CVE-2026-126369

Vvveb through 1.0.8.6 Stored XSS via sanitizeHTML() Blacklist Bypass

Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor users to inject script by bypassing the regex blacklist in sanitizeHTML(). Attackers can save post or product content with unclosed event-handler tags or javascript: entities to execute script for anonymous visitors and admins, enabling session or CSRF-token theft.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Vvveb

Products

Vvveb

CVE-2026-118587

PowerPress Podcasting plugin by Blubrry <= 11.18.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' and 'height' Shortcode Attributes

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 11.18.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the site's configured video player is set to html5video, or when the media URL uses a .webm or .ogv extension, as these conditions are required to route the shortcode attributes through the vulnerable powerpressplayer_build_html5video() builder. Successful exploitation additionally requires an action by an editor — the attacker cannot trigger the vulnerability on their own.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126029

WPZOOM Addons for Elementor <= 1.4.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regions[i][link][url]' and 'pins[i][link][url]' Parameters

The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'actions[save_builder][data][elements][...][settings][regions][i][link][url] / [pins][i][link][url]' parameter in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120573

WPeMatico RSS Feed Fetcher <= 2.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_category' Parameter

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_category' parameter in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is persisted in post meta as campaign_data, bypassing wp_kses sanitization, and executes in the browser session of any user with edit_posts — including Administrators — who opens the WPeMatico campaigns list screen.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120658

Download Manager <= 7.6.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'file[additional_previews][]' Parameter

The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'file[additional_previews][]' parameter in all versions up to, and including, 7.6.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The wpdm_sanitize_array() function strips HTML tags via wp_kses but leaves bare single quotes intact and calls stripslashes_deep() which defeats WordPress magic quotes protection, allowing a single-quote-based attribute breakout payload to be stored verbatim and later rendered without escaping.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125948

Recipe Card Blocks Lite <= 3.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute

The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text' parameter in all versions up to, and including, 3.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Because wp_kses_post() preserves block-delimiter HTML comments verbatim on save, a Contributor can embed event-handler payloads inside the block's steps[].text attribute in a draft or pending post without the unfiltered_html capability, and the payload executes for any visitor — including privileged editors and administrators who preview or publish the post — as well as through the public print endpoint.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125409

Passster <= 4.3.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'metavalue' Parameter

The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'metavalue (metakeyinput=passster_id | passster_headline)' parameter in all versions up to, and including, 4.3.21 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. A Contributor can break out of the shortcode attribute context by embedding a ] character in the passster_id or passster_headline meta value to prematurely close the opening shortcode tag, then append a [/passster] closing tag so that the trailing HTML payload is emitted verbatim by do_shortcode() — bypassing the per-attribute escaping present inside render_shortcode() — and the script will also execute in an editor's or administrator's browser when they preview the Contributor's pending post, since filter_the_content() has no edit-permission capability gate.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126451

OpenEMR before 8.5.0 Stored XSS via Document Template Rendering

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript in staff sessions by injecting javascript: URLs into document template_data. Attackers can submit an encounterForm value rendered unsanitized into an iframe src by DocumentTemplateRender, letting the script read PHI and CSRF tokens and call staff or admin endpoints.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-120688

EZ SQL Reports Shortcode Widget and DB Backup <= 5.25.25 - Unauthenticated Stored Cross-Site Scripting via Comment User-Agent Header

The EZ SQL Reports Shortcode Widget and DB Backup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_USER_AGENT (demonstrated); more generally, any attacker-controllable DB column the saved report selects' parameter in all versions up to, and including, 5.25.25 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires an administrator to have saved a SQL report that selects an attacker-controllable database column, such as wp_comments.comment_agent, which WordPress stores verbatim from unauthenticated visitors even when comments are pending moderation.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120547

CF7 Apps <= 3.8.0 - Authenticated (Editor+) Stored Cross-Site Scripting via [honeypot] Form-Tag Placeholder Value

The CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpcf7-form (CF7 form body; the [honeypot ...] tag value)' parameter in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only a meaningful privilege escalation on multisite installations or those with DISALLOW_UNFILTERED_HTML enabled, as Editor-level users on default single-site installs already possess the unfiltered_html capability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126456

OpenEMR before 8.5.0 Stored XSS via Fee Sheet notecodes field

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is escaped with the wrong context. Attackers with clinician access can inject a payload that breaks out of the single-quoted value attribute and executes in higher-privileged users' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126462

OpenEMR before 8.5.0 Stored XSS via Eye Exam Next Visit Orders

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Eye Exam edit permission to inject scripts via the Next Visit Orders PLAN[] field. Attackers can store a payload closing the textarea in view.php, executing JavaScript when another user opens the Eye Exam editor to steal session identifiers or clinical data.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126474

OpenEMR before 8.5.0 Reflected XSS via ACL Module module_id Parameter

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the ACL module that allows attackers to execute JavaScript in authenticated sessions via the module_id parameter. Attackers can deliver crafted acl/index or acl/acl links that inject unencoded input into inline script blocks, stealing non-HttpOnly session cookies and modifying ACL configuration.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126475

OpenEMR before 8.5.0 Reflected XSS via searchEleNo in Auto-Suggest Endpoint

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to execute JavaScript by injecting payloads into the searchEleNo POST parameter of the application/index/search endpoint. Attackers can break out of unencoded HTML attributes in auto-suggest.phtml to inject event handlers that fire on DOM insertion, stealing non-HttpOnly session cookies and patient data.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126476

OpenEMR before 8.5.0 Reflected XSS via auto-suggest searchMode parameter

OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest endpoint, which echoes the searchMode POST parameter unencoded into a single-quoted onClick attribute. Attackers can induce an authenticated user to submit a single-quote payload to application/index/search, executing arbitrary JavaScript in that user's session to steal session cookies or disclose patient data.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126477

OpenEMR before 8.5.0 Stored XSS via Eye Exam Defaults in eye_base.php

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Eye Exam (eye_mag) module that allows administrators to inject JavaScript through unencoded Eye_defaults list option titles. Attackers can store a crafted title via edit_list.php that breaks out of a jQuery string in eye_base.php, executing script in any authenticated user's session when they click Defaults.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126484

OpenEMR before 8.5.0 Stored XSS via Printed Fee Sheet Appointment Comments

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows authenticated portal patients to inject script by setting unescaped appointment comments (pc_hometext). Attackers can submit HTML payloads via the form_comments field in add_edit_event_user.php that execute when staff open the patient's fee sheet, acting within the staff session.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126493

OpenEMR before 8.5.0 Stored XSS via OnsitePortalActivity tableArgs

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal users to inject JavaScript via the tableArgs field of the onsiteportalactivity API. Attackers can store a payload with spaces that breaks out of an unquoted data-delete-id attribute, executing script when providers click the delete button on the audit review page.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr

Products

Openemr

CVE-2026-126945

Zipline before 4.5.1 Stored XSS via HighlightCode Component

Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders unescaped file content before highlight.js finishes loading. Authenticated attackers can upload text files containing HTML/JavaScript payloads that execute in viewers' browsers, enabling API calls such as account changes on the victim's behalf.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126946

Zipline 4.3.0 before 4.5.0 Stored XSS via SSR Embed Meta Tags

Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated low-privilege users to inject HTML through unescaped embed settings in SSR meta tags. Attackers can set malicious embedTitle, embedDescription, embedSiteName, or embedColor values via PATCH /api/user to execute JavaScript in browsers of visitors opening their file view pages.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—