CVE Database

CVE-2026-94461 Medium · 6.5 CWE-79 Sep 23, 2026

WordPress Ditty plugin <= 3.1.69 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ditty <= 3.1.69 versions.

CVE-2026-94391 Medium · 6.5 CWE-79 Sep 23, 2026

WordPress Ultimate FAQ plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Ultimate FAQ <= 2.4.14 versions.

CVE-2026-94179 High · 7.1 CWE-79 Sep 23, 2026

WordPress Razorpay Payment Button plugin <= 2.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button <= 2.4.9 versions.

CVE-2026-94176 High · 7.1 CWE-79 Sep 23, 2026

WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.1 versions.

CVE-2026-94168 Medium · 6.5 CWE-79 Sep 23, 2026

WordPress Premium Addons for Elementor plugin <= 4.11.105 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Premium Addons for Elementor <= 4.11.105 versions.

CVE-2026-94118 Medium · 6.5 CWE-79 Sep 23, 2026

WordPress Premium Blocks – Gutenberg Blocks for WordPress plugin <= 2.3.17 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Premium Blocks – Gutenberg Blocks for WordPress <= 2.3.17 versions.

CVE-2026-93774 High · 7.1 CWE-79 Sep 23, 2026

WordPress WP Photo Album Plus plugin <= 9.3.02.002 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP Photo Album Plus <= 9.3.02.002 versions.

CVE-2026-93772 Medium · 6.5 CWE-79 Sep 23, 2026

WordPress wpForo Forum plugin <= 3.1.5 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in wpForo Forum <= 3.1.5 versions.

CVE-2026-93622 High · 7.1 CWE-79 Sep 23, 2026

WordPress WPS Limit Login plugin <= 1.5.9.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WPS Limit Login <= 1.5.9.3 versions.

CVE-2026-93618 Medium · 6.5 CWE-79 Sep 23, 2026

WordPress JetTricks plugin <= 2.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock. Jetimpex Inc. JetTricks allows Stored XSS. This issue affects JetTricks: from n/a through 2.0.1.

CVE-2026-93526 High · 7.1 CWE-79 Sep 23, 2026

WordPress Event Tickets plugin <= 5.29.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Event Tickets <= 5.29.4 versions.

CVE-2026-92730 High · 7.4 CWE-79 Sep 23, 2026

LimeSurvey Community Edition 7.0.14 - Reflected XSS in participant CSV import result via invalid attribute column name

LimeSurvey Community Edition 7.0.14 contains a reflected cross-site scripting vulnerability on the administrative survey-participant CSV import result page.

CVE-2026-77394 High · 7.6 CWE-79 Sep 23, 2026

OpenC3 COSMOS: Stored, cross-user XSS via Telemetry screen BUTTON widget

OpenC3 COSMOS provides the functionality needed to send commands to and receive data from one or more embedded systems. From 5.0.6 until 7.3.0, an authenticated actor with system_set permission can store a shared screen through POST /openc3-api/screen whose BUTTON widget action is evaluated by openc3-cosmos-init/plugins/packages/openc3-vue-common/src/widgets/ButtonWidget.vue in another operator's browser session when the button is activated. The stored script runs in the COSMOS origin and can read localStorage.openc3Token, allowing theft of the victim's bearer token, account takeover, and actions with the victim's privileges. The permissive content security policy contributes to execution but is not the primary root cause. This issue is fixed in version 7.3.0.

CVE-2026-91775 High · 7.4 CWE-79 Sep 23, 2026

LimeSurvey Community Edition 7.0.14 - Reflected XSS through unescaped LSS survey-import warnings

LimeSurvey Community Edition 7.0.14 fails to safely encode attacker-controlled content from a crafted .lss survey file when displaying import warnings, resulting in XSS in the administrative interface.

CVE-2026-93769 High · 7.2 CWE-79 Sep 23, 2026

HumHub 1.18.5 - Stored XSS in Profile Field Category title via HForm#renderForm leading to System Administrator account takeover

HumHub 1.18.5 is affected by a stored cross-site scripting (XSS) vulnerability that allows any user holding the delegated, non-system-administrator Manage Users permission (admin_manage_users) to inject persistent HTML/JavaScript into a Profile Field Category title.

CVE-2026-18872 Critical · 9.3 CWE-79 Sep 23, 2026

IBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities

IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor can inject script into stored network acknowledgement data that executes in authenticated operator browsers, enabling session hijacking and unauthorized operator-level payment actions.

CVE-2026-63002 Medium · 4.8 CWE-79 Sep 23, 2026

REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVE-2026-63001 Medium · 4.8 CWE-79 Sep 23, 2026

REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVE-2026-59167 Critical · 10.0 CWE-79 Sep 23, 2026

SunEditor: Critical XSS vulnerability - sanitizer bypass

SunEditor is a lightweight and powerful WYSIWYG editor in vanilla JavaScript with no dependencies. Prior to 2.47.11, the sanitizer in src/lib/core.js does not consistently reject namespaced or custom HTML elements, allowing event-handler attributes to remain on crafted elements. When an application renders attacker-controlled editor content and a user interacts with the element, the retained handler can execute script in the application's browser origin, enabling stored cross-site scripting, data exposure, or unauthorized browser-context actions. This issue is fixed in version 2.47.11.

CVE-2026-5696 Medium · 5.9 CWE-79 Sep 23, 2026

Multiple vulnerabilities in the Microweber administration panel

Reflected Cross-Site Scripting (XSS) in Microweber. The vulnerability lies in the ‘group’ parameter of the ‘/admin/settings’ endpoint in the administration panel. A successful exploit allows an attacker to trick an authenticated user into executing malicious JavaScript code in their browser. This enables the attacker to perform actions without the victim’s consent, steal confidential information or hijack the user’s session.

CVE-2026-95626 High · 8.3 CWE-79 Sep 23, 2026

Tauri framework v2 CSP nonce protection bypass via data and blob URI schemes allows an XSS to RCE chains

Tauri's Content Security Policy hardening, which injects a random nonce to restrict script execution, provides zero protection when an application includes data: or blob: in its script-src directive. Per the CSP Level 3 specification, these scheme sources remain active even when a nonce is present, allowing arbitrary script execution without knowing the nonce.

CVE-2026-91999 Medium · 6.1 CWE-79 Sep 23, 2026

Apache Sling XSS: Improper escaping in the XSS Webconsole plugin

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVE-2026-91928 Medium · 6.1 CWE-79 Sep 23, 2026

Apache Sling XSS: Sanitizer bypass, uncontrolled resource consumption and failure pf protection mechanisms

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVE-2026-91852 Medium · 6.1 CWE-79 Sep 23, 2026

Apache Sling XSS: CWE-79 multiple raw-string break-outs and ReDOS in XSSImpl

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling XSS. This issue affects Apache Sling XSS: before 2.4.12. Users are recommended to upgrade to version 2.4.12, which fixes the issue.

CVE-2026-73192 Medium · 6.1 CWE-79 Sep 23, 2026

Apache Sling XSS: XSS possible through XSSAPI.getValidHref()

An improper neutralization of input during web page generation ('Cross-site Scripting') [CWE-79] vulnerability when using the XSSAPI.getValidHref() in Apache Sling XSS version 2.4.10 and prior may allow an attacker to perform a reflected cross-site scripting (XSS) attack in every feature using this method. In order to successfully attack an application, the attacker needs to be able to submit a value which is not correctly sanitized by that library. Upgrade to Apache Sling XSS >= 2.4.12