PostfixAdmin versions through 4.0.5 have a stored cross-site scripting (XSS) vulnerability that affects authenticated mailbox users. This flaw allows these users to inject malicious scripts via the description field when creating a TOTP exception. When a global administrator views the affected page, the injected script executes in the admin's session context, potentially allowing unauthorized admin actions using the page's CSRF token.
CVE-2026-44267 is a critical cross-site scripting (XSS) vulnerability in the Elo expression language used by enspirit. Versions prior to 1.0.1 allow attacker-controlled strings to execute arbitrary JavaScript code via the .constructor.constructor property. This flaw affects the defaultFormats.elo.parse() function, the bin/elo CLI, and the elo-lang.org/try playground, enabling browser script execution and session compromise. It also permits arbitrary Node.js code execution in environments using the library. The issue is fixed in version 1.0.1.
Buku versions 5.0 through 5.1.1 contain a stored cross-site scripting (XSS) vulnerability in the bukuserver bookmark list. This flaw allows attackers to inject malicious scripts via an unescaped bookmark URL, which can be submitted through the unauthenticated /api/bookmarks endpoint. Exploitation enables attackers to execute scripts in the context of the victim's browser, potentially issuing same-origin API requests with the victim's credentials.
CVE-2026-114185 is a stored cross-site scripting (XSS) vulnerability in WPVibes AnyWhere Elementor plugin versions prior to 1.3.1. It allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts in the context of other users. The issue is fixed in version 1.3.1.
CVE-2026-120843 is a stored cross-site scripting (XSS) vulnerability in Barn2 Plugins' Posts Table with Search & Sort plugin. It affects versions from initial releases up to 1.4.14. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 1.4.15.
CVE-2026-116858 is a medium severity vulnerability in WPMU DEV Forminator plugin versions before 1.58.4. It involves improper neutralization of script-related HTML tags, leading to a basic cross-site scripting (XSS) issue that allows code injection. The vulnerability affects Forminator versions from the initial release up to 1.58.3 and was fixed in version 1.58.4.
CVE-2026-119521 is a stored cross-site scripting (XSS) vulnerability in Cozmoslabs Paid Member Subscriptions affecting versions before 3.1.4. It allows improper neutralization of input during web page generation, potentially leading to execution of malicious scripts. The issue is fixed in version 3.1.4.
TeXlyre versions from 0.11.0 up to but not including 0.13.5 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows attackers to execute malicious scripts by supplying crafted LSP or typesetter recipe icons containing HTML event handlers. Successful exploitation can lead to persistent script execution in victims' environments, potentially exposing local projects and repository credentials. The vulnerability is fixed in version 0.13.5.
Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading to account takeover or code execution.
svg-sanitizer versions before 1.1.0 have a cross-site scripting (XSS) vulnerability that allows attackers to bypass sanitization by embedding javascript: URLs in the animateTransform values attribute. This flaw enables crafted SVG files to execute arbitrary JavaScript in Safari when users click on links targeted by animateTransform. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.
CVE-2026-108054 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of the 'Nombre' field in the '/Familias/Edit/{id}' endpoint. An authenticated user can inject JavaScript code that is stored and later executed in other users' browsers when viewing the affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-108055 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of user-supplied input in the 'Nombre' field at the '/Inmuebles/Create' endpoint. An authenticated attacker can inject malicious JavaScript code that executes in the browsers of other users viewing the affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-108060 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of input fields, allowing authenticated users to inject JavaScript code that executes in other users' browsers when viewing affected records. This can alter displayed content and perform actions within the victim's session context. Exploitation requires authenticated access.
A stored Cross-Site Scripting (XSS) vulnerability exists in Alosuite's delivery note functionality due to insufficient sanitization and encoding of input fields. Authenticated users can inject JavaScript code that executes in other users' browsers when viewing affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability specifically affects the 'Codigo' parameter in the '/CategoriasFicheros/Edit/{id}' endpoint.
CVE-2026-108051 is a stored Cross-Site Scripting (XSS) vulnerability in Alosuite affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of input fields, allowing JavaScript code to be stored and executed in other users' browsers when viewing affected records. Exploitation requires authenticated access. The vulnerability can alter displayed content and perform actions within the victim's session context. No patch or remediation information is currently provided.
CVE-2026-108053 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite application affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of input fields, allowing authenticated users to inject JavaScript code that executes in other users' browsers when viewing affected records. This can alter displayed content and perform actions within the victim's session context. The specific affected parameter is 'Nombre' in the '/CuentasCorrientes/Create' endpoint. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-108059 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. It arises from insufficient sanitization and encoding of user input in the 'Observaciones' field at the '/Terceros/Create' endpoint. An authenticated user can inject JavaScript code that executes in other users' browsers when they view the affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1.
A stored Cross-Site Scripting (XSS) vulnerability exists in Alosuite's delivery note functionality, specifically in the NombrePF parameter of the '/Empresas/Create' endpoint. This flaw allows authenticated users to inject JavaScript code that is stored and later executed in other users' browsers when viewing the affected records. The vulnerability arises from insufficient sanitization and encoding of input fields.
CVE-2026-108058 is a stored Cross-Site Scripting (XSS) vulnerability in Alosuite affecting the delivery note functionality. It arises from insufficient sanitization and encoding of input fields, allowing JavaScript code to be stored and executed in other users' browsers when viewing affected records. Exploitation requires authenticated access. The vulnerability can alter displayed content and perform actions within the victim's session context.
CVE-2026-108057 is a stored Cross-Site Scripting (XSS) vulnerability in the Alosuite software affecting the delivery note functionality. The vulnerability arises from insufficient sanitization and encoding of user-supplied input in the 'Nombre' field at the endpoint '/PlantillasPdf/Edit/1273129'. An authenticated user can inject malicious JavaScript code that executes in other users' browsers when viewing affected records, potentially altering displayed content and performing actions within the victim's session context. The vulnerability has a medium severity rating with a CVSS score of 5.1. No patch or remediation information is currently provided.