Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,971

Export CSV
CVE-2026-12900

Spectra Gutenberg Blocks <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via uagb/image Block

The Spectra Gutenberg Blocks – Website Builder for the Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `uagb/image` block in all versions up to, and including, 2.19.28 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress
Products
Spectra Legacy – Gutenberg Blocks Wordpress
CVE-2023-37508

HCL DevOps Plan is susceptible to a Cross-Site Scripting (XSS) vulnerability

HCL DevOps Plan is potentially susceptible to Cross-Site Scripting (XSS) which could allow an attacker to exploit this vulnerability if certain browser weaknesses are present.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Hclsoftware Hcltech
Products
Devops Plan Devops Plan
CVE-2026-55081

DHIS2 Reflected XSS in OpenAPI HTML scope parameter

DHIS2 is a flexible information system for data capture, management, validation, analytics and visualization. The DHIS2 OpenAPI HTML endpoint reflected values from the `scope` query parameter into the generated HTML document without sufficient sanitization. A crafted `scope` value could be rendered as active HTML or JavaScript in the OpenAPI documentation page. An attacker able to get a user to open a crafted OpenAPI HTML URL could execute JavaScript in that user's browser in the DHIS2 origin. Affected versions: DHIS2 2.42 and 2.43 before the 2026-06-09 security patch releases, and the development branch for DHIS2 2.44 before the fix was merged. Patched in 2.42.5.1, 2.43.0.1, the 2.42 and 2.43 line branches, and the 2.44 development branch.

CVSS 4.0 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Dhis2
Products
Dhis2-core
CVE-2026-63264

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3

Joomla Extension - joomshopping.com - Reflective XSS in JoomShopping < 5.9.3 - The Joomla extension JoomShopping is vulnerable to an reflected XSS vulnerability in the product frontend controller.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Joomshopping.com
Products
Joomshopping Extension For Joomla
CVE-2026-8152

Unblu Spark Open Redirect leading to DOM-Based XSS

Unblu Spark contains an open redirect vulnerability that can be escalated to a DOM-based cross-site scripting (XSS) attack. When Unblu Spark is deployed with com.unblu.identifier.siteEmbeddedSetup=true, it runs in the same origin as the host application. Any JavaScript injected through this vulnerability therefore executes with full access to the host application's cookies, DOM, and same-origin APIs — an attacker can reach all resources of the host application, not just Unblu's. This expanded blast radius is the reason on-premises deployments using this configuration are rated CRITICAL.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed
Vendors
Unblu
Products
Spark
CVE-2026-64828

Froiden TableTrack 1.3.10 Stored XSS via Order Notes Field

Froiden TableTrack through 1.3.10 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inject arbitrary HTML and JavaScript through the order notes field without sanitization. Attackers can craft malicious payloads in customer order placement that execute in the admin's browser session when viewing order details, enabling session token theft or unauthorized administrative actions.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Froiden
Products
Tabletrack
CVE-2026-9635

WP Shortcode by MyThemeShop <= 1.4.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute

The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter of the [tab] shortcode in versions up to, and including, 1.4.17. This is due to insufficient input sanitization and output escaping in the mts_tabs() function, which outputs the title shortcode attribute directly into the HTML output between anchor tags without applying any escaping functions. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mythemeshop Wordpress
Products
Wp Shortcode By Mythemeshop Wordpress
CVE-2026-15404

Bulk Page Generator <= 2.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Title

The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in versions up to, and including, 2.5.7. This is due to insufficient input sanitization and output escaping in the lpagery_add_filter_text_template_post() function, which is hooked to admin_footer and echoes the raw post_title of the post referenced by the ?lpagery_template query parameter directly inside a JavaScript single-quoted string literal, without esc_js(), esc_html(), or any other encoding. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a higher-privileged user (such as an administrator) accesses an admin page with the ?lpagery_template=<post_id> parameter pointing at the attacker's post.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Niklaslindemann Wordpress
Products
Bulk Page Generator – Lpagery Wordpress
CVE-2026-65756

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension

Joomla Extension - regularlabs.com - XSS vector in Keyboard Shortcuts extension - Shortcut configuration accepted arbitrary inline JavaScript.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Regularlabs.com
Products
Keyboard Shortcuts Extension For Joomla
CVE-2026-15394

Header Footer Script Adder <= 2.1 - Authenticated (Author+) Stored Cross-Site Scripting via 'asm_code' Snippet Meta

The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'asm_code' Snippet Meta in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Mahethekiller Wordpress
Products
Header Footer Script Adder Wordpress
CVE-2025-68081

WordPress WP-Polls plugin <= 2.77.3 - Cross Site Scripting (XSS) vulnerability

Administrator Cross Site Scripting (XSS) in WP-Polls <= 2.77.3 versions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Lester Chan Wordpress
Products
Wp-polls Wordpress
CVE-2026-57397

WordPress Coaching theme <= 3.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Coaching <= 3.9.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Thimpress. Wordpress
Products
Coaching Wordpress
CVE-2026-57699

WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting (XSS) in Slider Pro <= 4.8.13 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Bqworks Wordpress
Products
Slider Pro Wordpress