CVE-2026-120242 is a cross-site scripting (XSS) vulnerability affecting several Ruijie switch models including RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP, and RG-ES210GS-P running ESW_1.0(1)B1P48. The flaw exists in the Cloud Management component's set_cloud_serverUrl.cgi file, where manipulation of the 'url' argument allows remote XSS attacks. The vendor did not respond to disclosure attempts, and a public exploit is available.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1.
CVE-2026-113429 is a cross-site scripting (XSS) vulnerability in Gitea affecting legacy Actions artifact uploads (versions prior to 28.3.0). The vulnerability arises because the Content-Encoding header from artifact uploads was stored unchecked and used as the Content-Type when serving the artifact. If the Content-Type starts with video/ or audio/, it disables the sandboxing Content-Security-Policy, allowing an attacker to upload an artifact that a browser renders as HTML. This enables execution of attacker-controlled scripts in the context of the Gitea origin, potentially leading to session hijacking or full instance control if an administrator is targeted. The issue is fixed in version 28.3.0 by restricting stored headers and serve headers to valid media types only.
A stored cross-site scripting (XSS) vulnerability exists in the Media Library Assistant WordPress plugin versions before 3.44. The flaw arises because one of the plugin's shortcode attributes is not properly escaped before being output in an attribute of generated links. This allows users with Contributor role or higher to inject malicious scripts that persist and execute in other users' browsers.
CVE-2026-120218 is a cross-site scripting (XSS) vulnerability in Typemill up to version 2.26.0. The flaw exists in the ControllerApiImage::saveImage function within SvgSanitizer.php. This vulnerability can be exploited remotely and allows attackers to execute malicious scripts. An exploit has been published publicly. Upgrading to Typemill version 2.27.0 resolves the issue.
Thelia versions before 3.1.1 have a stored cross-site scripting (XSS) vulnerability that allows authenticated back-office administrators with store update permissions to inject malicious scripts by uploading unsanitized SVG images as logo or banner files. This vulnerability enables attackers to execute scripts in the context of visitors and higher-privileged administrators via payloads served from specific directories.
CVE-2026-120190 is a cross-site scripting (XSS) vulnerability in PostyBirb Plus versions 3.1.0 through 3.1.19. It affects an unknown functionality within the Submission Description Editor component, specifically the file DescriptionInput.tsx. The vulnerability allows remote attackers to perform XSS attacks. A public exploit exists. Upgrading to version 3.1.76 resolves this issue.
Thelia versions prior to 3.1.0 have a stored cross-site scripting (XSS) vulnerability in the ForSomeCustomers::getSummary() function. This flaw allows unauthenticated attackers to inject malicious scripts via unescaped customer names during registration. When administrators view coupons related to these customers, the injected scripts execute, potentially stealing CSRF tokens and enabling attackers to create administrator accounts.
WebDyne versions from 2.014 up to but not including 3.022 contain a cross-site scripting (XSS) vulnerability. This occurs because certain form tags (textfield, password_field, filefield) reflect request parameters into their value attributes without proper escaping. The default escaping control (WEBDYNE_CGI_AUTOESCAPE) is off, and from version 2.022 the entity encoding method was replaced with a no-op, rendering escaping ineffective. An attacker can inject malicious scripts via crafted links using these tags.
The BuddyBoss Platform plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 3.6.0. This flaw arises from insufficient input sanitization and output escaping of the Group Name field. Authenticated users with subscriber-level access or higher can exploit this vulnerability to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the "Enable social group creation by all members" setting to be enabled, which is the default configuration. If group creation is restricted to administrators, exploitation is not possible.
The Debug Log Manager plugin for WordPress up to version 2.5.2 is vulnerable to stored cross-site scripting (XSS) via the 'message' and 'pageUrl' parameters. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires that debug logging with JavaScript error logging is enabled and that the attacker can obtain a publicly emitted nonce to bypass endpoint checks.
The FlexStock plugin for WooCommerce on WordPress is vulnerable to stored Cross-Site Scripting (XSS) via the 'products[].post_content' parameter in all versions up to and including 3.17.2. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping, combined with exposure of the REST bearer token in the Dashboard page source without proper capability checks.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'post_images' parameter affecting all versions up to and including 2.8.197. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute in the browsers of administrators or editors when they view the pending listing's edit screen. This vulnerability enables a privilege escalation chain through normal editorial workflows.
The Ninja Forms plugin for WordPress up to version 3.15.5 is vulnerable to reflected DOM-based cross-site scripting (XSS) via a crafted 'querystring:<key>' URL parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute in the context of a victim's browser if they are tricked into clicking a malicious link.
The WooCommerce Extra Product Options Pro plugin for WordPress up to version 3.3.2 is vulnerable to reflected cross-site scripting (XSS) via specific parameters related to Date & Time Range Picker fields. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link on affected product pages. Exploitation requires no prior knowledge beyond viewing the product page source to identify the vulnerable parameter names.