The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display configuration values before storing them and outputting them in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page containing the affected gallery.
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a page embedding the gallery.
The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.
Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”) in ASUS router modules allows a remote attacker to read DOM information, modify router settings, and cause a denial-of-service condition when an authenticated user visits a crafted URL.Refer to the '
Security Update for ASUS Router Firmware ' section on the ASUS Security Advisory for more information.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Commons BCEL. This only happens when you're using Class2HTML to generate webpages for possibly-attacker-controlled class files, where Class2HTML emitters write attacker class-file strings into HTML unescaped (stored XSS in reports). This issue affects Apache Commons BCEL: before 6.13.0. Users are recommended to upgrade to version 6.13.0, which fixes the issue.
CVE-2026-101157 is a stored cross-site scripting (XSS) vulnerability in Arista Networks CloudVision CUE. It allows an unauthenticated attacker with adjacent-network access to inject malicious content that executes when an authenticated user views the affected content. Exploitation can compromise the victim's authenticated browser session, access sensitive data, modify system state, or disrupt services. The vulnerability affects versions from 2021.2.0 through 2026.2.0. It has a high severity with a CVSS score of 8.7.
CVE-2026-101156 is a stored cross-site scripting (XSS) vulnerability in Arista Networks CloudVision CUE that affects versions from 2025.2.0 through 2026.2.0. An authenticated high-privilege administrator can store malicious content in configurations, which may execute in the browsers of other authenticated users viewing or comparing those configurations. Exploitation could allow attackers to leverage the victim's browser session to access sensitive data, modify configurations, or disrupt wireless services.
CVE-2026-101158 is a stored cross-site scripting (XSS) vulnerability in the Fileserver upload API of Arista Networks CloudVision Portal. It affects multiple versions including 1.0.0 through 2026.1.2 and version 2026.2.0. An authenticated attacker with file upload privileges can exploit this flaw to execute malicious scripts in the context of other users' browsers. Successful exploitation could allow session hijacking and potentially grant full access to the victim's account and administrative permissions.
CVE-2026-106512 is a high-severity vulnerability in the MISP sachertortephp component where the CakeResponse::download() method improperly sanitizes filenames used in the Content-Disposition HTTP header. This flaw allows an authenticated user to craft filenames that inject HTTP header content, leading to stored cross-site scripting (XSS) when other users view affected pages. The vulnerability arises from two injection vectors: control characters causing header omission and double-quote characters enabling header parameter injection. Exploitation can result in session hijacking, data exfiltration, and unauthorized actions within the application context.
Quasar Framework versions prior to 3.3.0 contain a cross-site scripting (XSS) vulnerability due to improper neutralization of input during server-side rendering and static site generation. The vulnerability arises when the ssrContext.nonce value is interpolated directly into quoted HTML attributes without proper sanitization, allowing an attacker to inject malicious markup if they can control or override this value. This issue is fixed in version 3.3.0.
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError() in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env, request headers, and cookies into the HTTP page returned by serve.devError(), while the development server listened on all interfaces by default. Any network-adjacent client that reaches an SSR or SSG render failure through this development-only error path can obtain shell environment secrets. The renderer escaped only one exact lowercase script closing-tag spelling, so case variants and valid closing-tag delimiter variants in reflected diagnostic data could terminate the script element and inject markup; executing the injected code in a developer browser additionally requires the payload to accompany that developer's request. This issue is fixed in @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0.
Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to 2.22.0, the SSR-only getHead() serializer in ui/src/plugins/meta/Meta.js used getAttr() to interpolate values supplied through useMeta() into title, meta, link, and script markup without HTML text or quoted-attribute encoding. injectServerMeta() appended that output to the raw server-rendered response. An attacker who can influence dynamic page metadata, such as a post title, product name, excerpt, or display name, can terminate the intended HTML context and inject executable markup before hydration. The client-side apply() path is not affected because it uses DOM APIs that encode attributes. This issue is fixed in version 2.22.0.
## Impact
A malicious SVG file upload could bypass sanitization, be stored, and execute attacker-controlled JavaScript (XSS) after a user downloads it and opens it.
**You are affected if:**
- You have a collection configured to upload and allow SVG files which can then be downloaded by users.
## Patches
The fix validates SVG content on every upload path and hardens SVG/XML delivery so stored SVGs cannot frame attacker content.
Users should upgrade Payload packages to `>= 3.90.0` or `>= 4.0.0-canary.34`.
## Workarounds
Disallow SVG uploads, or serve uploaded SVGs as downloads with Content-Disposition: attachment and a strict CSP. These mitigations reduce exposure but do not replace upgrading when the patched release is available.
SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.261.029, POST /api/group_documents/upload stores an attacker-controlled group document filename that group_workspaces.html later interpolates into inline Share event handlers. The escapeGroupHtml function leaves apostrophes unchanged, while escapeHtml produces an HTML entity that the browser decodes before JavaScript evaluation, so either path permits the filename to terminate the handler string. An authenticated group Owner, Admin, or DocumentManager can persist script that executes in the SimpleChat origin when another group member clicks Share, allowing access to victim-visible data and actions with the victim session. This issue is fixed in version 0.261.029.
CVE-2025-15591 is a medium severity cross-site scripting (XSS) vulnerability in the Forums feature of OpenText Content Management Content Server. It allows an attacker to inject malicious code into a Forums web page. The vulnerability affects versions from 20.3 up to but not including 25.3. There is no information about an available patch or vendor advisory specifying remediation status. No known exploits in the wild have been reported.
CVE-2026-12380 is a reflected cross-site scripting (XSS) vulnerability in Akıllı Ticaret Software Technologies Ltd. Co.'s E-Commerce Pack. It arises from improper neutralization of input during web page generation. The vulnerability affects versions up to and including 2026-10-06. The vendor was contacted but did not respond regarding this issue. The CVSS v3.1 score is 6.1, indicating a medium severity risk.