The MCB WordPress plugin through 1.0.0 does not sanitise or escape request header values before storing them and later rendering them in the administrator statistics grid, allowing unauthenticated attackers to store malicious JavaScript that executes in an administrator's browser session when the statistics page is viewed.
CVE-2026-119432 is a stored cross-site scripting (XSS) vulnerability in Foxit Workspace's file share preview feature. An attacker can upload a malicious file and share it with a victim. When the victim previews the file, the embedded script executes within the application's origin, potentially allowing access to locally stored credentials and enabling credential theft.
CVE-2026-88986 is a cross-site scripting (XSS) vulnerability in Kubeflow Pipelines prior to version 2.15.0. It affects the frontend routes /pipeline/k8s/pod and /pipeline/k8s/pod/events, where untrusted query parameters are included in HTML-capable error responses. An unauthenticated attacker can craft a malicious link that executes JavaScript in the frontend origin when visited by an authenticated user with route access. The vulnerability allows limited impact such as cookie disclosure depending on cookie attributes, but does not establish server-side code execution or availability impact. The issue is fixed in version 2.15.0.
Altair GraphQL client versions from 7.2.4 up to but not including 8.5.8 contain a cross-site scripting (XSS) vulnerability. The flaw arises from unsafe handling of the iframe-sandbox query string parameter, allowing attacker-controlled script URLs to be injected and executed in the origin context when a crafted URL is directly accessed. This bypasses the intended iframe sandbox protections. The vulnerability is fixed in version 8.5.8.
OpenEMR versions prior to 8.3.0 contain a stored cross-site scripting (XSS) vulnerability in two PHP form scripts. Authenticated clinical users can inject malicious event-handler markup by submitting crafted input containing double quotes, which escapes HTML attribute boundaries. This can lead to exposure of session data and protected health information or unauthorized patient-record actions when another clinician views the affected form. The vulnerability is fixed in OpenEMR version 8.3.0.
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in OpenText OpenText Directory Services (OTDS) on Windows and Linux allows Cross-Site Scripting (XSS).
This issue affects OpenText Directory Services (OTDS): from 25.1 through 26.2.
A stored cross-site scripting (XSS) vulnerability exists in the Gridbox extension for Joomla by balbooa.com. The issue occurs in versions 1.0.0 through 2.20.4.2 due to inconsistent sanitization of user reviews. This flaw allows attackers to inject malicious scripts that can execute in the context of affected users' browsers.
Joomla Extension - tassos.gr - Privileged stored XSS in Advanced Custom Fields 2.8.2-2.8.15, 3.0.0-3.1.8 and Smile Pack 1.1.2-1.2.9, 2.0.0-2.1.6 - A user who could edit a Map marker label, like an article author, could add a script that ran for anyone who opened the marker.
CVE-2026-75599 is a cross-site scripting (XSS) vulnerability in sysadminsmedia HomeBox, a home inventory and organization system. Versions prior to 0.27.0 allow authenticated users to store javascript: URIs in markdown-style links within entity custom-field values. These links are rendered as clickable anchors on item pages, enabling execution of attacker-controlled JavaScript when clicked by other authenticated users. This can lead to session theft, account takeover, or data exfiltration. The issue is fixed in version 0.27.0.
HeyForm versions prior to 3.0.1 contain a cross-site scripting (XSS) vulnerability in the /api/upload endpoint. This endpoint accepts files with client-controlled mimetypes but serves them as text/html without a content security policy, allowing an attacker to upload active HTML. When a victim accesses the uploaded file's URL, the malicious script executes in the context of the HeyForm origin, potentially accessing or modifying data via the /graphql endpoint using the victim's session. The vulnerability is fixed in version 3.0.1.
A cross-site scripting (XSS) vulnerability exists in the Catalog image viewer component of Apache OFBiz versions before 24.09.08. This flaw allows an unauthenticated attacker to execute arbitrary JavaScript in the browser session of a logged-in back-office user by crafting a malicious viewImage URL that the user opens within the application. The issue is fixed in version 24.09.08.
CVE-2026-103863 is a cross-site scripting (XSS) vulnerability in Apache Sling Engine prior to version 3.0.4. The flaw arises from improper neutralization of input during web page generation, allowing stored XSS despite enabled protections. The vulnerability involves evasion of content-type and charset enforcement mechanisms through multiple header and redirect manipulations. The issue is fixed in Apache Sling Engine version 3.0.4.
CVE-2026-96677 is a critical cross-site scripting (XSS) vulnerability in Apache Juneau affecting versions prior to 9.2.1. The issue arises because HTML document serialization does not encode variable substitutions in page chrome elements such as headers and navigation bars. Applications that include request-derived variables in these areas without encoding them are vulnerable to XSS attacks. The default chrome does not use request variables, so only customized applications are affected. The vulnerability is fixed in Apache Juneau version 9.2.1.
The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.
The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.
The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.
This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value before outputting it in a page, which could allow users with the Contributor role and above to inject arbitrary web scripts that execute when a higher-privileged user views the affected page.