Base de CVEs

CVE-2026-84818 Alta · 7.1 CWE-79 08/09/2026

WordPress Open User Map plugin <= 1.4.50 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Open User Map <= 1.4.50 versions.

CVE-2026-84817 Alta · 7.1 CWE-79 08/09/2026

WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.1 versions.

CVE-2026-81798 Alta · 7.1 CWE-79 08/09/2026

WordPress Easy Appointments plugin <= 4.0.2.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Easy Appointments allows DOM-Based XSS. This issue affects Easy Appointments: from n/a through 4.0.2.1.

CVE-2026-86491 Baixa · 3.5 CWE-79 07/09/2026

Cross-site Scripting (XSS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.18634 stored XSS was possible via project and organization icon uploads

CVE-2026-86484 Média · 4.6 CWE-79 07/09/2026

Cross-site Scripting (XSS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.18634 angularJS template injection in assignee names led to stored XSS

CVE-2026-86483 Média · 5.4 CWE-79 07/09/2026

Cross-site Scripting (XSS) em Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.18634 stored XSS via a custom field on Agile board cards was possible

CVE-2026-86431 Alta · 7.2 CWE-79 07/09/2026

commonmark before 2.9.1 XSS via AttributesExtension form feed bypass

league/commonmark (thephpleague/commonmark) versions >= 2.7.0 and < 2.9.1 contain a cross-site scripting vulnerability in the AttributesExtension. Prefixing an attribute name with a single U+000C form feed byte (e.g. {\x0Conclick="alert(1)"}) bypasses the AttributesHelper::filterAttributes() 'on*' event-handler filter because PHP's trim() does not strip U+000C, causing the attribute to be written verbatim into the output where browsers parse it as a genuine event handler. The same prefix also defeats the allow_unsafe_links check, allowing javascript: URIs through href/src attributes even when allow_unsafe_links is false. Exploitation requires processing untrusted Markdown with the AttributesExtension enabled; the injected script executes when the rendered HTML is viewed. Fixed in 2.9.1.

CVE-2026-6431 Alta · 7.2 CWE-79 07/09/2026

User Profile Builder <= 3.15.7 - Unauthenticated Stored Cross-Site Scripting via 'Biographical Info' Meta Field

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Biographical Info' meta field parameter in all versions up to, and including, 3.15.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-86301 Baixa · 3.5 CWE-79 07/09/2026

code-projects Hospital Information System Patient Management editPatient.php cross site scripting

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVE-2026-78325 Média · 6.9 CWE-79 07/09/2026

XSS in Standard Notes on Android via Malicious Google Keep and Evernote HTML Import

Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.

CVE-2026-2390 Média · 6.4 CWE-79 07/09/2026

Powerkit <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Processing

The Powerkit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load module's image processing in all versions up to, and including, 3.0.4. This is due to the 'content_process_images' function using a flawed regex-based HTML attribute parser. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-86294 Média · 4.3 CWE-79 07/09/2026

SourceCodester Simple Traffic Offense System Settings Update Endpoint save-settings.php cross site scripting

A vulnerability has been found in SourceCodester Simple Traffic Offense System 1.0. Affected by this issue is some unknown functionality of the file save-settings.php of the component Settings Update Endpoint. The manipulation of the argument site_name/site_desc leads to cross site scripting. Remote exploitation of the attack is possible. The exploit has been disclosed to the public and may be used.

CVE-2026-86278 Média · 4.3 CWE-79 07/09/2026

SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage_subjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.

CVE-2026-86264 Média · 4.3 CWE-79 07/09/2026

sfturing ssm_pro Order Endpoint OrderController.java cross site scripting

A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVE-2026-86244 Média · 4.3 CWE-79 06/09/2026

FastAdmin User Controller User.php login cross site scripting

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.

CVE-2026-86238 Média · 4.3 CWE-79 06/09/2026

projectworlds Online Examination System Feedback Form feedback.php cross site scripting

A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVE-2026-86226 Baixa · 3.5 CWE-79 06/09/2026

Projectwolds Online Attendance System profile.php cross site scripting

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVE-2026-86216 Média · 4.3 CWE-79 06/09/2026

code-projects Hotel and Tourism Reservation in PHP details.php cross site scripting

A security vulnerability has been detected in code-projects Hotel and Tourism Reservation in PHP 1.0. This impacts an unknown function of the file /ht/details.php. The manipulation of the argument room leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used.

CVE-2026-86181 Baixa · 3.5 CWE-79 06/09/2026

code-projects Task Management System User Profile Update UpdateUserProfile.php cross site scripting

A vulnerability was found in code-projects Task Management System 1.0. Affected by this issue is some unknown functionality of the file /user/UpdateUserProfile.php of the component User Profile Update. The manipulation of the argument lname results in cross site scripting. The attack can be launched remotely. The exploit has been made public and could be used.

CVE-2026-84219 Alta · 7.5 CWE-79 06/09/2026

Kirki 6.2.1 - 6.2.5 - Unauthenticated Stored XSS via HTML Entity Decoding

The Kirki WordPress plugin before 6.3.0 does not hold back every spelling of the HTML entities it decodes when rendering, allowing unauthenticated users to store JavaScript in a comment which then runs in the session of anyone viewing a page that displays it, including an administrator, and on every page of the site when its header or footer is built to show comments.

CVE-2026-84028 Média · 6.8 CWE-79 06/09/2026

Bold Page Builder < 5.9.9 - Contributor+ Stored XSS via Slider Elements' additional_settings

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page.

CVE-2026-86197 Média · 5.1 CWE-79 05/09/2026

Grav before 2.0.20 Cross-Site Scripting via Assets Sandbox

Grav before 2.0.20 contains a cross-site scripting vulnerability in the Twig sandbox policy that allowlists addJs and addCss methods on Grav\Common\Assets without proper output escaping. Page editors can inject arbitrary script by registering malicious assets or injecting attributes, which are rendered unescaped into document head tags and executed for all visitors including administrators.

CVE-2026-86188 Alta · 7.2 CWE-79 05/09/2026

AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

CVE-2026-76573 Média · 6.4 CWE-79 05/09/2026

Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not_found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVE-2026-85414 Média · 6.4 CWE-79 05/09/2026

Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.