svg-sanitizer versions before 1.1.0 contain a cross-site scripting (XSS) vulnerability. This flaw allows attackers to bypass sanitization by embedding javascript: URLs within the animateTransform values attribute of SVG files. When a crafted SVG file with this payload is uploaded and a Safari user clicks the affected link, arbitrary JavaScript code can execute.
CVE-2026-120332 is a vulnerability where the HTML content of emails and tracked URLs is rendered without escaping in a backend module. This allows backend users with access to the mail module to inject arbitrary HTML and JavaScript. The injected code executes in the context of other backend users who view the mail preview or report, potentially leading to cross-site scripting (XSS).
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:CVE-2026-108060: Nombre in ‘/Trabajadores/Create’.
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108059: Observaciones in ‘/Terceros/Create’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108058: Nombre in ‘/PlantillasMail/Edit’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108057: Nombre in ‘/PlantillasPdf/Edit/1273129’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108056: NombrePF in ‘/Empresas/Create’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108055: Nombre in ‘/Inmuebles/Create’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108054: Nombre in ‘/Familias/Edit/{id}’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108053: Nombre in ‘/CuentasCorrientes/Create’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108052: Codigo in ‘/CategoriasFicheros/Edit/{id}’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108051: Nombre in ‘/Articulos/Create’;
A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionality. Insufficient sanitization and encoding of the specified fields allow JavaScript to be stored, which executes in other users’ browsers when they view the affected records. Exploitation requires authenticated access to the affected functionality. The code can alter the displayed content and perform actions within the context of the victim’s session. The list of features, parameters, and endpoints is as follows:
CVE-2026-108050: ReferenceOtherParty in ‘/Documents/DeliveryNotes/Edit/{id}’;
billboard.js versions before 4.1.3 contain a vulnerability that allows execution of malicious JavaScript due to improper sanitization of series IDs during legend template rendering. This flaw can lead to cross-site scripting (XSS) attacks if untrusted input is used in series IDs.
The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the 'title' parameter in all versions up to and including 0.9.9. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing HTML-entity-encoded payloads to bypass WordPress core's filtering mechanisms.
The Photo Engine (Media Organizer & Lightroom) WordPress plugin versions up to and including 6.5.7 contain a stored cross-site scripting (XSS) vulnerability via the 'hierarchy[].name' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with an authentication mechanism that relies solely on a user meta token without proper capability checks. This token is exposed on admin pages due to a commented-out guard, increasing the risk of exploitation.
The News Kit Addons For Elementor WordPress plugin versions up to and including 1.4.8 contain a stored cross-site scripting (XSS) vulnerability via the 'formData' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The flaw is due to an operator-precedence bug in handle_scripts() and improper sanitization that permits encoded angle brackets to be restored and executed.
CVE-2025-5769 is a cross-site scripting (XSS) vulnerability in the authentication endpoint of WSO2 API Control Plane. The endpoint fails to properly encode user input before rendering it, allowing attackers to inject malicious JavaScript. Exploitation can lead to browser redirection, content modification, or data exfiltration. Session hijacking is mitigated by the httpOnly flag on sensitive cookies. Multiple versions prior to fixed releases are affected.