CVE-2026-105643 is a cross-site scripting (XSS) vulnerability in the Ghost blogging platform affecting versions from 6.34.0 up to but not including 6.67.0. The flaw allows any staff user, including Contributors, to embed scripts in post content that execute when another staff user opens the post in the editor, potentially compromising the admin session of that user. The issue arises from improper neutralization of input during web page generation related to embed cards in the Ghost editor. The vulnerability has been fixed in version 6.67.0.
A reflected cross-site scripting (XSS) vulnerability exists in the Dynamic Content Filter addon of the SP Page Builder Pro extension for Joomla. The issue occurs because slider minimum and maximum values are taken from a request parameter, HTML-escaped in an attribute but then echoed without escaping as text content, allowing an unauthenticated attacker to inject arbitrary HTML or JavaScript. The vulnerability affects versions 3.0.0 through 5.6.1p2 of the extension.
Plane is an open-source project management tool. Prior to 1.4.0, an authenticated low-privilege workspace member, including a Guest, can upload an image/svg+xml file as a generic or issue attachment. The file retains the attacker-controlled Content-Type, and the asset-download endpoint creates a presigned URL with Content-Disposition: inline. In the default self-hosted MinIO deployment, the asset URL is served from the same origin as the Plane application, allowing embedded SVG JavaScript to execute in the application's security context. A victim, including a workspace administrator, who opens the link can have the session compromised through stored XSS, leading to account takeover. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a high-severity cross-site scripting (XSS) vulnerability (CVE-2026-104979) affecting versions prior to 1.4.0. The vulnerability allows any authenticated user to inject arbitrary HTML into projects with a published DeployBoard and intake enabled. When a project member or viewer clicks the malicious link, JavaScript executes in their session, potentially exfiltrating a long-lived API token. This issue is fixed in Plane version 1.4.0.
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content, resulting in a denial-of-service condition within the web application.
The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Users → Users List. The vulnerability occurs in the “Microsoft Exchange mailbox” field, which fails to properly validate or sanitize user-supplied input before storing and rendering it.
By injecting malicious JavaScript into this field, an attacker can cause the payload to execute whenever the affected user properties are accessed. This can prevent access to the affected user properties and result in a denial-of-service condition within the application's user-management functionality.
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application.
The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domains, specifically in the “Description” field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field.
By injecting malicious JavaScript into the Description field, an attacker can modify the content and behavior of the affected page when it is viewed by other users. This could allow an attacker to alter the page's appearance, display attacker-controlled content, or construct convincing phishing scenarios within the application's trusted web context.
CVE-2026-103344 is a reflected cross-site scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) up to version 2.0.20. It allows improper neutralization of input during web page generation, enabling attackers to execute malicious scripts in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-97276 is a reflected Cross-site Scripting (XSS) vulnerability in the VeronaLabs WP Statistics WordPress plugin, affecting versions up to and including 14.16.14. It allows improper neutralization of input during web page generation, which could enable attackers to execute arbitrary scripts within a user's browser session. This vulnerability has a high severity rating with a CVSS score of 7.1.
CVE-2026-103354 is a stored cross-site scripting (XSS) vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks. It affects versions up to and including 3.7.11.1. The flaw involves improper neutralization of input during web page generation, which could allow attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.
A stored Cross-Site Scripting (XSS) vulnerability exists in the Simple Shopping Cart WordPress plugin before version 5.2.6. This vulnerability arises because some settings field values are not properly escaped before being output on an admin settings page. It allows high-privilege users, such as administrators, to inject malicious scripts. The issue is particularly impactful on multisite WordPress installations where administrators lack the unfiltered_html capability.
The Horizontal scrolling announcements WordPress plugin up to version 2.6 contains a stored Cross-Site Scripting (XSS) vulnerability. This occurs because one of its announcement settings is not properly sanitized or escaped before being output into an attribute context on the front end. Users with Contributor or higher privileges who have access to the announcement management page can inject malicious scripts. These scripts execute in the browsers of anyone viewing the affected announcements, potentially compromising confidentiality, integrity, and availability.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Reflected XSS.This issue affects Unlimited Elements For Elementor (Free Widgets, Addons, Templates): from n/a through 2.0.20.
The Twenty20 Image Before-After plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'offset' Shortcode Attribute in all versions up to, and including, 2.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPC Estimated Delivery Date for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'rule_data' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
The Mail logging – WP Mail Catcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PHPMailer 'wp_mail_failed' Error Message in all versions up to, and including, 2.1.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a separately installed plugin, such as Contact Form 7, that passes unauthenticated user-controlled input into mail fields whose content PHPMailer will include in its failure error message.
The WPFront Notification Bar plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.1. This is due to the debug-log output path (write_debug_logs) reflecting the raw value of $_SERVER['REQUEST_URI'] through vprintf() directly inside a <script> block emitted on wp_footer, without any sanitization or escaping (see the 'Current URL is "%s"' log entry produced by the URL-text display filter in the filter() method). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'thumb_url' parameter in all versions up to, and including, 1.8.46 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires that the authenticated victim holds the manage_options capability, as the editimage_bwg AJAX action performs a capability check but no nonce verification, meaning the payload can be delivered via a crafted GET request without a CSRF token.
The Responsive Plus – Elementor Templates & Starter Sites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The WPC Product Options for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via wpcpo-* Array Key via Multipart Field Name in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable via guest checkout without authentication because the malicious payload is embedded in a multipart Content-Disposition field name beginning with 'wpcpo-', which PHP's RFC1867 parser preserves byte-for-byte and stores into order item meta.
The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'REQUEST_URI (path segment after /android_json/search/)' parameter in all versions up to, and including, 11.84 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the app's content mode to be configured as 'webview' (i.e., the 'speed' option is not set to '1'), which is a supported and still-shipped mode, though no longer the default.