Search: xss.is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows Stored XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal Elementor Addons royal-elementor-addons allows DOM-Based XSS.This issue affects Royal Elementor Addons: from n/a through 1.7.1069.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.8.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Image Gallery block – Create and display photo gallery/photo album. 3d-image-gallery allows Stored XSS.This issue affects Image Gallery block – Create and display photo gallery/photo album.: from n/a through 2.4.1.

CVE-2026-4316 is a reflected Cross-Site Scripting (XSS) vulnerability in the Gym Management Software IsMyGym by Zuinq Studio. The flaw exists in the reservation endpoint where the 'ret' parameter is reflected in the HTTP response without proper sanitization. Successful exploitation allows an attacker to inject and execute arbitrary JavaScript in the victim's browser context. The vulnerability has a medium severity rating with a CVSS score of 5.1. No affected versions or patches are specified in the available data.

A vulnerability in the Include directive of Mistune (used in JupyterLab) allows path traversal via '../' sequences to read arbitrary files outside the intended source directory. Additionally, error messages and included file contents are rendered without HTML escaping, enabling cross-site scripting (XSS) even when escaping is enabled. The Include plugin must be explicitly enabled to be exploitable. This issue affects JupyterLab versions from 3.4.7 up to but not including 4.6.1 and is fixed in version 4.6.1.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the web application of the Castile-La Mancha Regional Parliament’s video library. This flaw allows user-supplied content to be embedded without proper sanitization, enabling remote attackers to execute arbitrary JavaScript in the browsers of users who interact with crafted content. The vulnerability has a medium severity rating and a CVSS 4.0 score of 5.1. A fix was released in October 2026.

Multiple cross-site scripting (XSS) vulnerabilities exist in OPNsense firewall version 26.7.1_1 and earlier. These flaws allow a low-privileged attacker to execute arbitrary JavaScript in the context of another user who visits a crafted page or clicks a malicious link. The vulnerabilities have a medium severity rating with a CVSS 4.0 score of 5.6.

CVE-2026-116229 is a cross-site scripting (XSS) vulnerability in the ffxiv-teamcraft FFXIV Teamcraft application affecting versions 11.4.0 through 11.4.19. The flaw exists in the clipboard.readText function within the Renderer-Process IPC Bridge component. This vulnerability can be exploited remotely and has been publicly disclosed. Upgrading to version 11.4.32 addresses the issue.

CVE-2026-116227 is a cross-site scripting (XSS) vulnerability in the Virtual Server Page component of the Edimax BR-6208AC router version 1.32. This vulnerability allows remote attackers with high privileges and user interaction to execute malicious scripts. The vulnerability has been publicly disclosed, but the vendor has not responded or provided a fix.

CVE-2026-116100 is a cross-site scripting (XSS) vulnerability in gougucms versions 4.08.0 through 4.08.18. The flaw exists in the Add function of the app/admin/controller/Level.php file within the User Level Handler component. An attacker can remotely exploit this by manipulating the Title argument, potentially leading to XSS attacks. Public exploit code has been disclosed, but the vendor has not responded or issued a fix.

CVE-2026-116097 is a cross-site scripting (XSS) vulnerability in the CloudClassroom-PHP-Project affecting the addnewstudent.php file via the fname parameter. The vulnerability allows remote attackers to inject malicious scripts. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vendor did not respond to disclosure attempts. Public exploit code has been disclosed. The CVSS 4.0 score rates this as a medium severity issue.

YesWiki versions from 4.2.0 up to but not including 4.7.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts into comment bodies using the wakka raw-HTML syntax. These scripts execute in the browsers of administrators and visitors when comments are rendered via the /api/comments endpoint. The vulnerability is fixed in version 4.7.0.

YesWiki versions prior to 4.7.0 contain a stored cross-site scripting (XSS) vulnerability in the filtertags action. This flaw allows anonymous attackers to inject malicious markup via action-attribute parameters, bypassing the allow_raw_html gate and executing JavaScript in the browsers of page viewers. The vulnerability is fixed in version 4.7.0.