CWE-79: Cross-site Scripting vulnerabilities

IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3 contain a cross-site scripting (XSS) vulnerability in the local management interface under certain configurations. This vulnerability allows an authenticated user to inject arbitrary JavaScript code into the web user interface, potentially altering functionality and leading to credential disclosure within a trusted session. The vulnerability has a medium severity with a CVSS score of 4.9.

FreeScout versions prior to 1.8.235 contain a cross-site scripting (XSS) vulnerability when the APP_CLOUDFLARE_IS_USED setting is enabled. The application trusts the CF-Connecting-IP header during failed login attempts without validation and stores this value in the activity log. The LogsMonitor component inserts this unescaped value into administrator alert emails, allowing injected HTML to execute when the email is viewed. This vulnerability is fixed in version 1.8.235.

IBM Guardium Data Protection 12.2 contains a critical stored cross-site scripting (XSS) vulnerability in the Quick Search results grid. This vulnerability allows an unauthenticated attacker who can influence monitored database traffic to execute malicious scripts in the browser of an authenticated user. The vulnerability has a CVSS score of 9.3, indicating a high impact on confidentiality and integrity. No patch or remediation information is currently provided.

A cross-site scripting (XSS) vulnerability exists in darylldoyle svg-sanitizer versions prior to 1.0.0. The issue arises because the sanitizer validates SVG href attributes after XML DTD entity expansion but serializes the original entity reference without the DTD declaration. This discrepancy allows crafted entities to bypass validation and later be interpreted as JavaScript URLs during HTML5 rendering, enabling script execution in the embedding page's origin. The vulnerability is fixed in version 1.0.0.

CVE-2026-107303 is a cross-site scripting (XSS) vulnerability in the JHipster generator-jhipster and react-jhipster components prior to versions 9.4.0 and 1.1.0 respectively. The vulnerability allows an authenticated user with write access to store malicious Blob data that can execute active HTML or SVG content under the application origin when accessed by a privileged user. This issue arises from improper neutralization of input during web page generation and depends on the generated application's content security policy and browser Blob behavior. The vulnerability is fixed in generator-jhipster 9.4.0 and react-jhipster 1.1.0.

IBM DataPower Gateway 10.5.0.0 through 10.5.0.22, 10.6.1 through 10.6.6, 10.6.0.0 through 10.6.0.10, and 11.0.0.0 through 11.0.0.2 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

IBM DataPower Gateway 10.6.0.0 through 10.6.0.10 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.

The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.

The GPTranslate WordPress plugin before 2.34.14 does not properly restrict who can store translations, and does not escape them when outputting them in translated pages, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks when server-side translations are enabled.

The Aurora Heatmap plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 1.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user clicks the injected heatmap link.

CVE-2026-95595 is a reflected cross-site scripting (XSS) vulnerability in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' (Fontsplugin). This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. It affects versions up to and including 2.0.2. The vulnerability has a high severity with a CVSS score of 7.1.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Stored XSS. This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.19.

Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) which in specific conditions could potentially enable a remote authenticated attacker as administrator to store and potentially execute arbitrary JavaScript code in the Appliance Management Console (AMC).

This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.

CVE-2026-93684 is a stored cross-site scripting (XSS) vulnerability in Apache Impala up to version 4.5.2. An SQL user with only SELECT permission can inject JavaScript code into a table alias, which executes in another user's browser when viewing the query plan in Impala's Web UI. This vulnerability allows limited impact on confidentiality and integrity but does not affect availability. Users are advised to upgrade to version 4.5.3 to remediate the issue.

The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link.

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting.