The Form Maker by 10Web plugin for WordPress is vulnerable to reflected cross-site scripting (XSS) via the 'inputs' parameter in versions up to and including 1.15.48. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The issue arises from insufficient input sanitization and output escaping.
The Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter in all versions up to and including 6.88. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires that a comment from the attacker's email address be approved; on default WordPress setups, only the first comment from an email is moderated, so subsequent comments auto-approve and expose the payload immediately.
The RSS Aggregator by Feedzy plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 5.2.10. Authenticated users with contributor-level access or higher can inject malicious scripts via the RSS feed title, which are executed when other users view the affected pages. The vulnerability arises because the plugin does not properly sanitize or escape input from external RSS feed titles at render time, bypassing save-time filtering.
The Filter Everything — WordPress & WooCommerce Filters plugin is affected by a reflected cross-site scripting (XSS) vulnerability in versions up to and including 1.9.6. This vulnerability arises from improper input sanitization and output escaping in the flrt_elementor_load_more_anchor() function, which processes URL query parameters insecurely. An unauthenticated attacker can craft a malicious link that injects arbitrary scripts into pages, potentially executing them when a user interacts with the link.
The FV Flowplayer Video Player WordPress plugin up to version 7.5.54.7212 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of an unquoted popup shortcode attribute, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. Exploitation requires the profile_videos_enable_bio option to be enabled, as the injected scripts execute on author bio or archive pages where the profile-video shortcode is rendered. The vulnerability has a medium severity with a CVSS score of 6.4.
The Download Manager plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'regurl' parameter affecting all versions up to and including 3.3.71. Authenticated users with contributor-level access or higher can inject malicious scripts that execute for logged-out visitors viewing the injected pages. The vulnerability arises from insufficient input sanitization and output escaping. The injected payload does not affect authenticated users due to template gating based on login status.
The Fluent Forms WordPress plugin up to version 6.2.14 is vulnerable to reflected cross-site scripting (XSS) due to improper input sanitization and output escaping of user-controlled parameters in the {get.*} SmartCode placeholders. An unauthenticated attacker can inject malicious scripts if a site administrator has configured a Custom HTML field with a {get.*} SmartCode inside URL-accepting attributes. Exploitation requires tricking a user into interacting with a crafted link, potentially leading to script execution in the user's browser.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'email (Contact Email custom field htmlvar_name)' parameter. This affects all versions up to and including 2.8.188. Authenticated users with subscriber-level access or higher can inject malicious scripts if the Contact Email custom field is configured and the injected listing is approved by an administrator. The vulnerability arises from insufficient input sanitization and output escaping, allowing script execution when users view the affected listing pages.
The Data Tables Generator by Supsystic WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the updateRows action that allows authenticated users with subscriber-level access or higher to inject malicious scripts via table cell data. This vulnerability affects all versions up to and including 1.15.1. Exploitation requires that an administrator has explicitly granted the subscriber role access to the plugin's 'access_roles' setting, enabling them to reach the vulnerable action handler. The vulnerability can lead to script execution in the context of users visiting the injected pages.
The Table Field Add-on for ACF and SCF WordPress plugin versions up to 1.4.1-RC2 contains a stored cross-site scripting (XSS) vulnerability. Authenticated users with subscriber-level access or higher can inject malicious scripts via the Table Field Value. These scripts execute whenever a user views the affected page, potentially compromising user interactions. The vulnerability arises from insufficient input sanitization and output escaping.
The Advanced Classifieds & Directory Pro WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'phone' parameter in versions up to and including 3.4.4. This vulnerability requires that the 'Force Bootstrap' setting is enabled and the 'ACADP Listing Address' widget is placed on a sidebar on single listing pages, both of which are non-default configurations. Authenticated users with custom-level access or higher can inject malicious scripts that execute when other users view the affected pages.
A stored cross-site scripting (XSS) vulnerability exists in FolioVision FV Flowplayer Video Player (fv-wordpress-flowplayer) affecting versions up to 7.5.54.7212. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker with low privileges to execute scripts in the context of other users. The CVSS score is 6.5, indicating a medium severity level.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS.
This issue affects Talassoft Industrial Management Software: before V16.0.1.
Reflected Cross-Site Scripting (XSS) on the BeeTienda e-commerce platform, specifically in the latest demo version. The incident occurs due to a lack of proper sanitization of user input data in the 'search' parameter of the product list endpoint. When malicious payloads are transmitted via the 'search' parameter, they are displayed insecurely in the HTML response, allowing for the arbitrary execution of JavaScript code in the victim's browser.
In Progress® Telerik® Report Server prior to version 12.2.26.1007, a stored cross-site scripting vulnerability in the shared reporting engine allows an authenticated report author to embed javascript: or vbscript: URLs in report navigation actions or HTML text box links. When another user views the malicious report and the embedded navigation is triggered, attacker-controlled script can execute in the web report viewer's origin. In a multi-user Report Server deployment, this can enable privilege escalation by performing actions in a higher-privilege user's authenticated session, including an administrator's session.
The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.
CVE-2026-97030 is a cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. It involves improper escaping of the 'yield' keyword in templates, where valid uses were not correctly escaped, potentially allowing injection of malicious scripts. The issue affects certain versions of the Go html/template package prior to 1.26.9 and between 1.27.0-0 and 1.27.2. The vulnerability has a medium severity with a CVSS score of 6.1.
CVE-2026-94448 is a medium severity cross-site scripting (XSS) vulnerability in the Go standard library's html/template package. The issue arises when JavaScript template literals contain consecutive expressions, causing improper context tracking and failure to reset state correctly. This flaw can lead to insufficient escaping of regular expression literals within templates, potentially allowing injection of malicious scripts.
Satel Netco Design versions prior to v2.1.7 contains a stored cross site scripting vulnerability. An authenticated user with Network Operator privileges could store untrusted content that is rendered without adequate neutralization. Successful exploitation could allow script execution in another user's browser when the affected content is viewed.
IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a cross-site scripting (XSS) vulnerability. This flaw allows an unauthenticated attacker to inject arbitrary JavaScript into the web user interface, potentially altering functionality and leading to credential disclosure within a trusted session. The vulnerability has a high severity rating with a CVSS score of 8.2.