The Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in all versions up to and including 6.2.0. This vulnerability arises from insufficient input sanitization and output escaping of page builder text content. Authenticated users with the kirki_content_access capability can inject malicious scripts that execute when other users view the affected pages.
FileRise versions prior to 3.21.0 have a cross-site scripting (XSS) vulnerability due to improper neutralization of input in the branding.footerHtml value exposed via an unauthenticated public site configuration API. Although the frontend sanitizes this value before rendering, the raw HTML is exposed through the API, which could be unsafe for alternate clients or future render paths. An administrator must first store a malicious footer value to exploit this issue. The vulnerability is fixed in version 3.21.0.
CVE-2026-0316 is a stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS software affecting PA-Series, VM-Series firewalls, and Panorama (virtual and M-Series). It allows a malicious authenticated administrator to store or execute JavaScript payloads via the web interface. The vulnerability does not affect Cloud NGFW or Prisma Access. The risk is reduced if management interfaces are restricted to trusted internal IPs. The CVSS score is low (1.1).
Markdown Preview Enhanced for Visual Studio Code versions prior to 0.8.30 contains a cross-site scripting (XSS) vulnerability. The extension reads repository-controlled .crossnote/head.html content and inserts it into the preview webview's head without removing executable script content. This allows script execution before React and DOMPurify initialize, enabling malicious scripts to run when opening a Markdown preview in a malicious repository without further user interaction. The issue is fixed in version 0.8.30.
CVE-2026-102756 is a cross-site scripting (XSS) vulnerability in DataEase, an open source data visualization tool. Authenticated users with permissions to edit dataset fields and chart configurations can inject HTML-bearing dimension values into bar-horizontal charts. When the category axis label is truncated, the full label is assigned via innerHTML to a tooltip element, allowing execution of attacker-controlled JavaScript when a victim hovers over the truncated label. This vulnerability is fixed in DataEase version 2.10.26.
A cross-site scripting (XSS) vulnerability was identified in lichess-org's lila platform prior to a specific commit. The flaw allowed a user with permission to add a chapter to a study to inject attacker-controlled HTML and CSS via the PGN Annotator tag, which was rendered without proper escaping in the study's comments. Although the site's content security policy blocks injected JavaScript, the vulnerability could enable navigation to attacker-controlled sites, content spoofing, and CSS-based data exposure. This issue was fixed by a commit that properly escapes the injected content.
CVE-2026-91159 is a high-severity cross-site scripting (XSS) vulnerability in the Discourse open-source discussion platform. The flaw exists in oEmbed processing prior to versions 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, where an attacker-controlled HTML fragment containing an allowlisted iframe source is treated as trusted. This allows a user with posting permissions who controls a public webpage and its oEmbed response to inject styled content overlays or misleading user interfaces into posts. The vulnerability affects content integrity but does not expose restricted data or impact availability. It requires a posting account and control over the oEmbed response. The issue is fixed in the specified versions.
CVE-2026-89069 is a high-severity cross-site scripting (XSS) vulnerability in the Ad Hoc module of Progress MOVEit Transfer. It involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute arbitrary code in the context of a user's browser. The vulnerability affects MOVEit Transfer versions before 2025.1.6 and versions from 2026.0.0 up to but not including 2026.0.4.
CVE-2026-103904 is a high-severity cross-site scripting (XSS) vulnerability in JTL-Shop by JTL-Software GmbH. The issue arises because the public consent endpoint accepts arbitrary consent names from unauthenticated users without validation. These names are stored and later rendered without proper output encoding in the administration backend. This allows an unauthenticated attacker to inject malicious script code that executes in the browser session of an administrator viewing the consent statistics page, potentially enabling actions with administrator privileges.
The Gallery Custom Links plugin for WordPress up to version 2.3.3 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping of the 'display_name' and 'comment' parameters. Authenticated users with subscriber-level access or higher can exploit this by injecting malicious scripts that execute when other users view the affected pages. The attack requires coordinated inputs in both the comment body and the attacker's display name, leveraging the plugin's output buffering to bypass standard filters.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_title' parameter. This affects all versions up to and including 2.8.190. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
The Record of Consent Extension for Complianz WordPress plugin versions up to and including 2.5 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'uid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The vulnerability is exacerbated because the nonce used for enforcement is exposed to unauthenticated frontend visitors, and no capability or role checks restrict the write path.
The Mang Board WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in the 'user_name' parameter in all versions up to and including 2.4.3. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The existing sanitizer mbw_htmlspecialchars2() does not prevent this attack due to the nature of the exploit payload.
The Meow Lightbox WordPress plugin versions up to and including 5.6.2 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of the 'display_name + comment' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the plugin's Output Buffering option to be enabled (which is disabled by default) and at least one previously approved comment by the attacker to enable auto-approval of subsequent comments. The vulnerability can lead to script execution in the context of users visiting the affected pages.
The Mang Board WordPress plugin up to version 2.4.3 is vulnerable to stored Cross-Site Scripting (XSS) via the 'content' parameter. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
The PeproDev Branches Map plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.0.1. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when any user accesses the affected page, potentially leading to unauthorized actions or data exposure.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images (file_info[2] = title)' parameter. This vulnerability affects all versions up to and including 2.8.190. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages.
CVE-2026-92409 is a cross-site scripting (XSS) vulnerability in the Donation Thermometer WordPress plugin versions 2.2.9 up to but not including 2.3.0. The flaw arises because the plugin does not properly escape a colour value taken from a shortcode attribute before inserting it into the legend markup. This allows users with Contributor role or higher to inject arbitrary event handlers that execute when the page is viewed.
CVE-2026-86799 is a high-severity cross-site scripting (XSS) vulnerability in the Forms WordPress plugin before version 3.0.2. The plugin fails to sanitize submitted form values on storage and does not escape them before displaying on the form submissions screen in the admin dashboard. This allows unauthenticated users to inject malicious scripts that execute in the browsers of administrators viewing submissions.
CVE-2026-86797 is a cross-site scripting (XSS) vulnerability in the Pricing Table WordPress plugin before version 2.1.5. It occurs because the plugin does not validate the scheme of a user-supplied link value in one of its blocks before rendering. This allows users with contributor-level access or higher to store malicious scripts that execute when other users view or interact with the affected content.