Export limit exceeded: 19997 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Export limit exceeded: 47778 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (47778 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-18084 | 1 Blackberry | 1 Uem | 2026-07-28 | N/A |
| Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Scripting (XSS). This issue affects UEM: 12.23.0 QF8 or earlier. | ||||
| CVE-2026-41580 | 1 Stirling | 1 Stirling Pdf | 2026-07-28 | 6.1 Medium |
| Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.0.0, Stirling-PDF's /get-info-on-pdf endpoint rendered PDF Title and Author metadata fields without proper HTML encoding or sanitization, allowing a crafted PDF to execute attacker-controlled JavaScript in the browser of a user who views the resulting page. This issue is fixed in version 2.0.0. | ||||
| CVE-2026-48060 | 1 Litestar-org | 1 Litestar | 2026-07-28 | 8.1 High |
| Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie being excluded from automatic escaping by the template engine when configured inline with documentation recommendations. This issue has been patched in version 2.20.0. | ||||
| CVE-2026-65533 | 2 Wbolt, Wordpress | 2 Smart Seo Tool, Wordpress | 2026-07-28 | 6.5 Medium |
| Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions. | ||||
| CVE-2026-65697 | 1 Fathom | 1 Fathom | 2026-07-28 | 6.1 Medium |
| Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry. | ||||
| CVE-2026-15100 | 2 Wordpress, Wpxpo | 2 Wordpress, Postx - Gutenberg Blocks For Post Grid | 2026-07-28 | 6.4 Medium |
| The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post. | ||||
| CVE-2026-14190 | 2 Shaosina, Wordpress | 2 Sina Extension For Elementor, Wordpress | 2026-07-28 | 6.1 Medium |
| The Sina Extension for Elementor WordPress plugin before 3.10.2 does not escape a value reconstructed from request input in one of its unauthenticated AJAX handlers before reflecting it into the HTML response, allowing unauthenticated attackers to execute arbitrary JavaScript in the browser of anyone who triggers a crafted request. | ||||
| CVE-2026-61957 | 2 Miniorange, Wordpress | 2 Otp Verification, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. | ||||
| CVE-2026-65437 | 2 Cleantalk, Wordpress | 2 Spam Protection, Antispam, Firewall, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. | ||||
| CVE-2026-14819 | 2 Liquidweb, Wordpress | 2 Event Tickets And Registration, Wordpress | 2026-07-28 | 3.5 Low |
| The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on multisite installations. | ||||
| CVE-2026-15730 | 2 Rubengc, Wordpress | 2 Gamipress – Gamification Plugin To Reward Points, Achievements, Badges & Ranks In Wordpress, Wordpress | 2026-07-28 | 6.4 Medium |
| The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wp_kses_post filter applied at post save does not neutralize this payload because only the inert shortcode text is stored in post_content; the dangerous HTML is synthesized at render time by the shortcode handler, entirely bypassing save-time sanitization. | ||||
| CVE-2026-28926 | 1 Apple | 1 Macos | 2026-07-28 | 7 High |
| A race condition was addressed with improved state handling. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. An app may be able to elevate privileges. | ||||
| CVE-2026-15016 | 2 Strangerstudios, Wordpress | 2 Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions, Wordpress | 2026-07-28 | 6.4 Medium |
| The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via [pmpro_member_profile_edit] Shortcode in all versions up to, and including, 3.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-15393 | 2 Cozythemes, Wordpress | 2 Cozy Blocks – Page Builder For Gutenberg Editor & Fse With 600+ Patterns, 58 Blocks & Templates, Wordpress | 2026-07-28 | 6.4 Medium |
| The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. | ||||
| CVE-2026-65911 | 1 Cure53 | 1 Dompurify | 2026-07-28 | 6.1 Medium |
| In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version. | ||||
| CVE-2026-7775 | 1 Ibm | 2 Sterling B2b Integrator, Sterling File Gateway | 2026-07-28 | 5.5 Medium |
| IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. | ||||
| CVE-2026-65441 | 2 Nexcess, Wordpress | 2 Givewp, Wordpress | 2026-07-28 | 7.1 High |
| Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. | ||||
| CVE-2026-17528 | 2026-07-28 | 6.1 Medium | ||
| Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or interact with the affected page. | ||||
| CVE-2021-32087 | 1 Quest | 1 Kace Systems Deployment Appliance | 2026-07-28 | N/A |
| An issue was discovered in Quest KACE Systems Deployment Appliance (SMA) 11.0.273. It installs with default user credentials. The kbftp account has a password of getbxf, which is publicly known and documented. This allows remote attackers to trivially gain privileged access to the FTP service interface, which contains MySQL backups. Sensitive information is stored in the database, such as privileged credentials for other systems. | ||||
| CVE-2026-66030 | 1 Creativeitem | 1 Ekushey Project Manager Crm | 2026-07-28 | 5.4 Medium |
| Ekushey Project Manager CRM through version 5.0 ccontains a stored cross-site scripting vulnerability that allows authenticated client users to inject arbitrary HTML and JavaScript by entering malicious payloads into the Ticket Title field on the Create New Ticket page. Attackers can craft and store malicious scripts that execute in the browser sessions of Staff or Administrator users who view the Client Support page where ticket titles are rendered unsanitized. | ||||