CVE-2026-112247 is a cross-site scripting (XSS) vulnerability in Wuxi Wubang Security Software Five-in-One Safety Production Management Information System versions 3.0 through 3.5. The flaw exists in the Upload Endpoint component, specifically in the /FCKeditor/editor/filemanager/connectors/aspx/upload.aspx file, where manipulation of the NewFile argument can lead to XSS. The vulnerability can be exploited remotely and public exploit code is available. The vendor has not responded to disclosure attempts.
CVE-2025-6623 is a cross-site scripting (XSS) vulnerability in the WSO2 API Manager's carbon console. The vulnerability arises because user-supplied XML input is not properly encoded, allowing injection of malicious scripts. Exploitation enables remote attackers to execute arbitrary JavaScript in the victim's browser context, potentially redirecting users or modifying the web page interface. Session hijacking is mitigated by the httpOnly flag on session cookies. Multiple versions prior to specific fixed releases are affected.
A cross-site scripting (XSS) vulnerability exists in mljar mercury versions 3.0.0 through 3.2.10. The vulnerability arises because mr.Markdown converts attacker-controlled Markdown to HTML without sanitizing raw HTML, allowing malicious HTML and event-handler attributes to execute in the browser when viewed by another user. This issue is fixed in version 3.2.11.
Koalixcrm versions up to 1.14.0 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows staff users to inject malicious scripts via task titles, which are rendered without proper escaping by the Task.link_to_task() function. When administrators view the affected task changelist or change form, the embedded scripts execute, potentially enabling unauthorized actions such as creating a superuser account.
CVE-2026-56858 is a cross-site scripting (XSS) vulnerability in the Go html/template package used by Red Hat OpenShift Virtualization v4.16 images. The flaw allows pathological inputs to prematurely close an unescaped forward slash, enabling arbitrary content injection and potential client-side script execution. This vulnerability affects applications that render untrusted input using this package. Red Hat has classified this as an important security issue with a high severity rating. No fix or mitigation meeting Red Hat's criteria is currently available.
CVE-2026-111414 is a stored cross-site scripting (XSS) vulnerability in Crocoblock JetElements For Elementor versions before 2.9.2.5. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The issue affects all versions from initial release up to 2.9.2.4 and has been fixed in version 2.9.2.5.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf e2pdf allows Stored XSS.This issue affects e2pdf: from n/a through 1.32.57.
CVE-2026-112199 is a stored cross-site scripting (XSS) vulnerability in the YITH WooCommerce Wishlist plugin affecting versions before 4.19.0. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers with low privileges to execute malicious scripts in the context of affected users. The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. A fix is available in version 4.19.0.
CVE-2026-64944 is a Cross-site Scripting (XSS) vulnerability in Apache Answer versions up to 2.0.2. The issue arises because imported question bodies are stored as raw HTML without sanitization, allowing attacker-controlled HTML to be persisted and rendered to all users, including privileged ones. This vulnerability is fixed in version 2.0.3.
MISP versions prior to 2.5.48 contain a reflected cross-site scripting (XSS) vulnerability in the workflow module interface. This flaw arises because parameter names returned by the misp-modules service are rendered as raw HTML without proper output encoding. An attacker who can influence these parameter names may inject arbitrary JavaScript that executes in the context of an authenticated user's browser, potentially leading to session token theft or unauthorized actions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Stored XSS.This issue affects Tutor LMS: from n/a through 4.1.2.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz Maker quiz-maker allows Reflected XSS.This issue affects Quiz Maker: from n/a through 6.7.1.91.
SourceCodester Inventory System version 1.0 contains a cross-site scripting (XSS) vulnerability in the Product Management component, specifically in the /api/products_handler.php?action=save endpoint. The vulnerability arises from improper handling of the Product_Id and Product_Name parameters, allowing remote attackers to inject malicious scripts. This flaw has a medium severity rating with a CVSS score of 5.1. Exploit code for this vulnerability has been published, but there is no indication of active exploitation in the wild. No patch or remediation information is currently available.
The Document Gallery WordPress plugin through 5.1.1 does not sanitise or escape several gallery shortcode attributes before embedding them in a single-quoted HTML attribute in the rendered gallery markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when a higher privileged user views the content.
The Blaze Demo Importer WordPress plugin before 1.0.17 does not sanitize uploaded SVG files and registers the SVG MIME type for the WordPress media library unconditionally, allowing authenticated users with the Author role or higher to upload a crafted SVG that executes arbitrary JavaScript in the browser of any user who opens the file.
A cross-site scripting (XSS) vulnerability exists in the diem-project diem software affecting the dmBaseLinkTag::text function in the dmWidget component. This flaw allows remote attackers to manipulate the 'text' argument, potentially leading to XSS attacks. The product uses a rolling release model, so no specific affected or fixed versions are identified. The vulnerability has a medium severity score and public exploit code is available. The project has been notified but has not yet responded or issued a fix.
CVE-2026-112038 is a cross-site scripting (XSS) vulnerability in the diem-project diem software affecting the html function in dmAdminPlugin/web/js/dmAdminCtrl.js within the Version Check Service component. The vulnerability allows remote attackers to inject malicious scripts. The project uses a rolling release model, so specific affected or fixed versions are not provided. The issue was reported early but has not yet received a response from the project. Public exploit details are available, but no known exploitation in the wild has been confirmed.
CVE-2026-38671 is a Cross Site Scripting (XSS) vulnerability in Ellucian Banner Student Registration Self-Service (StudentRegistrationSsb) version 9.23 and earlier. The flaw allows a remote attacker to execute arbitrary code via the mepCode parameter of the /ssb/registration endpoint. No fixed version is currently available.
The Bootstrap Shortcodes plugin for WordPress before 3.4.6 is vulnerable to stored XSS via the id attribute of the [bs_tcontent] shortcode. The bs_tcontent() shortcode handler in inc/bs_tabs.php emits the id attribute value into an unquoted HTML attribute. esc_attr() is applied, but it does not encode space characters, so a space in the supplied value terminates the attribute and any following text is parsed as additional HTML attributes, including JavaScript event handlers. This allows authenticated attackers with Contributor-level access and above to inject arbitrary web script that executes in the browser of any user who views the page and interacts with the injected element.