Search: xss.is

Sector, a Drupal distribution, contains a vulnerability in a module that insufficiently sanitizes media names, which could allow cross-site scripting (XSS) attacks. Exploitation requires the attacker to have permissions to create or edit media entities. The vulnerability affects versions prior to 10.3.3 and versions from 10.4.0 up to but not including 10.4.2. A patch is available to address this issue.

The Drupal swiper_formatter module integrates the SwiperJs library and suffers from a cross-site scripting (XSS) vulnerability due to insufficient filtering of user-entered text used in slide captions. Exploitation requires the attacker to have a role with permission to edit captions, limiting the attack surface. Patches are available for affected versions.

The Drupal csv_field module allows uploading CSV files to a field and displaying them as interactive tables. A vulnerability exists due to insufficient escaping of CSV cell and header values before passing them to the DataTables library, which can lead to cross-site scripting (XSS). Exploitation requires the attacker to have permissions to create or edit content containing a CSV field. Patches are available for affected versions.

A cross-site scripting (XSS) vulnerability exists in Nuxt versions prior to 4.6.0. This flaw arises from an incomplete fix for a previous issue (CVE-2026-53722) where an attacker can craft a script-capable URL by prefixing attacker-controlled input with an ASCII C0 control character. The no-pages router misclassifies such input as an internal route and renders it in an anchor href, which browsers then interpret as a javascript: URL after removing the control character. Exploitation requires a victim to click the malicious link, leading to script execution within the application's origin. The vulnerability is fixed in Nuxt version 4.6.0.

Astro versions prior to 7.3.2 contain a cross-site scripting (XSS) vulnerability in their JSX and MDX rendering pipeline. The vulnerability arises because string children of script and style elements are treated as trusted HTML without proper distinction between compiler-generated literals and dynamic expressions. This allows attacker-controlled data to inject arbitrary HTML and JavaScript if passed directly as dynamic children. The issue is fixed in version 7.3.2.

CVE-2026-114127 is a low-severity cross-site scripting (XSS) vulnerability in the Astro web framework versions 7.1.0 through 7.3.2. The issue arises from Astro's server-side View Transition CSS generator, which improperly handles string animation properties, allowing attacker-controlled input to inject additional CSS rules. Although the injection cannot break out of the style element or inject HTML/JavaScript directly, it can manipulate the page's appearance and potentially expose data through CSS-based techniques. This vulnerability is fixed in version 7.3.3.

CVE-2026-76475 is a critical cross-site scripting (XSS) vulnerability affecting multiple Cisco collaboration products including Cisco Emergency Responder and Cisco Unified Communications Manager variants. The flaw arises from improper neutralization of input during web page generation, allowing potential injection of malicious scripts. Cisco has conducted an internal security review and released software hardening updates addressing these vulnerabilities.

A Cross-site Scripting (XSS) vulnerability exists in odf-kit versions from 0.6.0 up to but not including 0.14.2. The issue arises because certain inline CSS style attributes are not properly escaped when rendered into HTML, allowing malicious input to break out of style attributes and inject executable code. This vulnerability was patched in version 0.14.2.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Reflected XSS.This issue affects Geo Mashup: from n/a through 1.13.22.

CVE-2026-112221 is a stored cross-site scripting (XSS) vulnerability in Brainstorm Force's SureCart plugin affecting versions before 4.9.6. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1. A fix is available in version 4.9.6.

CVE-2026-111837 is a stored cross-site scripting (XSS) vulnerability in the Contest Gallery product by Wasiliy Strecker. The flaw involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. This vulnerability affects versions from initial releases up to 34.0.1. A fix is available in version 34.0.2. The CVSS 3.1 base score is 6.5, indicating a medium severity level.

CVE-2026-111838 is a high-severity reflected cross-site scripting (XSS) vulnerability in the ThemeHunk Customizer WordPress theme. It affects all versions from initial release up to and including 2.8.7. The flaw allows improper neutralization of input during web page generation, enabling an attacker to inject malicious scripts that could lead to partial confidentiality, integrity, and availability impacts. The issue is fixed in version 2.8.8.

CVE-2026-111840 is a reflected cross-site scripting (XSS) vulnerability in VideoWhisper.com's Paid Videochat Turnkey Site affecting versions prior to 7.5.15. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability is rated high severity with a CVSS score of 7.1. A fix is available in version 7.5.15.

CVE-2024-5139 is a cross-site scripting (XSS) vulnerability in the Authentication Endpoint of WSO2 Enterprise Integrator. The endpoint improperly encodes user input, allowing attackers to inject malicious JavaScript. Exploitation can lead to browser redirection, UI manipulation, or theft of sensitive browser information. Session hijacking is prevented by the httpOnly flag on session cookies. Multiple versions prior to specific fixed releases are affected.

Trudesk versions up to 1.2.11 have an unrestricted file upload vulnerability allowing authenticated users to upload HTML or SVG files to the public webroot. This can enable stored cross-site scripting (XSS) attacks and unauthorized replacement of instance branding by uploading script-bearing files disguised as images.