Export limit exceeded: 51989 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.

Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,989

Export CSV
CVE-2026-109208

LearnPress <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting via 'quantity' and 'order_comments' Parameters

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'quantity (REST) / order_comments (checkout)' parameter in all versions up to, and including, 4.4.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. With guest checkout enabled the attack is fully unauthenticated; with guest checkout disabled, any Subscriber-level user can exploit both vectors through their own checkout.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Thimpress Wordpress-extensions
Products
Learnpress Learnpress
CVE-2026-100316

European VAT Compliance Assistant for WooCommerce <= 1.36.10 - Unauthenticated Stored Cross-Site Scripting via CF-IPCountry Header

The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via CF-IPCountry Header in all versions up to, and including, 1.36.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious header value is persisted verbatim into order post-meta during a guest checkout, meaning no account or authentication is required to plant the payload.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-77829

Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Goratech Wordpress-extensions
Products
Cooked Cooked
CVE-2026-74920

Document Gallery <= 5.1.1 - Reflected XSS via data-shortcode Attribute

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visitor, including a logged-in administrator.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Document Gallery
CVE-2026-78001

Post and Page Builder by BoldGrid <= 1.27.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-label' Attribute

The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'data-label' Attribute in all versions up to, and including, 1.27.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Boldgrid Wordpress-extensions
Products
Post And Page Builder By Boldgrid - Visual Drag And Drop Editor Post And Page Builder By Boldgrid
CVE-2026-42702

WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS tutor allows Reflected XSS.This issue affects Tutor LMS: from n/a through 4.1.0.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Themeum Wordpress-extensions
Products
Tutor Lms Tutor Lms
CVE-2026-67165

HCL Connections is vulnerable to cross-site scripting (XSS)

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credentials and comprise user's account then launch other attacks.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Hcltech
Products
Connections
CVE-2026-69194

FileRise: Unsanitized footerHtml in Public Site Config

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.footerHtml value through the unauthenticated public site configuration API without server-side sanitization. The FileRise frontend already sanitizes this value before rendering it into the page, using an allowlist of simple footer tags and safe link handling. The unauthenticated public config API exposed raw admin-provided footer HTML to clients, which is still undesirable and could be unsafe for alternate clients or future render paths. An administrator must first store the malicious footer value. This issue is fixed in version 3.21.0.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Error311
Products
Filerise
CVE-2026-58392

OPNsense: Stored XSS in Services: NTP GPS

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form, applies legacy_html_escape_form_data() to the encoded string, and then uses base64_decode() to decode the value directly into the GPS initialization-command textarea in src/www/services_ntpd_gps.php. Because decoding occurs after escaping, stored HTML remains unescaped at the output sink. A user with page-services-ntp-gps privilege can store a value that closes the textarea, and script executes in the session of any user who later opens the GPS page. The script can read CSRF material and perform authenticated actions, including actions available to an administrator. This issue is fixed in version 26.1.11.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Opnsense
Products
Core
CVE-2026-57568

Lychee: Stored XSS via Markdown javascript: Links in Photo and Album Descriptions (Gallery View)

Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI in an album or photo Markdown description because config/markdown.php enables allow_unsafe_links. app/Http/Resources/Models/Utils/PreformattedPhotoData.php and app/Http/Resources/Models/Utils/PreFormattedAlbumData.php convert the description to HTML, and the gallery components PhotoDetails.vue, Overlay.vue, PhotoThumb.vue, AlbumHero.vue, and AlbumCard.vue render that HTML with v-html. A visitor, including an unauthenticated visitor to a public album, who clicks the rendered link executes attacker-controlled JavaScript in the Lychee origin, which can expose session data or enable authenticated requests in the victim's context. This gallery-view flaw is distinct from CVE-2026-33738, which addressed feed rendering. This issue is fixed in version 7.6.0.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Lycheeorg
Products
Lychee
CVE-2026-58394

OPNsense: Stored XSS in Administration Settings via Certificate Description

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert but omits that array from legacy_html_escape_form_data() before rendering each certificate descr value in the SSL Certificate selector. The certificate description accepts HTML metacharacters, allowing a user with the page-system-certmanager privilege to store markup that executes when another user opens System Settings Administration. This issue is fixed in version 26.1.11.

CVSS 3.1 · 5.2 Medium EPSS < 1% KEV · Not listed
Vendors
Opnsense
Products
Core
CVE-2026-60008

Gitea Jupyter notebook UI redress through CSS class injection

Gitea's Jupyter notebook renderer inserts the notebook's language_info.name metadata into a CSS class attribute while disabling sanitization and rendering directly in the main document without an iframe sandbox. A malicious repository notebook can supply multiple CSS classes that create a viewport-covering overlay and intercept clicks when another user views it. The reported impact is UI redress; script execution was not demonstrated.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Gitea
Products
Gitea
CVE-2026-55184

EspoCRM: Stored XSS in wysiwyg template fields if CSP is disabled

EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store crafted HTML that bypasses moderateSanitizeHtml(). When another user opens the template in edit mode and clientCspDisabled is true, the stored payload executes and can hijack the user's session. This issue is fixed in version 9.3.9.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Espocrm
Products
Espocrm
CVE-2026-18586

Premium Packages <= 7.0.5 - Unauthenticated Stored Cross-Site Scripting via 'order_email'

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Codename065 Wordpress-extensions
Products
Premium Packages – Sell Digital Products Securely Premium Packages
CVE-2026-110252

WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import

The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugin removing WordPress's wp_filter_post_kses filter from content_save_pre immediately before calling wp_insert_post() with RSS feed content, whenever the campaign's last editor had the unfiltered_html capability — a flag the plugin sets automatically for every admin-saved campaign. Imported item content is taken raw from $item->get_content(), only entity-decoded, and stored verbatim in post_content. This makes it possible for unauthenticated attackers, who publish or compromise an RSS feed that an administrator has subscribed a WPeMatico campaign to, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected imported post.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Etruel Wordpress-extensions
Products
Wpematico Rss Feed Fetcher Wpematico Rss Feed Fetcher
CVE-2026-93485

WordPress Core <= 7.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Automattic WordPress wordpress allows DOM-Based XSS.This issue affects WordPress: from n/a through 7.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Automattic
Products
Wordpress
CVE-2026-103524

CVE-2026-103524

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary JavaScript execution when the affected pages are viewed. The vulnerability affects multiple administrative functions including category creation and product creation.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2024-34321

Reflected XSS via PageTitle/Notes in ProPhoenix Law RMS Notes.aspx

ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the PageTitle/Notes parameter in the Notes.aspx endpoint.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—
CVE-2026-103527

CVE-2026-103527

Thelia v2.6.0's Smarty templates (address.html and address-update.html) fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting (XSS) when an authenticated user visits the malicious link containing attacker‑controlled JavaScript.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Thelia
Products
Thelia
CVE-2026-104587

Stored Cross‑Site Scripting in Blob42 gosuki via Unescaped URL Field

blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
—
Products
—