CWE-79: Cross-site Scripting vulnerabilities

Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

CVE-2026-39726 is a reflected Cross-site Scripting (XSS) vulnerability in Lumise Product Designer before version 2.1.4.1. It involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability has a high severity score of 7.1 and affects versions from initial releases up to but not including 2.1.4.1. A fix is available in version 2.1.4.1.

Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

CVE-2026-32574 is a high-severity cross-site scripting (XSS) vulnerability in EDGARROJAS Smart Forms. It involves improper neutralization of input during web page generation, leading to a DOM-based XSS issue. The vulnerability affects versions from 0 up to and including 2.6.104. Exploitation requires user interaction and can impact confidentiality, integrity, and availability. No patch or official fix information is provided.

Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

Post SMTP plugin for WordPress versions up to 4.0.1 is vulnerable to stored cross-site scripting (XSS) via the 'user_email' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when a user views the affected page. The issue arises from insufficient input sanitization and output escaping, particularly on WordPress Multisite installations with public registration enabled. Attackers can exploit this by submitting email addresses with numeric HTML character references that bypass Post SMTP's validation and get logged verbatim.

Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.13, selecting a note containing a jsoncanvas fence causes the whiteboard text and file-node components in packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/TextNode.tsx and packages/app-desktop/gui/NoteEditor/NoteBody/WhiteboardEditor/nodes/FileNode.tsx to render card content with the full Markdown renderer. The components insert the resulting HTML into the main application document through dangerouslySetInnerHTML. A malicious note can inject style elements and remote CSS imports that modify trusted application chrome, signal when the note is opened, and potentially disclose exposed attribute values. Content Security Policy blocks inline script execution, so the supported impact is CSS injection and UI redressing rather than code execution. This issue is fixed in version 3.7.13.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost versions 6.22.1 through 6.64.0. The issue arises because the default local storage adapter does not enforce content type restrictions on uploaded files, allowing scripts to be hosted on the site's domain. This can lead to compromise of other staff users' admin sessions. The vulnerability is fixed in version 6.64.0.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost when creating bookmark cards. Non-image files fetched from external websites could be stored as bookmark icons or thumbnails, allowing any staff user, including Contributors, to host arbitrary HTML on the site's domain. This may lead to compromise of other staff users' admin sessions. The vulnerability affects Ghost versions from 5.94.0 up to but not including 6.64.0. Version 6.64.0 contains a fix for this issue.

CVE-2026-105650 is a cross-site scripting (XSS) vulnerability in the TryGhost Ghost blogging platform affecting versions from 2.5.0 up to but not including 6.64.0. The flaw allows attacker-controlled URLs to embed untrusted scripts in post content, which may execute in the Ghost editor, on published sites, and in newsletter emails. This could lead to compromise of a staff user's administrative session. The issue is fixed in version 6.64.0.

A cross-site scripting (XSS) vulnerability exists in TryGhost Ghost where SVG media thumbnails and SVG images uploaded with incorrect file extensions were stored without proper sanitization. This flaw allows any staff user, including Contributors, to host malicious scripts on the site's domain, potentially compromising other staff users' admin sessions. The vulnerability affects Ghost versions from 4.22.0 up to but not including 6.65.0. Version 6.65.0 contains a fix for this issue.

CVE-2026-105644 is a cross-site scripting (XSS) vulnerability in TryGhost Ghost that affects versions from 4.0.0 up to 6.66.x. The issue arises because SVG images included in content imports were stored without proper sanitization. An attacker who tricks an Administrator into importing a crafted SVG file could host malicious scripts on the site's domain, potentially compromising admin user sessions. The vulnerability is fixed in version 6.67.0.