CVE-2026-128116

SvelteKit: Protocol-relative module import during server-side route resolution allows cross-origin script execution

SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte. Prior to versions 2.70.4 and 3.1.1, apps configured with router.resolution: 'server' could treat a pathname beginning with // as a protocol-relative module specifier during client-side navigation. A socially engineered link could therefore make server-side route resolution import and execute JavaScript from another origin in the user's browser. This issue is fixed in 2.70.4 and 3.1.1.

CVSS 3.1 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125711

Trustindex Review Widget Plugins < 14.3 - Editor+ Stored XSS via Business Name

The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before 14.3, Widgets for Booking.com Reviews WordPress plugin before 14.3, Widgets for Reviews & Recommendations WordPress plugin before 14.3, Widgets for Airbnb Reviews WordPress plugin before 14.3, Widgets for Yelp Reviews WordPress plugin before 14.3, Widgets for Amazon Reviews WordPress plugin before 14.3, Widgets for Thumbtack Reviews WordPress plugin before 14.3, Widgets for Ebay Reviews WordPress plugin before 14.3, Widgets for Zillow Reviews WordPress plugin before 14.3, Widgets for Capterra Reviews WordPress plugin before 14.3, Widgets for Expedia Reviews WordPress plugin before 14.3, Widgets for Opentable Reviews WordPress plugin before 14.3, Widgets for WordPress Reviews WordPress plugin before 14.3, Widgets for Hotels.com Reviews WordPress plugin before 14.3, Review Widgets for Szallas.hu WordPress plugin before 14.3, Widgets for AliExpress Reviews WordPress plugin before 14.3, Widgets for Árukereső Reviews WordPress plugin before 14.3, Widgets for Foursquare Reviews WordPress plugin before 14.3, Widgets for Alibaba Reviews WordPress plugin before 14.3, Widgets for SourceForge Reviews WordPress plugin before 14.3 do not sanitise and escape the connected business details before outputting them in their review widgets, which could allow users with the Editor role and above to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123124

WooCommerce Vindi Pagamento <= 0.8.3 - Unauthenticated Stored XSS via 'code' Parameter

The WooCommerce Vindi Pagamento WordPress plugin through 0.8.3 does not perform any authorisation check when updating an order's shipment tracking code, and does not escape that code when displaying it on the order edit page, allowing unauthenticated attackers to perform Stored Cross-Site Scripting attacks against administrators and shop managers who view an order paid through the gateway. The stored payload is only rendered on sites using WooCommerce's legacy (WordPress posts) order storage.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126424

OpenEMR before 8.5.0 Stored XSS via Billing Code Descriptions

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write permission to inject HTML into SNOMED code descriptions via superbill_custom_full.php. When a clinician selects the malicious code, the Functional and Cognitive Status form or fee-sheet forms assign it to innerHTML, executing JavaScript in the clinician's session to read patient data and perform actions.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-67444

Hubleys: Stored XSS via unrestricted background-image upload, served with an attacker-chosen Content-Type and no CSP protection

Hubleys is a dashboard for self-hosted services. Prior to version 0.5.2, any authenticated (non-admin) Hubleys user can upload a file with an arbitrary extension as their dashboard "background image," and the server will later serve that file back with a Content-Type derived straight from the attacker's chosen extension - so uploading an .html file gets it served as text/html. Because the endpoint that serves it returns a manually-constructed response rather than going through SvelteKit's normal page-rendering pipeline, the app's configured Content-Security-Policy never gets attached to it either, so a script embedded in the upload runs unrestricted. This issue has been patched in version 0.5.2.

CVSS 4.0 · 7.1 High EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126418

OpenEMR before 8.5.0 Stored XSS via Billing Code in sl_eob_invoice.php

OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php, which escapes billing codes for HTML attributes but not for JavaScript strings in an inline onkeyup handler. Clinicians with encounter coding access can save crafted billing codes through diagnosis.php that execute script when a Back Office user enters a payment, exposing patient and financial data or performing actions as that user.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Open-emr Openemr

