Search: xss.is

A stored cross-site scripting (XSS) vulnerability exists in Gutenberg Blocks by Kadence Blocks up to version 3.8.0.1. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Gym Management Software IsMyGym by Zuinq Studio. The issue occurs at the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation could allow an attacker to execute arbitrary JavaScript code in the victim's browser context. The vulnerability has a medium severity rating with a CVSS score of 5.1. No patch or remediation information is currently available.

A stored cross-site scripting (XSS) vulnerability exists in the bPlugins Image Gallery block (up to version 2.4.1). This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of other users. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A stored cross-site scripting (XSS) vulnerability exists in WProyal Royal Elementor Addons up to version 1.7.1069. This flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with limited privileges to execute malicious scripts in the context of the affected application. The vulnerability has a medium severity rating with a CVSS score of 6.5.

A reflected Cross-site Scripting (XSS) vulnerability exists in the Ad Inserter plugin by Igor Funa, affecting versions up to 2.8.18. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of a user's browser session.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web application of the Castile-La Mancha Regional Parliament’s video library. The vulnerability arises because user-supplied content is embedded into web pages without proper sanitization. This flaw allows remote attackers to execute arbitrary JavaScript code in the browsers of users who interact with maliciously crafted content. The vulnerability has a medium severity rating with a CVSS score of 5.1. No specific affected versions or patches are provided, and there are no known exploits in the wild at this time.

A DOM-based Cross-site Scripting (XSS) vulnerability exists in WProyal Royal Elementor Addons up to version 1.7.1069. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker with limited privileges and requiring user interaction to potentially execute malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-114708 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetSmartFilters versions before 3.8.6.2. It arises from improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts. The flaw is fixed in version 3.8.6.2.

CVE-2026-115955 is a stored cross-site scripting (XSS) vulnerability in the bPlugins Advanced Post Block - Post Grid for WordPress block editor. It affects versions from initial release up to 2.5.1. The vulnerability allows improper neutralization of input during web page generation, which could lead to execution of malicious scripts. A fix is available in version 2.5.2.

CVE-2026-115956 is a stored cross-site scripting (XSS) vulnerability in bPlugins Panorama Viewer – 360 Degree Image + Video Viewer affecting versions prior to 1.8.4. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This flaw is fixed in version 1.8.4.

CVE-2026-115961 is a stored cross-site scripting (XSS) vulnerability in bPlugins B Slider (b-slider) affecting versions prior to 2.2.4. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to inject malicious scripts that execute in the context of other users. This vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity impact on confidentiality, integrity, and availability. A fixed version 2.2.4 is available to remediate the issue.

CVE-2026-114707 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetElements For Elementor versions prior to 2.9.2.6. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with limited privileges to execute malicious scripts in the context of the affected application. This vulnerability has a medium severity rating with a CVSS score of 6.5. A fixed version, 2.9.2.6, is available to address this issue.

CVE-2026-115953 is a stored cross-site scripting (XSS) vulnerability in the Geo Mashup plugin by Dylan Kuhn. It affects all versions from initial releases up to and including 1.13.22. The vulnerability allows improper neutralization of input during web page generation, which can lead to script injection. A fix is available in version 1.13.23.

CVE-2026-115950 is a stored cross-site scripting (XSS) vulnerability in the WordPress plugin Better Post & Filter Widgets for Elementor. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker to inject malicious scripts. This affects versions from initial release up to 1.9.1. The issue is fixed in version 1.9.2.

CVE-2026-115951 is a stored cross-site scripting (XSS) vulnerability in Kevin Weber's Lazy Load for Videos plugin. It affects versions from initial release up to 2.18.11. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers with limited privileges to inject malicious scripts. A fix is available in version 2.18.12.

CVE-2026-115355 is a vulnerability in the Mistune markdown parser's Include directive that allows path traversal and cross-site scripting (XSS). The directive does not properly validate file paths, enabling attackers to read arbitrary files via '../' sequences. Additionally, error messages and included file contents are rendered without HTML escaping, causing XSS even when escaping is enabled. This vulnerability affects versions >=1.3.0 and <1.4.0_6 of the adr-viewer product. A fix is available in version 1.4.0_6.