Base de CVEs

CVE-2026-54717 Média · 5.4 CWE-79 06/08/2026

Silverstripe: XSS in breadcrumbs in page list view

Silverstripe CMS is an open source content management system. Prior to 6.2.1, page breadcrumbs in the CMS are vulnerable to cross-site scripting when viewed using the page list view, because page titles are rendered into the breadcrumb trail without being escaped. This issue is fixed in 6.2.1.

CVE-2026-49391 Média · 5.1 CWE-79 06/08/2026

Frappe: Stored XSS in Column Headers via Data Import

Frappe is a full-stack web application framework. Prior to 16.19.0 and 15.109.0, Data Import does not escape imported column headers before rendering previews and results, allowing an authenticated importer to persist script content that executes when another user views the import interface. This issue is fixed in versions 16.19.0 and 15.109.0.

CVE-2026-48081 Alta · 8.1 CWE-79 06/08/2026

OpenReception vulnerable to stored click-triggered XSS via javascript: tenant links rendered into patient-facing footer

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, a TENANT_ADMIN can store `javascript:` URLs in the tenant `links` configuration (`website`, `imprint`, `privacyStatement`). These values are returned to the patient-facing landing page via `/api/public`, hydrated into the SvelteKit Button component, and rendered as `<a href="javascript:...">` elements without URL-scheme filtering. A patient who clicks any such link executes the attacker's JavaScript inside the patient browser origin, where patient form data is read before client-side encryption is applied. This breaks the project's central trust claim that the server is an untrusted relay and that administrators cannot read patient data. Patient-side encryption happens after form input, so JavaScript executing in the patient origin can read or alter the plaintext before encryption is performed. Version 1.0.2 fixes the issue.

CVE-2026-47185 Média · 5.1 CWE-79 06/08/2026

Frappe Has Broken Access Control in its Workspace Save API

Frappe is a full-stack web application framework. Prior to 16.18.0, the Workspace Save API accepts a controlled workspace identifier from any authenticated user without enforcing workspace ownership, allowing modification of another user's private workspace and persistent script injection. This issue is fixed in version 16.18.0.

CVE-2026-19110 Baixa · 2.4 CWE-79 06/08/2026

DataGear Chart Name HtmlTplDashboardWidgetHtmlRenderer.java HtmlTplDashboardWidgetHtmlRenderer cross site scripting

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2025-6508 Média · 4.3 CWE-79 06/08/2026

User Interface Misrepresentation via Swagger UI Try-out Console in WSO2 API Manager Allows Sensitive Information Exposure or Unintended Requests

The Swagger UI Try-out console within the API Publisher documentation allows an external Swagger API definition URL to be loaded, overriding the existing API definitions within the Publisher portal. By exploiting this vulnerability, malicious actors can deceive users into interacting with these overwritten API definitions. This could lead to the exposure of sensitive information or the initiation of unintended requests to backend services.

CVE-2024-39024 Alta · 8.8 CWE-79 06/08/2026

In Packetfence 13.2.0, the WebGui interface setting allows authenticated remote code execution.

CVE-2026-66711 Alta · 7.1 CWE-79 06/08/2026

WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.5.6 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in WooCommerce Multilingual & Multicurrency <= 5.5.6 versions.

CVE-2026-66707 Alta · 7.1 CWE-79 06/08/2026

WordPress Facebook for WooCommerce plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Facebook for WooCommerce <= 3.7.5 versions.

CVE-2026-66706 Média · 5.9 CWE-79 06/08/2026

WordPress Subscribe to Comments plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in Subscribe to Comments <= 2.3.1 versions.

CVE-2026-66705 Alta · 7.1 CWE-79 06/08/2026

WordPress Facebook for WordPress plugin <= 5.2.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Facebook for WordPress <= 5.2.1 versions.

CVE-2026-66703 Média · 6.5 CWE-79 06/08/2026

WordPress MailOptin plugin <= 1.2.78.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in MailOptin <= 1.2.78.0 versions.

CVE-2026-66702 Alta · 7.1 CWE-79 06/08/2026

WordPress Rank Math SEO plugin <= 1.0.274.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Rank Math SEO <= 1.0.274.1 versions.

CVE-2026-66694 Alta · 7.1 CWE-79 06/08/2026

WordPress Thrive Architect plugin <= 10.9.3.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Thrive Architect <= 10.9.3.1 versions.

CVE-2026-66690 Alta · 7.1 CWE-79 06/08/2026

WordPress GiveWP plugin <= 4.16.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.5 versions.

CVE-2026-66688 Média · 6.5 CWE-79 06/08/2026

WordPress Ultimate Addons for Elementor plugin <= 1.45.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ultimate Addons for Elementor <= 1.45.2 versions.

CVE-2026-66664 Alta · 7.1 CWE-79 06/08/2026

WordPress SEO plugin by Squirrly SEO plugin <= 14.2.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SEO Plugin by Squirrly SEO <= 14.2.0 versions.

CVE-2026-66663 Alta · 7.1 CWE-79 06/08/2026

WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Data Access <= 5.5.79 versions.

CVE-2026-66457 Alta · 7.1 CWE-79 06/08/2026

WordPress Events Manager plugin <= 7.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events Manager events-manager allows Reflected XSS.This issue affects Events Manager: from n/a through 7.4.2.

CVE-2026-66440 Alta · 7.1 CWE-79 06/08/2026

WordPress WPIDE – File Manager & Code Editor plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPIDE – File Manager & Code Editor <= 3.5.7 versions.

CVE-2026-66439 Alta · 7.1 CWE-79 06/08/2026

WordPress Advanced AJAX Product Filters plugin <= 3.2.0.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.

CVE-2026-65565 Alta · 7.1 CWE-79 06/08/2026

WordPress Survey Maker plugin <= 5.2.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Survey Maker <= 5.2.3.3 versions.

CVE-2026-65560 Alta · 7.1 CWE-79 06/08/2026

WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Houzez Property Feed <= 2.5.48 versions.

CVE-2026-65545 Alta · 7.1 CWE-79 06/08/2026

WordPress AI Engine plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in AI Engine <= 3.6.8 versions.

CVE-2026-65544 Alta · 7.1 CWE-79 06/08/2026

WordPress Super Socializer plugin <= 7.14.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Super Socializer <= 7.14.5 versions.