Search: xss.is

YesWiki versions prior to 4.7.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows low-privilege authenticated users to upload malicious SVG files via the bazar ImageField class. The malicious SVG is served with the image/svg+xml content type and can execute scripts when viewed by other users. The vulnerability is fixed in version 4.7.0.

SiYuan note-taking software versions from 2.10.0 up to but not including 3.8.7 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows users with edit permissions to inject malicious JavaScript code via specially crafted math block content when KaTeX trust is enabled. The vulnerability arises because certain math rendering functions assign user-controlled content using innerHTML, enabling script execution when a reader clicks on the rendered link. The issue is fixed in version 3.8.7.

SiYuan note-taking software versions from 2.9.0 up to but not including 3.8.7 contain a cross-site scripting (XSS) vulnerability in the unauthenticated /check-auth page. This flaw allows attackers to craft a link with a javascript: URI that is assigned to window.location.href without proper scheme validation. After a victim logs in, the malicious script executes, potentially invoking kernel APIs to read or modify workspace content and settings. The vulnerability is fixed in version 3.8.7.

CVE-2026-116148 is a medium severity cross-site scripting (XSS) vulnerability in ImageMagick affecting versions before 6.9.13-58 and 7.x before 7.1.2-33. The flaw exists in the MVG encoder, which fails to properly neutralize user-supplied drawing options before embedding them into generated MVG files. This allows attackers who can supply drawing options to inject arbitrary MVG drawing commands.

WWBN AVideo versions 26.0 through 29.3.0 contain a stored cross-site scripting (XSS) vulnerability. Authenticated commenters can inject JavaScript code via specially crafted comments that include an img tag with an onerror event handler. This occurs because the markDownToHTML() function preserves event-handler attributes in leading HTML blocks, allowing the injected script to bypass the inline sanitizer and execute in the browsers of users viewing the comments.

CVE-2026-116047 is a cross-site scripting (XSS) vulnerability in Privoce Vocechat version 0.9.121. The flaw exists in the Query Parameter Handler component, specifically in the processing of the 'welcome' argument in the file widget.html. This vulnerability can be exploited remotely and requires user interaction. Public exploit code has been disclosed, but the vendor has not responded or provided a fix.

A cross-site scripting (XSS) vulnerability exists in the GiveWP WordPress plugin versions before 4.19.0.1. The plugin fails to properly sanitize and escape a donation form template setting before outputting it inside an HTML attribute. This allows users with a custom form-editing role to inject arbitrary scripts that execute in the browsers of visitors or administrators who open the affected donation form.

CVE-2025-15705 is a cross-site scripting (XSS) vulnerability in the Contact Form by Supsystic WordPress plugin versions before 1.8.0. The flaw arises because the plugin does not properly sanitize and escape the form name, allowing users with form editor access to inject arbitrary scripts. On multisite WordPress installations, this vulnerability can cross privilege boundaries when administrators lack the unfiltered_html capability. The issue is fixed in version 1.8.0.

CVE-2026-84942 is a stored cross-site scripting (XSS) vulnerability in OpenSearch Dashboards involving a bypass of the Vega expression function. The vulnerability allows malicious input to be stored and later executed in users' browsers. No affected versions or patch information are provided. There is no evidence of exploitation in the wild.

CVE-2026-116004 is a cross-site scripting (XSS) vulnerability in onyx-dot-app Onyx version 5.0.0. The flaw exists in an unspecified function within the file web/src/app/craft/components/output-panel/PreviewTab.tsx. This vulnerability allows remote attackers to execute script code via crafted input. The vulnerability has been publicly disclosed, and exploit code may be available. The vendor has not responded to the disclosure and no patch information is provided.

CVE-2026-115982 is a cross-site scripting (XSS) vulnerability in phpIPAM versions 1.8.0 through 1.8.3. It affects the create_rack_link function in the app/tools/racks/show-rack-popup.php component. The vulnerability arises from improper handling of the deviceid argument, allowing remote attackers to inject malicious scripts. Exploit code is publicly available, enabling potential exploitation. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.3.

CVE-2026-115981 is a cross-site scripting (XSS) vulnerability in phpIPAM affecting versions 1.8.0 through 1.8.3. The flaw exists in the upgrade/index.php file where manipulation of the REQUEST_URI argument can lead to XSS. The vulnerability can be exploited remotely and requires user interaction with elevated privileges. Public exploit code has been disclosed. The vulnerability has a medium severity rating with a CVSS score of 4.8.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inserter ad-inserter allows Reflected XSS.This issue affects Ad Inserter: from n/a through 2.8.18.

CVE-2026-115993 is a stored cross-site scripting (XSS) vulnerability in the 'Notes' field of the Checklists feature in Cervantes version v1.3-beta. This flaw could allow an attacker with limited privileges to execute arbitrary code in another user's browser with elevated privileges. The vulnerability has a CVSS score of 6.8, indicating a medium severity level.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Stored XSS.This issue affects VOD Infomaniak: from n/a through 1.5.14.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.8.

CVE-2026-114693 is a stored cross-site scripting (XSS) vulnerability in the Plugins360 Labs All-in-One Video Gallery plugin affecting versions before 5.0.0. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a medium severity with a CVSS score of 6.5. A fixed version 5.0.0 is available, and the plugin is a cloud service with vendor-managed remediation.