Base de CVEs

CVE-2026-19943 Média · 6.4 CWE-79 25/08/2026

Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious titleTag value survives wp_kses_post on save because it is stored inside a block-comment delimiter and the live HTML is only synthesized at render time by do_blocks(), meaning the payload also fires in administrator and editor sessions during post preview.

CVE-2026-17089 Média · 6.1 CWE-79 25/08/2026

Events Manager <= 7.4.0.1 - Reflected Cross-Site Scripting via 'header_format' Parameter

The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'header_format' parameter in all versions up to, and including, 7.4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The shortcode entry point sanitizes 'header_format' via wp_kses(), but the unauthenticated 'search_events_grouped' AJAX action bypasses this sanitization entirely, leaving the parameter unsanitized before it is echoed into the HTML body in output_grouped().

CVE-2026-75019 Média · 6.4 CWE-79 25/08/2026

Cozy Blocks <= 2.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via cozyHoverEffect Block Attribute

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload survives wp_kses_post on save because it contains no angle brackets — only a double-quote breakout of the cozyHoverEffect.boxShadow.color attribute value — allowing event-handler injection at the render stage.

CVE-2025-9878 Média · 6.4 CWE-79 25/08/2026

Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PPWP – Password Protect WordPress | #1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-56704 Média · 6.1 CWE-79 24/08/2026

Adminer before 5.4.3 Cross-Site Scripting via MySQL Version String

Adminer before 5.4.3 inserts unsanitized database server version strings into script tags with valid CSP nonces without proper validation. Attackers controlling a rogue MySQL server can return crafted version strings that break out of the JavaScript context and execute arbitrary code, bypassing Content Security Policy protections.

CVE-2026-78282 Alta · 7.1 CWE-79 24/08/2026

WordPress Stripe Payments plugin <= 2.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Stripe Payments <= 2.1.2 versions.

CVE-2026-78264 Alta · 7.1 CWE-79 24/08/2026

WordPress Toolset Blocks plugin <= 1.6.26 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Toolset Blocks <= 1.6.26 versions.

CVE-2026-78263 Alta · 7.1 CWE-79 24/08/2026

WordPress Event Tickets plugin <= 5.29.2.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.2.1 versions.

CVE-2026-32556 Alta · 7.1 CWE-79 24/08/2026

WordPress Boost plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Boost <= 2.0.4 versions.

CVE-2022-30983 Média · 6.1 CWE-79 24/08/2026

A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms…

A cross-site scripting (XSS) vulnerability in Support chatbot in Nopaperforms Niaa-Chatbot through 2022-05-17 allows remote attackers to inject arbitrary web script or HTML via the Enter email parameter.

CVE-2026-71503 Média · 6.1 CWE-79 24/08/2026

Dolibarr < 24.0.0 Reflected XSS via Extra Fields Administration Template

Dolibarr before 24.0.0 contains a reflected cross-site scripting vulnerability in the extra fields administration template where the type request parameter is echoed without JavaScript-context encoding into an inline script block and no Content-Security-Policy header is emitted. An unauthenticated attacker can cause an authenticated administrator to open a crafted URL to execute arbitrary JavaScript in that session and create a persistent administrator account.

CVE-2026-30864 Alta · 8.9 CWE-79 24/08/2026

Combodo iTop: Reflected XSS in dashboard revert

Combodo iTop is a web-based IT service management tool. Prior to 3.2.3, iTop is vulnerable to Reflected Cross-Site Scripting (XSS) in the dashboard revert functionality. This issue has been fixed in version 3.2.3.

CVE-2026-76837 Média · 6.4 CWE-79 24/08/2026

Baserow before 2.3.0 Stored Cross-Site Scripting via Rich Text Mention Display Name

Baserow interpolates a user's display name into the rich-text mention markup without HTML encoding. PATCH /api/user/account/ stores the first_name value verbatim, and the mention renderer in web-frontend/modules/core/editor/mention.js builds its element with a template literal that places the name into a data-label attribute and the element body unescaped. A name containing a double quote closes that attribute and the opening tag, so following markup lands in the element content. The result is rendered through v-html by the rich-text field components, so any rich-text cell mentioning the account executes the stored script for every workspace member who views the table, without a click. Any workspace member, at the lowest permission level, can set the name and reach every other member of the workspace, and the payload persists until the name is changed or the mentioning row is removed. Version 2.3.0 escapes the value before interpolation.