Products

Openemr Openemr

CVE-2026-63166

Omnispace Agora Project 26.10.0 Stored XSS via CSV Import Preview

Omnispace Agora Project through 26.10.0 contains a stored cross-site scripting vulnerability that allows attackers to inject malicious HTML markup by controlling imported directory data or an uploaded CSV file, as values are rendered into table cell text and value attributes after only Txt::utf8Encode() with no HTML escaping in VuePersonsImportExport.php. Attackers can craft a CSV cell containing an attribute-breakout payload that is rendered verbatim and executed in the browser of the administrator performing the import, leading to arbitrary script execution in the administrative context.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Agora-project

Products

Agora-project

CVE-2026-63171

Omnispace Agora Project < 26.10.0 Stored XSS via Category Description

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63169

Omnispace Agora Project < 26.10.0 Stored XSS via Messenger Iframe

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-63168

Omnispace Agora Project < 26.10.0 Stored XSS via Nested POST Array Bypass

Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Agora-project Omnispace

Products

Agora-project Agora Project

CVE-2026-129140

paicoding 1.0.0 through 1.0.3 Stored XSS via SVG Image Upload

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability in image upload because ImageServiceImpl.validateStaticImg accepts SVG files, which are then served from the site origin when local storage is used. Authenticated attackers can upload script-bearing SVG images that execute when victims view them, stealing the non-HttpOnly f-session cookie to hijack accounts.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

Itwanger

Products

Paicoding

CVE-2026-129141

paicoding 1.0.0 through 1.0.3 Stored XSS via JSON-LD Profile Description

paicoding 1.0.0 through 1.0.3 contains a stored cross-site scripting vulnerability because SeoInjectService embeds user profile text without escaping in an inline JSON-LD script element. Authenticated attackers can add a closing script tag followed by HTML to their profile, executing scripts for visitors of their profile page and stealing the non-HttpOnly f-session cookie.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

Itwanger

Products

Paicoding

CVE-2026-129142

paicoding commit 766c48b through 903adce Stored XSS via Payment Notifications

paicoding commit 766c48b through commit 903adce contains a stored cross-site scripting vulnerability in payment notifications, where NotifyMsgListener inserts the payer's display name unescaped and notify-system-item.html renders it via th:utext. Authenticated attackers can set a malicious display name and start a pending payment on a paid article, executing script in the author's browser when the author views notifications.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129154

SurveyKing 1.13.0 through 1.13.2 Stored XSS via Response Survey Snapshot

SurveyKing 1.13.0 through 1.13.2 contains a stored cross-site scripting vulnerability because the server accepts a respondent-supplied survey snapshot and the frontend renders its titles via innerHTML. Anonymous respondents can submit a forged snapshot embedding event handlers such as img onerror that execute in an administrator's browser session when the response is viewed.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

Surveyking

Products

Surveyking

CVE-2026-129155

DjangoBlog 2.0.0.0 through 2.1.0.0 Stored XSS via Comment Sanitizer class_filter

DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter comment sanitizer passes event-handler attributes on span, div, pre and code tags. Authenticated commenters can post a div with autofocus and onfocus attributes, executing script without interaction for every visitor, including administrators.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129156

DjangoBlog commit d186b1c through 6134ed6 Stored XSS via Comment Reactions

DjangoBlog commit d186b1c through commit 6134ed6 contains a stored cross-site scripting vulnerability that allows authenticated OAuth users to inject script via an unescaped nickname in comment reactions. Attackers can set their OAuth display name to a payload closing the single-quoted data-reactions attribute, then react to a comment to execute script in article visitors' browsers.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129158

ragent 1.1.0 Stored XSS via SVG Knowledge-Base Document Upload

ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by uploading SVG knowledge-base documents served inline as image/svg+xml. Attackers can upload a script-bearing SVG via /knowledge-base/{kb-id}/docs/upload so that victims opening /knowledge-base/docs/{docId}/file execute it in the application origin, enabling account takeover.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129163

Dromara free-fs 2.0.1 through 2.3.1 Stored XSS via File Preview Endpoint

Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users to run script by uploading HTML files served inline as text/html. Attackers can send a victim the /api/file/stream/preview/{fileId} link to execute script in the application origin, calling /apis endpoints to expose the victim's files and account.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129168

PMail 2.9.1 through 2.9.8 Stored XSS via Inline HTML Attachments

PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.

CVSS 4.0 · 5.3 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-129169

PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.

CVSS 4.0 · 5.1 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—