CVE Database

CVE-2026-102126 High · 8.1 CWE-79 Sep 30, 2026

Kiteworks Core Stored Cross-site Scripting (XSS)

A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an administrator holding only a single, narrowly scoped delegated permission to store crafted content that later executes arbitrary JavaScript in the authenticated session of a System Administrator who views the affected page. This could have permitted the lower-privileged administrator to escalate to full administrative control of the tenant, including the creation of a new administrative account.

CVE-2026-102100 High · 8.7 CWE-79 Sep 30, 2026

Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-Site Scripting. A stored cross-site scripting (XSS) weakness in Kiteworks Core could allow an authenticated user to submit content that, when later viewed by another user, executes arbitrary JavaScript in that user's authenticated session. This could be used to perform actions on the victim's behalf and may have permitted account takeover, including of higher-privileged users. Exploitation requires the victim to view the attacker-supplied content.

CVE-2026-102092 High · 8.7 CWE-79 Sep 30, 2026

Kiteworks Core stored XSS

Kiteworks Core before version 9.5.0 is vulnerable to Stored Cross-site Scripting (XSS) that could allow an authenticated user to store crafted content that executes arbitrary JavaScript in another user's authenticated session when they preview shared content. This could potentially lead to session compromise and account takeover.

CVE-2026-97290 High · 7.1 CWE-79 Sep 30, 2026

WordPress Photonic Gallery & Lightbox for Flickr, SmugMug & Others plugin <= 3.36 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Photonic Gallery & Lightbox for Flickr, SmugMug & Others <= 3.36 versions.

CVE-2026-97265 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress JetEngine plugin <= 3.8.15.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetEngine allows Stored XSS. This issue affects JetEngine: from n/a through 3.8.15.3.

CVE-2026-94171 High · 7.1 CWE-79 Sep 30, 2026

WordPress CURCY plugin 2.2.18 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme CURCY woo-multi-currency allows DOM-Based XSS.This issue affects CURCY: 2.2.18.

CVE-2026-102391 High · 7.1 CWE-79 Sep 30, 2026

WordPress JetFormBuilder plugin <= 3.6.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in JetFormBuilder <= 3.6.5.4 versions.

CVE-2026-102376 High · 7.1 CWE-79 Sep 30, 2026

WordPress Branda plugin <= 3.4.32 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Branda <= 3.4.32 versions.

CVE-2026-100510 High · 7.1 CWE-79 Sep 30, 2026

WordPress Post and Page Builder by BoldGrid plugin <= 1.27.14 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Post and Page Builder by BoldGrid <= 1.27.14 versions.

CVE-2026-100275 Medium · 4.8 CWE-79 Sep 30, 2026

Cross-site Scripting (XSS) in Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.19197 stored XSS in the workflow error notification toast was possible

CVE-2026-100263 Medium · 6.1 CWE-79 Sep 30, 2026

Cross-site Scripting (XSS) in Jetbrains Youtrack

In JetBrains YouTrack before 2026.2.18991 stored HTML injection via the User-Agent header was possible

CVE-2026-62084 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress User Submitted Posts plugin <= 20260810 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jeff Starr User Submitted Posts allows Stored XSS. This issue affects User Submitted Posts: from n/a through 20260810.

CVE-2026-103388 Medium · 6.2 CWE-79 Sep 30, 2026

MISP Stored Cross-Site Scripting via JavaScript URL in Galaxy Cluster Source Field

MISP renders the source field of a Galaxy Cluster as a clickable hyperlink whenever the stored value passes PHP's FILTER_VALIDATE_URL validation. Because FILTER_VALIDATE_URL accepts the javascript: URI scheme, a user with galaxy editor privileges on the local instance or on a synced instance could store a javascript: URL as the cluster source. When another user views the affected Galaxy Cluster and clicks the rendered link, the embedded script executes in the victim's browser context, enabling session hijacking, data exfiltration, or actions performed on behalf of the victim. Preconditions: - Attacker must hold galaxy editor privileges (local or via sync). - Victim must view the affected cluster and click the malicious link. Impact: - Stored cross-site scripting (XSS) in the victim's browser. - Potential session theft, credential harvesting, or unauthorized actions within the MISP application. Affected: <2.5.48.

CVE-2026-97298 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress King Addons for Elementor plugin <= 51.1.86 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.86 versions.

CVE-2026-97292 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress YITH WooCommerce Tab Manager plugin <= 2.15.0 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting (XSS) in YITH WooCommerce Tab Manager <= 2.15.0 versions.

CVE-2026-97288 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress OAuth Server plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in OAuth Server <= 4.5.1 versions.

CVE-2026-97289 High · 7.1 CWE-79 Sep 30, 2026

WordPress Quiz And Survey Master plugin <= 11.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows DOM-Based XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.6.

CVE-2026-97301 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress Cool Formkit Lite plugin <= 2.7.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Cool Formkit Lite <= 2.7.8 versions.

CVE-2026-97286 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress Strong Testimonials plugin <= 3.3.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.11.

CVE-2026-97279 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress Polylang plugin <= 3.8.9 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Polylang <= 3.8.9 versions.

CVE-2026-97272 High · 7.1 CWE-79 Sep 30, 2026

WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Premmerce Permalink Manager for WooCommerce <= 2.3.13 versions.

CVE-2026-97271 High · 7.1 CWE-79 Sep 30, 2026

WordPress WPFunnels plugin <= 3.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPFunnels <= 3.13.1 versions.

CVE-2026-97270 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress CMB2 plugin <= 2.13.0 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in CMB2 <= 2.13.0 versions.

CVE-2026-97266 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12.1 versions.

CVE-2026-97262 Medium · 6.5 CWE-79 Sep 30, 2026

WordPress Visual Composer Website Builder plugin <= 45.16.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Visual Composer Website Builder <= 45.16.2 versions.