Search: xss.is

The Analytics Insights – Google Analytics Dashboard for WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 6.3.12. This vulnerability arises from insufficient input sanitization and output escaping of the Page Title, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when any user accesses the compromised page, potentially leading to data theft or session hijacking.

CVE-2026-116640 is a cross-site scripting (XSS) vulnerability in the Saruf-Ratul HR-Payroll-Management-System. The flaw exists in an unspecified functionality of the chat.php file, where manipulation of the ID argument can lead to XSS. The vulnerability can be exploited remotely and exploit code has been published. The product uses a rolling release model, so no specific affected or fixed versions are available. The vendor has been informed but has not yet responded or issued a fix.

CVE-2026-116639 is a cross-site scripting (XSS) vulnerability in the MD-MAFUJUL-HASAN Online-Payroll-Management-System affecting an unspecified function in chat.php. The vulnerability arises from manipulation of the ID argument and can be exploited remotely. The product uses a rolling release model, so no specific affected or fixed versions are available. The issue was reported early but remains unaddressed. Public exploit code is available, and the CVSS 4.0 score rates this as a medium severity vulnerability.

A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 in an unknown function within the Sandbox.vue component. The vulnerability arises from improper handling of the 'template' argument, allowing remote attackers to execute script code. The issue has been publicly disclosed, but no official response or patch has been provided by the project at this time. The vulnerability has a low CVSS score of 2.4 and requires high privileges and user interaction for exploitation.

DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to bypass the SMIL attributeName=href guard when parsing application/xhtml+xml content because attribute names are not properly lowercased. An attacker can craft SVG content with animate or set elements using attributeName="href" and a javascript: URI to execute scripts when users click the sanitized link.

DOMPurify versions before 3.4.17 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to retain event handlers in detached DOM subtrees that are not sanitized, enabling malicious event handlers like img onerror to execute after the sanitize() function completes. The vulnerability arises when an IN_PLACE hook removes a parent or sibling node, leaving attacker-controlled markup unneutralized.

A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 in a text field component. The vulnerability arises from improper handling of the 'text' argument in the file argilla-frontend/components/features/annotation/container/fields/text-field/TextField.vue. The flaw can be exploited remotely but requires user interaction and high privileges. The project has been notified but has not yet responded or issued a fix. Public exploit code is available.

A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 within the Dataset.from_disk function of the Settings Page component. This flaw allows remote attackers to manipulate the Name argument, potentially leading to XSS attacks. The vulnerability has a low CVSS score of 3.5 and requires user interaction with low privileges. The project has been informed but has not yet responded or issued a fix. Exploit code is publicly available.

A cross-site scripting (XSS) vulnerability exists in itsourcecode Airline Reservation System 1.0 in the /book_flight.php file. The flaw arises from improper handling of the 'max' argument, allowing remote attackers to execute script code. Public exploit code is available. The vulnerability has a medium severity rating with a CVSS score of 4.3.

CVE-2026-116836 is a Stored Cross-Site Scripting (XSS) vulnerability in Ubiquiti Inc's airMAX M devices. An attacker with access to the adjacent network can exploit this flaw under certain conditions to escalate privileges on the device. The vulnerability affects versions prior to 6.3.26. A fix is available in version 6.3.26.

YesWiki versions before 4.7.0 contain a stored cross-site scripting (XSS) vulnerability in the referrers_sites.php handler. This flaw allows unauthenticated attackers to inject malicious scripts via crafted Referer headers. The injected scripts execute in the context of any user visiting the referrer-sites page, potentially enabling same-origin authenticated actions. The vulnerability is fixed in version 4.7.0.

YesWiki versions before 4.7.0 contain a reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject JavaScript by manipulating query parameters that correspond to missing Bazar field names. The vulnerability arises because the application falls back to unsanitized user input rendered with Twig |raw templates, enabling execution of malicious scripts in the context of authenticated users' sessions. The issue is fixed in version 4.7.0.

CVE-2026-116804 is a cross-site scripting (XSS) vulnerability in DOMPurify versions 3.4.4 through 3.4.16. It involves a bypass of the SAFE_FOR_TEMPLATES feature that allows attackers to preserve template expressions in attached shadow roots when using certain return modes. This enables attackers to split expressions across text nodes separated by disallowed elements, which merge after removal and are evaluated by downstream template engines, leading to XSS.