The All-in-One Video Gallery plugin for WordPress versions up to 4.9.7 contains a stored cross-site scripting (XSS) vulnerability via the 'custom_fields[embedcode]' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with a logic flaw in the save_meta_data() handler that bypasses sanitization during XML-RPC requests. The plugin also grants subscribers the capability to publish videos, enabling exploitation through a single XML-RPC call.
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin up to version 3.9.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'atkp_product_producturl' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires the plugin's AJAX loading or AJAX handler option to be enabled, or contributor-level access if these options are not configured.
The AMP for WP – Accelerated Mobile Pages WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.1.17. This vulnerability arises from insufficient input sanitization and output escaping of the 'headline-*' shortcode attribute. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The issue is exacerbated by WordPress core's wp_filter_kses() function, which does not remove shortcode syntax, and the AMP content sanitizers running before shortcode processing, leaving the injected markup unsanitized.
The AI Marketing Expert WordPress plugin (versions up to and including 1.2.8) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'name' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrators accessing the injected pages. Exploitation requires the chatbot module to be active with at least one configured bot. The attacker can store the payload through unauthenticated REST calls, which the JavaScript widget then delivers to administrators automatically.
The All-in-One Video Gallery plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via the 'more_link' parameter in versions up to and including 4.9.7. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Member WordPress plugin versions up to and including 2.14.0. The flaw arises from insufficient sanitization and escaping of the 'user_url' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when other users view the affected profile pages, triggered by clicking the attacker's Website URL link on public profiles. The vulnerability has a medium severity rating with a CVSS score of 6.4.
CVE-2026-50571 is a cross-site scripting (XSS) vulnerability in the W3C WebSub recommendation related to the intent-verification protocol. The vulnerability arises because the protocol requires subscribers to echo back a challenge value without enforcing safe response media types or disabling MIME sniffing. This can allow an attacker to craft a verification request that executes malicious HTML or JavaScript in the subscriber's origin, potentially exposing private data and browser permissions. The advisory notes that safe media typing and the use of the X-Content-Type-Options: nosniff header are necessary to mitigate these issues. No practical impact has been established on demonstration sites, and no known exploits are reported in the wild.
JeromeDevome GRR versions prior to 4.5.0 contain a reflected cross-site scripting (XSS) vulnerability in the maj.php script related to improper escaping of the forcemaj parameter when installation files remain accessible. This vulnerability allows attackers to execute arbitrary JavaScript in the context of a victim's browser, potentially enabling phishing, redirection to malicious sites, cookie theft, and session hijacking due to the authentication cookie not being HttpOnly. The issue is resolved in version 4.5.0.
CVE-2026-97045 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises from improper handling of namespace transitions in the HTML parser, where the ancestor chain was not fully walked, potentially allowing literal text emission in unexpected foreign namespaces. This flaw was fixed in version 0.62.0 of the package.
A stored Cross-Site Scripting (XSS) vulnerability exists in the media plugin of TinyMCE. This flaw allows attackers to inject malicious scripts via elements crafted through the data-mce-object attribute, which are executed before proper sanitization. The vulnerability affects TinyMCE versions 7.9.3 and 8.5.1 up to but not including 7.9.4 and 8.9.3 respectively. It has been patched in TinyMCE 7.9.4 and 8.9.3. No official workaround is available other than upgrading.
CKEditor 5 versions from 45.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability due to prototype pollution in a vulnerable es-toolkit version used by the editor's engine. This flaw allows crafted editor content with malicious style attribute values to execute unauthorized JavaScript in the browser. The issue is resolved in versions 47.7.4 and 48.5.1.
CKEditor 5 versions from 29.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability when General HTML Support is enabled and configured to allow object content. This vulnerability allows specially crafted markup to execute attacker-controlled JavaScript in a browser context isolated from the embedding application's origin. The issue is fixed in versions 47.7.4 and 48.5.1.