Export limit exceeded: 51985 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,985

Export CSV
CVE-2026-20088

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software Unified Computing System Unified Computing System E-series Software and 1 more
CVE-2026-20087

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an authenticated, remote attacker with administrative privileges to conduct a stored XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software Unified Computing System Unified Computing System E-series Software and 1 more
CVE-2026-20085

Cisco Integrated Management Controller Cross-Site Scripting Vulnerability

A vulnerability in the web-based management interface of Cisco IMC could allow an unauthenticated, remote attacker to conduct a reflected XSS attack against a user of the interface. This vulnerability is due to insufficient validation of user input. An attacker could exploit this vulnerability by persuading a user of an affected interface to click a crafted link. A successful exploit could allow the attacker to execute arbitrary script code in the browser of the targeted user or access sensitive, browser-based information.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Cisco
Products
Enterprise Nfv Infrastructure Software Unified Computing System Unified Computing System E-series Software and 1 more
CVE-2026-9125

The Ultimate Video Player For WordPress <= 4.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link_url' Shortcode Attribute

The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
2winfactor Wordpress
Products
Presto Player Wordpress
CVE-2026-5934

WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wp Media
Products
Wordpress Wp Rocket
CVE-2026-78615

WatchGuard Dimension Reflected DOM-Based XSS in Report Detail Page

A Reflected Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's report detail page allows an attacker to execute arbitrary JavaScript in a authenticated user's browser with a specially crafted URL.

CVSS 4.0 · 4.6 Medium EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Dimension
CVE-2026-78616

Dimension Stored XSS via Trusted CA Certificate Configuration

A Stored Cross-Site Scripting (XSS) vulnerability in WatchGuard Dimension's Trusted CA certificate configuration allows an authenticated administrator to execute arbitrary JavaScript in another authenticated administrator's web browser by saving a carefully crafted certificate.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Watchguard
Products
Dimension
CVE-2026-15798

Smart Slider 3 <= 3.5.1.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'slider' Block Attribute

The Smart Slider 3 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'slider' Block Attribute in all versions up to, and including, 3.5.1.38 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected scripts execute specifically when a user opens the affected post in the WordPress block editor, making Editors and Administrators the primary targets.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Nextendweb Wordpress
Products
Smart Slider 3 Wordpress
CVE-2026-78073

Joomla Extension - j2commerce.com - Reflected XSS attribute in All Video Share 1.0.0-4.5.0

Joomla Extension - mrvinoth.com - Reflected XSS in All Video Share 1.0.0-4.5.0 - Various user supplied inputs lacked escaping, leading to reflected XSS vectors

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Mrvinoth.com
Products
All Video Share Extension For Joomla
CVE-2026-77365

Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Optimole Wordpress
Products
Optimole – Optimize Images | Convert Webp & Avif | Cdn & Lazy Load | Image Optimization Wordpress
CVE-2026-66353

Doggo vulnerable to cross-site scripting via unescaped date field values

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in woylie doggo allows Reflected XSS. Doggo.normalize_value/2 in lib/doggo.ex returned date field values wrapped in {:safe, ...}, the Phoenix.HTML marker meaning "already escaped, emit verbatim", without escaping them, so the value reached the value attribute of the <input> rendered by the field component unchanged. Any application rendering <.field type="date"> over user-controlled params is affected through the ordinary Phoenix form round-trip, where a failed validation re-renders the submitted value. The pattern kept exactly the first ten bytes and discarded shorter values, capping a payload at ten bytes: enough to terminate the attribute and open an element or attach a short event handler, not enough to place attacker-chosen script inline. Only type="date" is affected. This issue affects doggo: from 0.1.0 before 0.14.8.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Woylie
Products
Doggo
CVE-2026-44727

Jupyter Server: Stored XSS in `NbconvertFileHandler` / `NbconvertPostHandler` via missing `sandbox` CSP

Jupyter Server is the backend for Jupyter web applications. Prior to 2.20, the nbconvert HTTP handlers in jupyter_server render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a notebook carrying an HTML payload in a display_data output triggers stored XSS with cookie access, full /api/* authority, and kernel RCE. This vulnerability is fixed in 2.20.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Jupyter
Products
Jupyter Server
CVE-2026-42557

jupyterlab: Command linker attributes in HTML enable one-click command execution from untrusted content

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. Prior to 4.5.7, JupyterLab's HTML sanitizer allowlists data-commandlinker-command and data-commandlinker-args on button elements, while CommandLinker listens for all click events on document.body and executes the named command without checking whether the element came from trusted JupyterLab UI. A notebook with a pre-saved HTML cell output containing a deceptive button can trigger arbitrary JupyterLab commands - including arbitrary code execution - on a single user click, without any code being submitted for execution by the user. This vulnerability is fixed in 4.5.7.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed
Vendors
Jupyter
Products
Jupyterlab Notebook
CVE-2026-82089

Cross‑Site Scripting via Untrusted API Response in Wallabag Android App

The wallabag (aka fr.gaulupeau.apps.InThePoche) application through 2.6.0 for Android allows XSS because /api/entries data is loaded into a WebView.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wallabag
Products
Android-app
CVE-2026-18324

Forminator Forms <= 1.57.0.1 - Unauthenticated Stored Cross-Site Scripting via Rich-Text Textarea Field

The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Rich-Text Textarea Field in all versions up to, and including, 1.57.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted Textarea field has the Rich-Text editor option enabled.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wordpress Wpmudev
Products
Wordpress Forminator Forms – Contact Form, Payment Form & Custom Form Builder
CVE-2026-82090

Untrusted HTML Injection in Pocket Allows XSS with Native Bridge Exploitation

Pocket through 8.33.0.0 allows XSS because "Save to Pocket" injects external HTML into the DOM.  JavaScript code can alter the application state via native bridge methods.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Getpocket
Products
Pocket
CVE-2025-2610

MagnusBilling Stored Cross-Site Scripting in Alarm Module

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling (Alarm Module modules) allows authenticated stored cross-site scripting. This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Magnussolution
Products
Magnusbilling
CVE-2025-2609

MagnusBilling Stored Cross-Site Scripting in Login Logs

Improper neutralization of input during web page generation vulnerability in MagnusSolution MagnusBilling login logging allows unauthenticated users to store HTML content in the viewable log component accessible at /mbilling/index.php/logUsers/read" cross-site scripting This vulnerability is associated with program files protected/components/MagnusLog.Php. This issue affects MagnusBilling: through 7.3.0.

CVSS 3.1 · 8.2 High EPSS 1.2% KEV · Not listed
Vendors
Magnussolution
Products
Magnusbilling