CVE-2026-34491 Média · 6.1 CWE-79 24/08/2026

Improper neutralization of input during web page generation ('cross-site scripting')...

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls Metasys 14 and Johnson Controls Metasys 15 allows Cross Site Scripting. This issue affects Metasys 14: before 14.1.5; Metasys 15: before 15.0.1.

CVE-2026-78391 Alta · 8.8 CWE-79 24/08/2026

Stored Cross-Site Scripting via Untrusted Cryptocurrency Address Rendering in RansomLook

RansomLook contains a stored cross-site scripting (XSS) vulnerability in the cryptocurrency wallet detail view. Cryptocurrency addresses and blockchain names originating from external sources, including the public crowd-sourced ransomwhe.re feed, were stored without sufficient validation and later embedded directly into an inline JavaScript onclick handler. Although Jinja HTML autoescaping was applied, it does not provide adequate protection when untrusted data is inserted into a JavaScript string inside an HTML attribute. HTML entities such as ' are decoded by the browser's HTML parser before the resulting attribute is interpreted as JavaScript. Consequently, a specially crafted cryptocurrency address containing quote characters and JavaScript syntax could escape the intended string literal and execute arbitrary JavaScript when a user clicked the affected wallet's CSV export button. Because cryptocurrency information imported from an untrusted upstream could reach the vulnerable rendering path, exploitation may not require an authenticated RansomLook account if an attacker can introduce a malicious wallet record into a consumed external data source. Successful exploitation could allow attacker-controlled JavaScript to execute in the security context of the RansomLook web application, potentially exposing information accessible to the victim or performing actions with the victim's privileges. The patch mitigates the issue by validating cryptocurrency addresses and blockchain identifiers before storage, restricting them to a safe character set, and replacing the inline JavaScript handler with data-* attributes and an external event listener so wallet values are treated strictly as data rather than executable JavaScript.

CVE-2026-78414 Alta · 8.0 CWE-79 24/08/2026

Cross-site scripting in Nx Witness VMS Web Administration allows session token exfiltration via a rogue peer site name

Cross-site scripting in the Web Administration interface of Network Optix Nx Witness VMS before version 6.1.3 on Linux, Windows and MacOS allows an adjacent-network attacker to execute arbitrary JavaScript in the browser of an authenticated administrator and steal the administrator's session token, resulting in Administrator Account Takeover. An attacker who controls an Nx server on the same network segment can set that server's site name to a script payload, which executes when an administrator opens the "Merge with Another Site" dialog and the site selection list is displayed.Solution: Update to Nx Witness VMS version 6.1.3 or later.

CVE-2026-65053 Média · 6.1 CWE-79 24/08/2026

Horde IMP before 7.2.0 Stored Cross-Site Scripting via AppleDouble Viewer Part Name

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

CVE-2026-17033 Média · 6.8 CWE-79 24/08/2026

CVE-2026-17033 CVE Record

An authenticated attacker with Editor access or alert.instances.external:write can submit an external Alertmanager alert containing a controlled generatorURL. The attacker is authorized to create the alert, but not to execute script in another user's Grafana session. Grafana renders alert.generatorURL directly as the Alert Details See source LinkButton href without URL-scheme sanitization or a safe-protocol allowlist. The click interceptor's :// heuristic can be bypassed by placing :// inside a JavaScript comment. When a user with read access clicks See source, the browser executes attacker-controlled JavaScript in the Grafana origin with the clicking user's permissions.

CVE-2026-78290 Média · 6.5 CWE-79 24/08/2026

WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.6 versions.

CVE-2026-66623 Alta · 7.1 CWE-79 24/08/2026

WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Social Media & Share Icons <= 2.9.9 versions.

CVE-2026-66610 Alta · 7.1 CWE-79 24/08/2026

WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Urna <= 2.6.2 versions.

CVE-2026-66599 Alta · 7.1 CWE-79 24/08/2026

WordPress WPComplete plugin <= 2.9.5.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPComplete <= 2.9.5.6 versions.

CVE-2026-66584 Alta · 7.1 CWE-79 24/08/2026

WordPress 12 Step Meeting List plugin <= 3.19.16 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in 12 Step Meeting List <= 3.19.16 versions.

CVE-2026-32476 Alta · 7.1 CWE-79 24/08/2026

WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Brave Conversion Engine (PRO) <= 0.8.6 versions.

CVE-2026-28166 Alta · 7.1 CWE-79 24/08/2026

WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Tourmaster <= 5.4.9 versions.