CVE-2026-21269

ColdFusion | Cross-site Scripting (Stored XSS) (CWE-79)

ColdFusion is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Adobe

Products

Coldfusion Coldfusion 2023 Coldfusion 2025

CVE-2026-86188

AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-18164

Flow Neuroscience FL-100 Use of Hard-coded Credentials

An undocumented hard-coded credential, shared by all device units, is authorized to bypass authentication. This allows an attacker within Bluetooth range to arbitrarily manipulate brain stimulation parameters and state.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Flow Neuroscience Halo Neuroscience

Products

Fl-100 Fl-100

CVE-2026-86673

ningzichun Student Management System Database Connection database.php mysqli_connect hard-coded credentials

A vulnerability was determined in ningzichun Student Management System up to 98760f5711cf6dc8b4adca53a9e207ca49b02ebf. Affected by this issue is the function mysqli_connect of the file config/database.php of the component Database Connection. This manipulation causes hard-coded credentials. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. This product uses a rolling release model to deliver continuous updates. As a result, specific version information for affected or updated releases is not available. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ningzichun

Products

Student Management System

CVE-2026-85229

Apache SkyWalking: CWE-79 stored XSS in Booster UI dashboard widgets (incomplete fix of CVE-2025-54057)

** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache SkyWalking Booster UI. This issue affects Apache SkyWalking UI : from 10.2.0 through 10.4.0. Users are recommended to upgrade to Horizon UI 1.0.0, which fixes the issue.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Skywalking

CVE-2026-82123

WordPress Loops & Logic - Reflected XSS

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Tangible Loops & Logic.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tangible Wordpress

Products

Loops & Logic Wordpress

CVE-2026-74998

Unvalidated CSS Proxy Response Causing XSS and Information Disclosure in Roundcube Webmail

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Roundcube

Products

Webmail

CVE-2026-86244

FastAdmin User Controller User.php login cross site scripting

A security vulnerability has been detected in FastAdmin up to 1.2.0.20210401_beta. Affected is the function register/login of the file application/index/controller/User.php of the component User Controller. Such manipulation of the argument url leads to cross site scripting. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. Upgrading to version 1.2.1.20210731_beta is able to address this issue. The name of the patch is b3d32e2bf3637488cfe2fc58a27a9d2475b2b51b. It is recommended to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Fastadmin

Products

Fastadmin

CVE-2026-86738

Snipe-IT before 8.7.0 CSS Injection via Custom CSS

Snipe-IT versions before 8.7.0 contain a CSS injection vulnerability in the Custom CSS field due to incomplete sanitization that reverses HTML encoding on greater-than and double-quote characters. Superusers can plant malicious CSS payloads using @import and url() references to exfiltrate CSRF tokens from other superusers via attribute-selector rules, enabling account takeover.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Grokability Snipeitapp

Products

Snipe-it Snipe-it

CVE-2026-85599

Grav Shortcode Core before 6.2.5 Stored XSS via unescaped parameters

Grav Shortcode Core before 6.2.5 contains stored cross-site scripting vulnerabilities in the [lorem] tag parameter and [details] summary parameter that are written to rendered pages without escaping. Attackers with page-edit access can inject arbitrary HTML and JavaScript that executes in the browsers of all page visitors, including administrators.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Getgrav

Products

Grav

CVE-2026-19769

Ninja Forms <= 3.15.1 - Unauthenticated Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Ninja Forms File Uploads add-on to be active, as the attack routes the unwhitelisted child entry through the File Uploads handler to write an attacker-supplied HTML file containing arbitrary JavaScript into any web-server-writable directory, including the site root, where it is served from the site's own origin.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Kstover Wordpress

Products

Ninja Forms – The Contact Form Builder That Grows With You Wordpress

CVE-2026-16649

Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit survives save-time sanitization because wp_kses_post allows the required HTML tags and attributes, and the client-side tooltip script re-parses the browser-decoded aria-label value as innerHTML while only stripping script elements, leaving onerror and other event-handler attributes fully intact and executable.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Gravityforms Wordpress

Products

Gravity Forms Wordpress

CVE-2026-15984

QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce guarding the unauthenticated booked_add_appt AJAX action is publicly embedded on any page rendering the booking calendar shortcode, making it trivially obtainable by unauthenticated attackers without any prior account or privilege.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Themovation Wordpress

Products

Quickcal Wordpress

CVE-2026-86644

star7th showdoc API Page Save Endpoint editormd.js cross site scripting

A vulnerability was determined in star7th showdoc up to 3.9.1. This vulnerability affects unknown code of the file web_src/public/editor.md/editormd.js of the component API Page Save Endpoint. Executing a manipulation can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 3.9.2 is able to resolve this issue. This patch is called a8ea1520850b4242f395247f72e87e597506cef0. Upgrading the affected component is recommended. The vendor confirms: "The fix [...] sets Mermaid `securityLevel` to `strict`, disables `htmlLabels`, and sanitizes rendered SVG with DOMPurify."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc Star7th

Products

Showdoc Showdoc

CVE-2026-86226

Projectwolds Online Attendance System profile.php cross site scripting

A security flaw has been discovered in Projectwolds Online Attendance System 1.0. Affected by this issue is some unknown functionality of the file profile.php. The manipulation of the argument email results in cross site scripting. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Projectwolds

Products

Online Attendance System

CVE-2026-86301

code-projects Hospital Information System Patient Management editPatient.php cross site scripting

A vulnerability has been found in code-projects Hospital Information System 1.0. Affected is an unknown function of the file /HIS/src/patients/editPatient.php of the component Patient Management. Such manipulation of the argument ID leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Hospital Information System

CVE-2026-86278

SourceCodester Syllabus-Aligned Learning Management & Examination System manage_subjects.php cross site scripting

A vulnerability was found in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. The affected element is an unknown function of the file manage_subjects.php. The manipulation of the argument msg/title/content results in cross site scripting. The attack may be performed from remote. The exploit has been made public and could be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Syllabus-aligned Learning Management Examination System

CVE-2026-86264

sfturing ssm_pro Order Endpoint OrderController.java cross site scripting

A flaw has been found in sfturing ssm_pro up to 627f426331da8086ce8fff2017d65b1ddef384f8. Affected is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/OrderController.java of the component Order Endpoint. This manipulation of the argument hospitalName/officesName/doctorName causes cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sfturing

Products

Ssm Pro

CVE-2026-86238

projectworlds Online Examination System Feedback Form feedback.php cross site scripting

A vulnerability was determined in projectworlds Online Examination System 1.0. The affected element is an unknown function of the file feedback.php of the component Feedback Form. Executing a manipulation of the argument Name/Subject can lead to cross site scripting. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Projectworlds

Products

Online Examination System

CVE-2026-77830

Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is deliverable via unauthenticated comment submission and executes exclusively for non-logged-in visitors; if comment moderation is enabled, an approving moderator must first publish the comment before the script reaches other users.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Cleantalk Wordpress

Products

Spam Protection, Honeypot, Anti-spam By Cleantalk Wordpress