escaping
`getWidgetAttributes()` places the inline CSS into an attribute tuple, then concatenates every tuple into `key="value"` without encoding `&`, `<`, `>`, `'`, or `"`:
[`packages/apostrophe/modules/@apostrophecms/styles/lib/methods.js:251-322`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/styles/lib/methods.js#L251-L322)
```javascript
if (styleParts.length) {
attrs.push(
[ 'style', `${styleParts.join(';')};` ]
);
}
if (options.asObject) {
return Object.fromEntries(attrs);
}
return attrs
.map(([ key, value ]) => `${key}="${value}"`)
.join(' ');
```
The same raw serializer also makes a project-defined free-form `string` style with `class: true` a potential sibling path, because the string is added to `classes` and later serialized into `class="..."`. The inline-property path was the path dynamically verified.
### Root Cause 4: The unsafe string is used by the automatic public wrapper
Styled widgets use `getWidgetAttributes()` to create a wrapper around the rendered widget:
[`packages/apostrophe/modules/@apostrophecms/widget-type/index.js:448-457`](https://github.com/apostrophecms/apostrophe/blob/aa5170c7df9ff9ea5ac2e72a008f12e28dae6ca8/packages/apostrophe/modules/%40apostrophecms/widget-type/index.js#L448-L457)
```javascript
if (hasStyles && self.options.stylesWrapper !== false) {
const styles = self.apos.styles.prepareWidgetStyles(widget);
const styleTag = self.apos.styles
.getWidgetElements(styles, { scene: req.scene });
const wrapperAttrs = self.apos.styles.getWidgetAttributes(styles);
return `${styleTag}<div${wrapperAttrs ? ' ' + wrapperAttrs : ''}>${markup}</div>`;
}
```
Consequently, the injected attribute is present on normal public page renders, not only in the editor UI.
### Why the CVE-2026-33889 defense does
### Summary
The color field accepts any string that *begins* with a valid `rgb()` / `hsl()` color, because `TinyColor.isValid` does not anchor its match at the end of the string. An authenticated user with edit rights can store arbitrary HTML after a valid color prefix. When the stored value is rendered , the payload executes, resulting in stored XSS.
### Details
Server-side validation of the color field relies on TinyColor:
```js
const { TinyColor } = require('@ctrl/tinycolor');
if (!new TinyColor(value).isValid) throw self.apos.error('invalid');
```
TinyColor's `rgb`/`hsl` matchers are not anchored at the end of the string, while hex matchers are. Tested with @ctrl/tinycolor
| Input | `isValid` |
|---|---|
| `rgb(1,2,3)<img src=x onerror=alert(1)>` | `true` |
| `rgb(1,2,3)</textarea><script>alert(1)</script>` | `true` |
| `hsl(0,100%,50%);--x:1}</style><script>alert(1)</script>` | `true` |
| `#ff0000<img src=x onerror=alert(1)>` | `false` |
The value is saved to MongoDB unchanged (not normalized to hex8).
### Relation to GHSA-97v6-998m-fp4g
GHSA-97v6 addressed CSS custom property injection escaping a `<style>` context. The root cause (validation that accepts trailing content after a valid color) still exists in <= 4.32.2, so [FILL IN: either "the style-tag sink remains exploitable via `</style>`" OR "a separate HTML sink at X is exploitable"]. Fixing the validation (requiring the full string to be a color, or storing only TinyColor's normalized output) would close both.
### Impact
Any user with edit permission can plant persistent JavaScript that runs in the browser of visitors and administrators viewing the affected page, enabling session hijacking and actions as an admin.
### Suggested fix
Reject values unless the entire string is a valid color, e.g. normalize on save:
```js
const c = new TinyColor(value);
if (!c.isValid) throw self.apos.error('invalid');
value = c.toHex8String(); // store only normalized output
```
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.
This issue affects Ticimax E-Commerce Platform: through 2026-09-02.
Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.
Values entered by visitors were placed into the HTML summary email without being escaped. An unauthenticated attacker could use this to inject HTML into an email that is shown to the recipient.
FacturaScripts version 2025.61 has a vulnerability allowing unauthenticated attackers to enumerate valid usernames by observing differences in login responses. This can enable targeted attacks such as brute-force or social engineering against confirmed accounts.
CVE-2026-11959 is a stored Cross-Site Scripting (XSS) vulnerability in FacturaScripts version 2025.61. It arises from insufficient validation or sanitization of user input in the 'city' and 'province' fields of the 'ListAlmacen' endpoint. Exploitation could allow attackers to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to privilege escalation from normal user to administrator, session hijacking, and compromise of system confidentiality.