It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel.
To exploit this vulnerability, an attacker would need to craft a URL containing a malicious script payload within a specific parameter and lure an authenticated administrator into visiting that link.
The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload executes when an administrator visits the DiviGear > Activation settings page, where the unsanitized stored value is echoed unescaped into a single-quoted HTML value attribute.
A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting (XSS) flaw allows an attacker to execute arbitrary JavaScript in the origin of an affected LIFF application's endpoint when a user opens a specially crafted URL in an external browser, potentially leading to disclosure of JavaScript-accessible authentication tokens or application data, or unauthorized actions using the user's session.
IBM Cloud Pak System versions 2.3.6.0 and 2.3.6.1 contain a stored cross-site scripting (XSS) vulnerability. The web application does not properly sanitize or HTML-encode user-supplied input before storing and rendering it. An authenticated attacker can exploit this by submitting malicious JavaScript payloads that are saved and later executed when other users view the affected pages. This vulnerability can lead to the execution of arbitrary scripts in the context of the victim's browser session.
IBM Concert versions 1.0 through 3.0.0 are affected by a cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject arbitrary JavaScript into the web interface, potentially altering functionality and leading to credential disclosure within trusted sessions. The vulnerability has a medium severity rating with a CVSS score of 6.1.
CVE-2025-6623 is a cross-site scripting (XSS) vulnerability in the WSO2 API Manager's carbon console. The vulnerability arises because user-supplied XML input is not properly encoded, allowing injection of malicious scripts. Exploitation enables remote attackers to execute arbitrary JavaScript in the victim's browser context, potentially redirecting users or modifying the web page interface. Session hijacking is mitigated by the httpOnly flag on session cookies. Multiple versions prior to specific fixed releases are affected.
A cross-site scripting (XSS) vulnerability exists in mljar mercury versions 3.0.0 through 3.2.10. The vulnerability arises because mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML, allowing malicious HTML and event-handler attributes to execute in the browser when viewed by another user. This issue is fixed in version 3.2.11.
CVE-2026-64944 is a Cross-site Scripting (XSS) vulnerability in Apache Answer versions up to 2.0.2. The issue arises because imported question bodies are stored as raw HTML without sanitization, allowing attacker-controlled HTML to be persisted and rendered to all users, including privileged ones. This vulnerability is fixed in version 2.0.3.
MISP versions prior to 2.5.48 contain a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. This flaw arises because parameter names returned by the misp-modules service are rendered as raw HTML without proper output encoding. An attacker who can influence these parameter names may inject arbitrary JavaScript that executes in the context of an authenticated user's browser, potentially leading to session token theft or unauthorized actions.
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.
A Cross-Site Scripting (XSS) vulnerability exists in the WP Photo Album Plus WordPress plugin before version 9.2.11.002. The flaw arises because the plugin does not properly escape a category navigation value before reflecting it into a JavaScript event handler on gallery breadcrumb links. This allows unauthenticated attackers to inject arbitrary scripts that execute in the browser of anyone who clicks the crafted breadcrumb link, including logged-in administrators.
CVE-2026-110033 is a cross-site scripting (XSS) vulnerability in the Salon Booking System WordPress plugin versions before 10.31.11. It allows users with the Salon Staff role or higher to supply an image URL that the server fetches and writes to a public location under an attacker-chosen filename. This can lead to disclosure of internal-only resources and storage of malicious SVG files that execute arbitrary scripts in the site's origin.
The European VAT Compliance Assistant for WooCommerce plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability via the CF-IPCountry header in all versions up to and including 1.36.10. This vulnerability allows unauthenticated attackers to inject malicious scripts that are stored in order post-meta during guest checkouts and executed when users access the affected pages.
The YMC Filter WordPress plugin up to version 3.12.19 is vulnerable to stored DOM-based cross-site scripting (XSS) via the 'post_title' parameter. Authenticated users with author-level access or higher can inject malicious scripts that execute when any user accesses the affected page. The vulnerability is exacerbated by an autocomplete REST endpoint that allows unauthenticated users to trigger the injected payload simply by interacting with the search box.
The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'mmdwqzpoxadd' parameter. This affects all versions up to and including 2.8.61. The vulnerability allows unauthenticated attackers to inject malicious scripts that execute when an administrator views the affected invoice's Payment Form Details metabox. The nonce required for form submission is publicly exposed, enabling exploitation without authentication.
The EU VAT Assistant for WooCommerce WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'vat_number' parameter in all versions up to and including 2.1.30.260413. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the administrator's browser when reviewing orders, potentially leading to privilege escalation and full site takeover through rogue administrator account creation.
Themify Popup plugin for WordPress versions up to and including 1.4.7 contains a stored cross-site scripting (XSS) vulnerability via the 'popup_width_unit' parameter. Authenticated users with author-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Themify Builder plugin for WordPress up to version 7.8.2 contains a stored cross-site scripting (XSS) vulnerability via the 'visible' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts into pages, which execute when those pages are viewed. Exploitation requires the 'slider' custom post type to be active, which occurs automatically with certain themes or plugins. The vulnerability arises from insufficient input sanitization and output escaping.