CVE-2026-124696

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-124698

Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip

In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Progress

Products

Kendo Ui For Jquery

CVE-2026-127274

Linksys EA8100 CheckAdminPassword excessive authentication

A vulnerability was found in Linksys EA8100 1.0.3.216940. This vulnerability affects unknown code of the file /jnap/core/CheckAdminPassword. The manipulation results in improper restriction of excessive authentication attempts. The attack may be performed from remote. The attack requires a high level of complexity. It is stated that the exploitability is difficult. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Linksys

Products

Ea8100

CVE-2026-125680

WordPress Bold Page Builder plugin <= 5.9.11 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold Page Builder bold-page-builder allows Stored XSS.This issue affects Bold Page Builder: from n/a through 5.9.11.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bold-themes Wordpress-extensions

Products

Bold Page Builder Bold Page Builder

CVE-2026-125454

WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpchill

Products

Passster Passster

CVE-2026-126365

Astro: XSS via unescaped code for unsupported languages in @astrojs/prism

Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro() returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labeled with an unsupported language could therefore render embedded HTML and script instead of displaying it as text. The Prism component was affected when applications supplied untrusted code with an unsupported or attacker-controlled lang, and the @astrojs/markdoc prism() extension was affected for less-trusted content authors even when Markdoc's ordinary HTML rendering was disabled. This issue is fixed in @astrojs/prism 4.1.2 and @astrojs/markdoc 2.1.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107710

Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmudev

Products

Hustle Hustle – Email Marketing, Lead Generation, Optins, Popups

CVE-2026-125338

Winter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wintercms

Products

Winter

CVE-2026-125341

Winter CMS: Stored XSS through Backend List widget image columns

Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Wintercms

Products

Winter

CVE-2026-124752

WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress-extensions

Products

Element Pack Elementor Addons Element Pack Elementor Addons

CVE-2026-123288

Stored Cross‑Site Scripting via Vega Editor Link in JetBrains Datalore

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Datalore

CVE-2026-17139

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-118634

Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Liedekef Wordpress-extensions

Products

Events Made Easy Events Made Easy

CVE-2026-115277

WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

User Frontend

CVE-2026-118071

Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Joinchat

CVE-2026-118165

Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Firelight Lightbox

CVE-2026-116622

Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpscripts

Products

Food Store Food Store – Online Food Delivery & Pickup

CVE-2026-65444

WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Creativethemes Wordpress-extensions

Products

Blocksy Companion Blocksy Companion

CVE-2026-119365

WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress-extensions

Products

Media Player Addons For Elementor – Media Player Widget For Wp Media Player Addons For Elementor – Media Player Widget For Wp

CVE-2026-110001

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting to be enabled by an administrator, which causes the plugin to register do_shortcode on the comment_text filter, allowing attacker-supplied shortcode attributes stored in comments to be rendered unescaped to all subsequent visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Foliovision Wordpress-extensions

Products

Fv Flowplayer Video Player Fv Flowplayer Video Player