Search: xss.is

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA Analytics qa-heatmap-analytics allows Stored XSS.This issue affects QA Analytics: from n/a through 5.3.0.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Grid W3 Total Cache w3-total-cache allows Stored XSS.This issue affects W3 Total Cache: from n/a through 2.10.7.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noah Hearle We’re Open! opening-hours allows Reflected XSS.This issue affects We’re Open!: from n/a through 2.6.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics WP Event Solution wp-event-solution allows Stored XSS.This issue affects WP Event Solution: from n/a through 4.1.26.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP Better Messages bp-better-messages allows DOM-Based XSS.This issue affects BP Better Messages: from n/a through 3.1.3.

A cross-site scripting (XSS) vulnerability exists in the yahoo serialize-javascript library prior to version 7.1.3. The flaw arises because the function-source escaping logic fails to neutralize a bare closing-script prefix when attacker-controlled function source text ends exactly at that prefix. This can allow an attacker who controls a serialized function's source text to inject malicious markup that becomes live in the page. The issue is fixed in version 7.1.3.

A reflected Cross-Site Scripting (XSS) vulnerability exists in the registration module of phpBB versions 3.3.0 through 3.3.18 due to improper input sanitization. This flaw allows attackers to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to data theft or session hijacking.

CVE-2026-55486 is a critical cross-site scripting (XSS) vulnerability in the intranda goobi-viewer-core web application affecting versions from 25.08 up to but not including 26.05. The vulnerability occurs because the IIIF Auth 2.0 endpoints auth/login and auth/token accept an origin query parameter without proper validation, which is then embedded unsafely into the Content-Security-Policy header and HTML response body. This allows reflected XSS attacks. The issue has been fixed in version 26.05.

GFI Archiver versions before 15.14 contain a stored cross-site scripting (XSS) vulnerability in the MailInsights scheduled report configuration. Authenticated attackers can inject arbitrary web script or HTML via the report name parameter, which is stored without proper output encoding. The malicious script executes in the browser of the user who created the scheduled report when they view the MailInsights page. This vulnerability has a medium severity rating and is fixed in version 15.14.

baserCMS versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2 contain a stored cross-site scripting (XSS) vulnerability. This occurs because global shortcode expansion processes the entire rendered page, including HTML-escaped blog comments from unauthenticated users. An attacker can inject a malicious script URL via the BcBaser.getGoogleMaps shortcode in a comment, which executes when an administrator or visitor views the affected article. Other shortcodes like Mail.getForm can embed active forms with valid CSRF tokens. The vulnerability is patched in versions 5.3.2 and 5.4.2.

CVE-2026-93638 is a reflected cross-site scripting (XSS) vulnerability in the login page of Zimbra Collaboration Suite (ZCS) versions up to 10.1.17. It allows an unauthenticated attacker to inject JavaScript via the zrememberme parameter in a crafted relogin URL. This causes attacker-controlled script execution under the legitimate Zimbra origin, potentially enabling credential theft through a fake login form. The attack logs out any existing session before rendering the payload, so it does not grant access to the victim's mailbox.

CVE-2026-93633 is a cross-site scripting (XSS) vulnerability in Zimbra Collaboration Suite (ZCS) versions up to 10.1.20. It arises from improper sanitization of CSS stylesheets containing non-ASCII characters, allowing an authenticated user with Briefcase access to publish documents that can display attacker-controlled content under the Zimbra origin. This can enable attackers to share crafted documents that load external resources and present credential-collection forms using Zimbra's own visual assets. Exploitation requires the victim to open the malicious document in a browser that renders the content inline, and credential theft requires user form submission.

serialize-javascript versions from 7.0.1 up to but not including 7.1.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to break out of HTML script elements by injecting unescaped </script> sequences via a spoofed toString() function, enabling injection of live markup such as img onerror handlers. The vulnerability is fixed in version 7.1.3.

The node-i18next-http-backend package version 4.0.2 contains an incomplete fix in the interpolateUrl() function. This flaw allows attackers who can control the namespace (ns) value to redirect translation requests by supplying a namespace starting with a slash. By crafting a protocol-relative URL in loadPath or addPath templates, attackers can load malicious translations from attacker-controlled hosts, potentially enabling UI content injection and cross-site scripting (XSS). The vulnerability has a low CVSS score of 3.1, indicating limited impact and requiring user interaction.

CVE-2026-50053 is a vulnerability in Zimbra Collaboration Suite (ZCS) affecting versions up to and including 10.1.17. It allows unauthenticated requests to override servlet request attributes intended for trusted internal dispatch, enabling an attacker to manipulate authentication tokens and document identifiers. This flaw can be combined with CVE-2026-10632 in ZCS 10.1.16 to execute JavaScript in another user's signed-in browser session. Although ZCS 10.1.17 mitigates the XSS chain by changing the document renderer, it still retains the request attribute override vulnerability.

CVE-2026-10632 is a reflected cross-site scripting (XSS) vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) version 10.1.16 and earlier. The flaw occurs due to improper HTML encoding of the packages parameter in the /h/rest document editor, allowing JavaScript injection. When combined with CVE-2026-50053, an attacker with a valid Zimbra account can craft a URL that executes JavaScript in another signed-in user's browser session, enabling unauthorized mailbox data access and authenticated actions. This vulnerability was fixed in ZCS version 10.1.17.

CVE-2026-112849 is a high-severity DOM-based Cross-site Scripting (XSS) vulnerability in AivahThemes Hostme v2. The flaw arises from improper neutralization of input during web page generation, affecting versions up to and including 7.0. This vulnerability allows an attacker to inject malicious scripts that can execute in the context of the victim's browser, potentially leading to information disclosure, integrity loss, and availability impact.

CVE-2026-112863 is a reflected cross-site scripting (XSS) vulnerability in Hogash KALLYAS versions up to and including 4.25.0. The flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1.