CVE-2026-75048

Stored XSS via Code‑Block Language Label in JetBrains YouTrack

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Youtrack

CVE-2026-44282

Election question titles allow stored script execution

Decidim is a participatory democracy framework. Prior to 0.32.0, a low-privilege process-scoped administrator or election editor with question-management rights can store HTML or script-bearing content in question.body. The question_title helper returns the translatable question body through html_safe without a sanitization boundary, causing stored script execution when visitors open public election pages or voting booth screens. The persisted script executes in visitors' browsers. The vulnerability is fixed in 0.32.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Decidim

Products

Decidim

CVE-2023-28148

Body Class Injection XSS in Paessler PRTG Network Monitor

A bodyclass XSS issue was discovered in Paessler PRTG before 23.3.86.1520.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Paessler

Products

Prtg Network Monitor

CVE-2026-82796

Cross‑Site Scripting in SolarView Compact Image Management Allows OS Command Execution

SolarView Compact contains a cross-site scripting vulnerability in Image Management. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Contec

Products

Sv-cpt-mc310 Sv-cpt-mc310f

CVE-2026-90567

quequnlong shiyi-blog Search index.vue highlightKeyword cross site scripting

A security vulnerability has been detected in quequnlong shiyi-blog up to 1.2.1. Affected by this issue is the function highlightKeyword of the file blog-web/src/components/Search/index.vue of the component Search. The manipulation of the argument title/summary leads to cross site scripting. The attack can be initiated remotely. The project was informed of the problem early through an issue report.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Quequnlong

Products

Shiyi-blog

CVE-2026-90529

DataEase Symbolic Map symbolic-map.ts buildTooltip cross site scripting

A vulnerability has been found in DataEase up to 2.10.25/2.10.26. Affected by this issue is the function buildTooltip of the file core/core-frontend/src/views/chart/components/js/panel/charts/map/symbolic-map.ts of the component Symbolic Map. Such manipulation of the argument canvasViewInfo[*].customAttr.tooltip.backgroundColor leads to cross site scripting. The attack may be performed from remote. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Dataease

Products

Dataease

CVE-2026-88866

WWBN AVideo LoginControl Stored XSS via User-Agent Header

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-16186

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Websphere Application Server

CVE-2026-13276

Security vulnerabilities have been addressed in IBM Verify Identity Access and IBM Security Verify Access

IBM Verify Identity Access 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access 10.0.0 through 10.0.9.2 Interim Fix 001 and IBM Verify Identity Access Container 11.0.0 through 11.0.3 Interim Fix 001 and IBM Security Verify Access Container 10.0.0 through 10.0.9.2 Interim Fix 001.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Security Verify Access Security Verify Access Container Verify Identity Access and 1 more

CVE-2025-15267

Bold Page Builder <= 5.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via bt_bb_accordion_item Shortcode

The Bold Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's bt_bb_accordion_item shortcode in all versions up to, and including, 5.6.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Bold-themes Wordpress

Products

Bold Page Builder Wordpress

CVE-2026-82795

Cross‑Site Scripting Allows Arbitrary OS Command Execution in SolarView Compact

SolarView Compact contains a cross-site scripting vulnerability in Schedule Settings and Mail Send Setting. If this vulnerability is exploited, an arbitrary OS command may be executed by an attacker who can log in to the product.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Contec

Products

Sv-cpt-mc310 Sv-cpt-mc310f

CVE-2026-90845

PHPGurukul Daily Expense Tracker System sidebar.php cross site scripting

A flaw has been found in PHPGurukul Daily Expense Tracker System 1.1. This issue affects some unknown processing of the file /dets/includes/sidebar.php. Executing a manipulation of the argument FullName can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Daily Expense Tracker System

CVE-2026-90835

michaelliao itranswarp Page Content Rendering Markdown.java Markdown.toHtml cross site scripting

A flaw has been found in michaelliao itranswarp up to 2.19. The impacted element is the function Markdown.toHtml of the file Markdown.java of the component Page Content Rendering. This manipulation causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may be used. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Michaelliao

Products

Itranswarp

CVE-2026-90850

PHPGurukul Hostel Management System manage-students.php cross site scripting

A vulnerability was detected in PHPGurukul Hostel Management System 3.0. Affected by this issue is some unknown functionality of the file /admin/manage-students.php. The manipulation results in cross site scripting. The attack may be launched remotely. The exploit is now public and may be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Phpgurukul

Products

Hostel Management System

CVE-2026-85575

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets <= 4.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shopengine_product_title_header_size' Parameter

The ShopEngine Elementor WooCommerce Builder Addon – All in One WooCommerce Solution with eCommerce Templates & Woo Widgets plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘shopengine_product_title_header_size’ parameter in all versions up to, and including, 4.9.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Roxnor Wordpress

Products

Shopengine Elementor Woocommerce Builder Addon – All In One Woocommerce Solution With Ecommerce Templates & Woo Widgets Wordpress

CVE-2026-90795

itsourcecode Loan Management System navbar.php cross site scripting

A vulnerability was determined in itsourcecode Loan Management System 1.0. The impacted element is an unknown function of the file navbar.php. Executing a manipulation of the argument page can lead to cross site scripting. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Itsourcecode

Products

Loan Management System

CVE-2026-90615

SourceCodester Class and Exam Timetabling System subject1.php cross site scripting

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /subject1.php. Such manipulation of the argument subject leads to cross site scripting. The attack can be executed remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Class And Exam Timetabling System

CVE-2026-44793

OpenAM: Pre-authentication Reflected XSS in SAML2 Cluster Cookie-Hash-Redirect Path via `FSUtils.postToTarget`

Open Access Management (OpenAM) is an access management solution. Prior to 16.1.1, certain federation endpoints in a non-default clustered configuration inconsistently encode user-supplied parameters rendered into HTML in the SAML2 cluster cookie-hash redirect path. An unauthenticated attacker can induce a user to follow a crafted request and execute script in the OpenAM origin. This issue is fixed in version 16.1.1.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Openidentityplatform

Products

Openam

CVE-2026-91922

Steedos Platform through 3.0.15-beta.47 Reflected XSS via page render

Steedos Platform through 3.0.15-beta.47 contains a reflected cross-site scripting vulnerability in the anonymous /api/page/render endpoint that fails to properly escape query parameters in inline script elements. Attackers can craft malicious links with script-terminating sequences in the schemaApi or data parameters to execute arbitrary JavaScript in victim sessions and steal X-Auth-Token credentials.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Steedos

Products

Steedos-platform

CVE-2026-4103

Cross-Site Scripting via HTML Sanitization in WSO2 Publisher and Developer Portals Allows Malicious Script Execution

Insufficient HTML sanitization in the Publisher Portal and Developer Portal allows untrusted user input to be rendered without proper encoding or neutralization. This enables the injection and execution of malicious JavaScript when affected API documents are viewed. Successful exploitation may result in the execution of malicious scripts within the user's browser context when viewing API documentation. Users with permissions to access the API documentation through these portals may be impacted, potentially allowing attackers to perform actions on behalf of the user, depending on their session privileges.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wso2

Products

Api Control Plane Api Manager Wso2 Api Control Plane and 1 more