GeoNode versions prior to 5.0.3 contain a stored cross-site scripting (XSS) vulnerability in the handling of document abstract metadata. This flaw allows a low-privileged remote user to inject arbitrary HTML and JavaScript that executes in the browsers of other users viewing the affected document page. The vulnerability is fixed in GeoNode version 5.0.3.
CVE-2026-62346 is a high-severity cross-site scripting (XSS) vulnerability in open-wanderer wanderer versions prior to 0.19.3. Authenticated local users can submit crafted waypoint.name and waypoint.icon values that are improperly handled in the elevation profile rendering, leading to script execution in the browser of any victim viewing the profile. Additionally, federated waypoints can propagate this malicious input across instances without requiring local accounts on the target instance. The vulnerability allows attackers to expose session data or perform actions in the victim's context. The issue is fixed in version 0.19.3.
CVE-2026-62345 is a cross-site scripting (XSS) vulnerability in open-wanderer wanderer versions prior to 0.19.3. An authenticated user can inject malicious script via the waypoint.icon value, which is inserted without validation into map marker HTML. This script executes in the browser of anyone viewing the affected trail map, potentially exposing session tokens or allowing actions on behalf of the victim. Federated waypoint data can also trigger this without a local account on the receiving instance. The issue is fixed in version 0.19.3.
OHIF Viewers is a zero-footprint DICOM viewer with shared extension packages. From 3.5.0-beta.0 until 3.12.15, 3.13.7, and 3.14.0-beta.19, the dicom-pdf extension reads the attacker-controlled MIMETypeOfEncapsulatedDocument value in extensions/dicom-pdf/src/getSopClassHandlerModule.js and uses it as the Blob media type for the attacker-controlled EncapsulatedDocument bytes. When a victim opens Encapsulated PDF SOP Class 1.2.840.10008.5.1.4.1.1.104.1, extensions/dicom-pdf/src/viewports/OHIFCornerstonePdfViewport.tsx embeds the Blob URL in an object element. A Blob labeled as HTML is handled as HTML despite the application/pdf object hint, and the Blob inherits the OHIF origin, allowing embedded script to access session storage, authentication tokens, and same-origin PACS requests. The malicious DICOM object may be opened locally, uploaded to a shared PACS, or supplied by a DICOMweb source. This issue is fixed in source versions 3.12.15, 3.13.7, and 3.14.0-beta.19.
CVE-2026-85742 is a high-severity cross-site scripting (XSS) vulnerability in FreeScout versions prior to 1.8.230. It allows a pre-authenticated attacker to inject HTML into a failed-login email value, which is then processed and stored in a way that can lead to execution of attacker-controlled JavaScript when an administrator views specific job details. This issue requires several conditions including monitoring of user activity logs, a failed alert email job, queue failure storage, and the administrator opening a specific endpoint as a top-level page. The vulnerability is fixed in FreeScout version 1.8.230.
CVE-2026-106143 is a Cross-Site Scripting (XSS) vulnerability in the Editor component of Progress Software Kendo UI for Vue. Versions from 2.7.1 up to but not including 10.1.0 are affected. The flaw allows a low-privileged attacker who can supply content to the Editor to execute arbitrary JavaScript in another user's browser via unsafe URLs entered in the Insert Link or Insert Image dialogs. The vulnerability is fixed in version 10.1.0.
A Cross-Site Scripting (XSS) vulnerability exists in the Editor component of Progress Software KendoReact versions 2.7.0 through 16.1.0. This flaw allows a low-privileged attacker who can supply content to the Editor to execute arbitrary JavaScript in another user's browser when the user clicks a crafted link with an unsafe URL embedded in the Editor content. The vulnerability is fixed in version 16.2.0.
A Cross-Site Scripting (XSS) vulnerability exists in the Editor component of Progress Software Kendo UI for Angular versions prior to 25.3.0. This flaw allows a low-privileged attacker to execute arbitrary JavaScript in another user's browser by supplying Editor content containing a link or image with an unsafe URL. The vulnerability is fixed in version 25.3.0.
A Cross-Site Scripting (XSS) vulnerability exists in the Chat component of Progress Software KendoReact versions 0.6.0 through 16.1.0. This flaw allows a low-privileged attacker who can supply chat messages to execute arbitrary JavaScript in the context of the application by exploiting an unsafe URL in an openUrl quick action triggered when a user clicks the action. The vulnerability is fixed in version 16.2.0.
CVE-2026-62854 is a cross-site scripting (XSS) vulnerability in FreeScout versions prior to 1.8.225. It allows a user with permission to edit mailbox signatures to inject scriptable content by combining uploaded files and nested tag fragments that bypass sanitization. The malicious script executes with the victim's privileges when they open the mailbox reply editor or new-ticket page. This vulnerability is fixed in FreeScout version 1.8.225.
CVE-2026-106134 is a Cross-Site Scripting (XSS) vulnerability in the Menu component of Progress Software's KendoReact library. It affects versions 1.3.0 through 16.1.0. A low-privileged attacker who can influence the Menu item data can inject unsafe URLs that execute arbitrary JavaScript when a user selects the malicious menu item. This vulnerability has been fixed in version 16.2.0.
CVE-2026-106135 is a Cross-Site Scripting (XSS) vulnerability in the Chat component of Progress Software's Kendo UI for Angular versions prior to 25.3.0. It allows a low-privileged attacker who can supply chat messages to execute arbitrary JavaScript in another user's browser by exploiting an unsafe URL in an openUrl quick action. The vulnerability is fixed in version 25.3.0.
Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows an attacker to execute backend IPC commands by convincing a user to open a specially crafted SAZ file.
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'item_title (parsed from feed <item><title>)' parameter in all versions up to, and including, 5.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have previously configured a Feed-to-Post import pointing at an attacker-controlled feed URL, after which the attacker can rotate payloads at will without any further interaction with the site.
The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bf_post_type (and buddyforms_form_content)' parameter in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that at least one BuddyForms form with public submissions enabled exists on the site (so that the required nonce can be harvested from the public form page) and that the active theme registers a widgetized sidebar, allowing the injected customize_changeset to place a malicious Custom HTML widget into the site's front end.
The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr title> attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post.
The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'custom_fields[].value.label (for key='track')' parameter in all versions up to, and including, 5.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site's Player Library option to be configured as Plyr/Vidstack (aiovg_player_settings[player]='vidstack') rather than the Video.js default, as the DOM innerHTML sink exists only in the Plyr/Vidstack template path.
The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's Option Tracking setting to be configured to 'Legacy' mode, and succeeds despite WordPress ultimately returning HTTP 403 to the low-privileged caller because the vulnerable 'all' filter fires before the capability check in wp-admin/options.php.
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all versions up to, and including, 8.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVE-2026-84164 is a cross-site scripting (XSS) vulnerability in Ericsson CodeChecker versions before 6.29.3. The vulnerability arises because the HTML reports generated by CodeChecker embed report messages, checker names, and source file paths into a script block using json.dumps, which does not escape the less-than character. This allows a maliciously crafted closing script tag in these fields to break out of the script block and inject arbitrary HTML. The vulnerability affects reports published without a restrictive Content Security Policy (CSP). Jenkins userContent is likely safe due to its restrictive CSP, but other publishing destinations without CSP are vulnerable. The issue is fixed in version 6.29.3.