CVE-2026-111095 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity affecting versions before 2026.2, including 2026.1.4 and 2025.11.8. The vulnerability exists in the classic project overview feature, allowing malicious scripts to be stored and potentially executed. It has a high severity with a CVSS score of 8.0. No explicit patch links are provided in the input data.
CVE-2026-58390 is a cross-site scripting (XSS) vulnerability in the OPNsense core firewall platform prior to version 26.1.11. It affects the OpenVPN connection-status dashboard widget and view, where a client common_name is inserted into HTML attributes without proper quote-safe encoding. Exploitation requires an OpenVPN server configured with username-as-common-name and RADIUS or LDAP authentication, plus the ability to provision or self-register a username containing a double quote. An authenticated client can inject script that executes in an administrator's session when viewing the dashboard or connection-status page. The vulnerability allows reading config.xml, invoking privileged APIs, resetting the root password, and obtaining root command execution. This issue is fixed in version 26.1.11.
A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The vulnerability occurs because the certificate description field in the SSL Certificate selector does not properly escape HTML metacharacters, allowing a user with the page-system-certmanager privilege to inject markup. This markup executes when another user with access opens the System Settings Administration page. The issue is fixed in version 26.1.11.
CVE-2026-58392 is a cross-site scripting (XSS) vulnerability in the OPNsense core firewall and routing platform. The issue occurs on the NTP GPS page prior to version 26.1.11, where user-supplied input is improperly neutralized, allowing stored XSS. An attacker with page-services-ntp-gps privilege can inject malicious scripts that execute in the context of other users viewing the GPS page, potentially enabling theft of CSRF tokens and execution of authenticated actions. This vulnerability is fixed in version 26.1.11.
A cross-site scripting (XSS) vulnerability exists in OPNsense core prior to version 26.1.11. The issue arises from improper encoding of stored category names and alias descriptions placed into HTML title attributes, allowing injection of script code. An authenticated user with Firewall Categories or Firewall Alias Edit privileges can exploit this by crafting malicious input that executes in the session of an administrator or other user viewing the affected Rules or NAT page. This can lead to unauthorized actions performed with the victim's privileges. The vulnerability is fixed in version 26.1.11.
EspoCRM versions prior to 9.3.9 contain a cross-site scripting (XSS) vulnerability. An unauthenticated remote attacker can send an email with arbitrary HTML in the plain-text body to a monitored group or IMAP address, including email-to-Case addresses. EspoCRM stores and renders this HTML without proper escaping in Email Received stream notification emails sent to users, enabling HTML injection and potential JavaScript execution in mail clients that process these emails. This vulnerability is fixed in version 9.3.9.
CVE-2026-106153 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2011.3.1007 up to but not including 2026.3.1015. The issue arises because the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper sanitization or HTML attribute encoding. An attacker with low privileges who can control these values can inject malicious JavaScript that executes in the context of users interacting with the affected calendar components, potentially compromising confidentiality and integrity of accessible data.
CVE-2026-106150 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery affecting the Splitter, Window, and Tooltip components. Versions from 2011.2.804 and 2013.1.319 up to but not including 2026.3.1015 are vulnerable. The issue arises because these components improperly sanitize URL values and do not encode iframe titles correctly, allowing attackers with low privileges to inject malicious JavaScript. Exploitation requires user interaction and can compromise confidentiality and integrity of data accessible in the user's browser.
CVE-2026-47790 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc.'s QuFTP Service. The flaw allows a remote attacker with a user account to inject malicious code. The vulnerability has been fixed in QuFTP Service versions 1.4.6 and later, 1.5.5 and later, and 1.6.5 and later.
CVE-2026-39991 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc. Notes Station 3. A remote attacker with a user account can exploit this flaw to inject malicious code. The vulnerability is fixed in version 3.9.12 and later.
CVE-2026-22896 is a cross-site scripting (XSS) vulnerability in QNAP Systems Inc.'s Network & Virtual Switch. It requires an attacker to have an administrator account to exploit the vulnerability by injecting malicious code. The vulnerability has been fixed in specific versions of QTS, QuTS cloud, and QuTS hero as detailed by the vendor. The CVSS 4.0 base score is 6.2, indicating a medium severity level.
The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.
The VK Blocks plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its Group Block 'linkToPost' feature. This vulnerability affects all versions up to and including 1.126.1. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Tracking Code Manager plugin for WordPress has a reflected cross-site scripting (XSS) vulnerability via the 'TCM_ErrorMessages' POST parameter in all versions up to and including 2.6.0. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when a user is tricked into interacting with a crafted link. The issue arises from insufficient input sanitization and output escaping.
The Mang Board WordPress plugin (versions up to and including 2.4.0) contains a stored cross-site scripting (XSS) vulnerability via the 'data_type' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. It is caused by insufficient input sanitization and output escaping.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin is vulnerable to reflected Cross-Site Scripting (XSS) via the 'title' parameter in all versions up to and including 1.8.42. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with crafted content.
Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress versions up to and including 4.5.14 is vulnerable to stored Cross-Site Scripting (XSS) via the 'ref' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Premium Packages – Sell Digital Products Securely WordPress plugin contains an unauthenticated stored cross-site scripting (XSS) vulnerability in the 'order_email' parameter. This affects all versions up to and including 7.0.5. The vulnerability arises from insufficient input sanitization and output escaping, allowing attackers to inject malicious scripts that execute when users view the affected pages.
The Import and export users and customers plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in custom column user meta profile fields. This vulnerability affects all versions up to and including 2.4.5. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the Table Designer 'data-label' attribute. This vulnerability exists in all versions up to and including 1.27.13 and allows authenticated users with Contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages. The CVSS score is 6.4, indicating a medium severity risk.