A Cross-Site Scripting (XSS) vulnerability exists in the PixelYourSite WordPress plugin versions before 11.4.3 and PixelYourSite Pro versions before 12.6.8. The flaw arises because the plugins do not sanitize and escape a cookie value before outputting it on the page. On sites using full-page caching, this allows unauthenticated attackers to inject malicious scripts into the cached page, which are then served to other visitors.
WordPress Core versions up to and including 7.0.2 are vulnerable to a stored cross-site scripting (XSS) flaw via the Quick Edit feature. This vulnerability arises from insufficient escaping of user display names, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when higher privileged users access certain administrative pages. The issue specifically affects sites with a large number of users.
A stored cross-site scripting (XSS) vulnerability exists in the Drupal CookieCuttr module versions 2.0.0 through 2.0.3. This vulnerability is due to improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers.
A privilege misconfiguration vulnerability in the Drupal Webform module allows stored cross-site scripting (XSS) attacks. This affects Webform versions from 0.0.0 up to 6.2.12 and from 6.3.0 to 6.3.1. The vulnerability requires high privileges and user interaction, and it has a low severity score.
CVE-2026-114718 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw occurs in the password plugin where error messages from a password driver are displayed without proper HTML escaping. This allows a backend capable of influencing the error text, such as the DirectAdmin API, to inject malicious scripts into the Roundcube interface. The issue was fixed by escaping the driver message before display in versions 1.6.20 and 1.7.5.
CVE-2026-84911 is a stored cross-site scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.3.13, and from 1.4.0 up to but not including 1.4.8. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with high privileges and user interaction to inject malicious scripts. The issue has been fixed in versions 1.3.13 and 1.4.8.
CVE-2026-84915 is a stored cross-site scripting (XSS) vulnerability in the Drupal Component blocks module. It affects versions from 0.0.0 up to but not including 1.2.7. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in version 1.2.7.
CVE-2026-84924 is a reflected Cross-site Scripting (XSS) vulnerability in the Drupal Email Verification / SMS Verification / OTP Verification module. It affects versions from 0.0.0 up to but not including 2.4.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This flaw has a medium severity rating with a CVSS score of 5.4. A fix is available in version 2.4.0.
CVE-2026-84919 is a stored cross-site scripting (XSS) vulnerability in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery. It affects versions from 0.0.0 up to but not including 5.0.9. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in version 5.0.9. The CVSS v3.1 base score is 4.6, indicating a medium severity level.
CVE-2026-87939 is a stored cross-site scripting (XSS) vulnerability in the Drupal Feed Block module. It affects Feed Block versions from 0.0.0 up to but not including 2.0.2, and from 3.0.0 up to but not including 3.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in versions 2.0.2 and 3.0.2.
CVE-2026-87942 is a stored cross-site scripting (XSS) vulnerability in the Drupal SafeDelete module. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects SafeDelete versions from 0.0.0 up to but not including 1.0.88. A fix is available in version 1.0.88. The CVSS score is 4.6, indicating a medium severity level.
CVE-2026-87948 is a Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in version 3.2.0. The CVSS score is 3.5, indicating a low severity impact with limited confidentiality and integrity impact and no availability impact.
CVE-2026-87949 is a Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has a low CVSS score of 3.3 and was fixed in version 3.2.0.
CVE-2026-96360 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability arises from improper neutralization of input during web page generation. The issue has a low CVSS score of 3.5 and is fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96361 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue has been fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96358 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module caused by improper neutralization of input during web page generation. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability allows an attacker with low privileges to execute scripts in the context of the user's browser. The issue has been fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96359 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. Fixed versions are 6.2.12 and 6.3.1. The CVSS score is 4.6 (medium severity).