Search: xss.is

CVE-2026-114703 is a stored cross-site scripting (XSS) vulnerability in hupe13 Extensions for Leaflet Map affecting versions up to and including 6.0. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with low privileges and requiring user interaction to execute malicious scripts. The vulnerability has a medium severity rating with a CVSS score of 6.5.

CVE-2026-114702 is a stored cross-site scripting (XSS) vulnerability in the nicdark ND Shortcodes For Visual Composer plugin. It affects versions from 0 up to and including 7.8. The flaw involves improper neutralization of input during web page generation, which could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level with impacts on confidentiality, integrity, and availability. No public exploits or patches are currently documented.

CVE-2026-114701 is a stored cross-site scripting (XSS) vulnerability in the xootix Waitlist Woocommerce (Back in stock notifier) plugin affecting versions up to and including 2.9.1. This vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that can be stored and executed in users' browsers.

CVE-2026-114700 is a stored cross-site scripting (XSS) vulnerability in Gloriafood's Restaurant Menu – Food Ordering System – Table Reservation affecting versions up to 2.4.4. It involves improper neutralization of input during web page generation, which can lead to persistent injection of malicious scripts.

CVE-2026-111830 is a high-severity stored cross-site scripting (XSS) vulnerability in WP Mailster versions prior to 1.9.2.0. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability affects WP Mailster from initial versions up to 1.9.1.0 and has been fixed in version 1.9.2.0.

CVE-2026-112845 is a stored cross-site scripting (XSS) vulnerability in the Off-Canvas Sidebars & Menus (Slidebars) plugin by Jory Hogeveen. It affects versions from the initial release up to 0.5.9. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 0.5.9.1.

CVE-2026-112379 is a stored cross-site scripting (XSS) vulnerability in Codepeople Contact Form Email versions before 1.3.69. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability is rated high severity with a CVSS score of 7.1. A fix is available in version 1.3.69.

CVE-2026-112867 is a stored cross-site scripting (XSS) vulnerability in H5P versions prior to 1.17.10. It allows improper neutralization of input during web page generation, potentially leading to script injection. The issue affects H5P versions from 0 up to 1.17.9 and has been fixed in version 1.17.10.

CVE-2026-114184 is a stored cross-site scripting (XSS) vulnerability in the WPVibes Elementor Addon Elements plugin for WordPress. The flaw allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute malicious scripts. This affects versions from initial releases up to 1.14.4. A fix is available in version 1.14.5.

CVE-2026-97328 is a Cross-Site Scripting (XSS) vulnerability in the WebP Express WordPress plugin versions before 0.25.16. The flaw occurs because the plugin does not properly escape values emitted into HTML element attributes by its bundled parser when a non-default image delivery mode is enabled. This allows unauthenticated users to inject malicious scripts that execute in the browsers of users viewing affected pages, including administrators.

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Link Library WordPress plugin before version 7.9.6. This flaw allows users with Contributor role or higher to inject malicious scripts via a link field that is not properly sanitized or escaped. The vulnerability affects the link preview feature, which is generated without authentication and without verifying if the link is published, potentially exposing any visitor who views the preview to the malicious payload.

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Photo Engine (Media Organizer & Lightroom) WordPress plugin versions before 6.5.8. The plugin fails to properly sanitize and escape collection and gallery names before storing and displaying them in the administrative dashboard. This allows authenticated users with author role or higher to inject malicious scripts that execute in the context of the admin dashboard.