CVE-2026-125454

WordPress Passster plugin <= 4.3.21 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Passster content-protector allows Stored XSS.This issue affects Passster: from n/a through 4.3.21.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpchill

Products

Passster Passster

CVE-2026-126365

Astro: XSS via unescaped code for unsupported languages in @astrojs/prism

Astro is a web framework for content-driven websites. Prior to @astrojs/prism 4.1.2, and from @astrojs/markdoc 0.3.0 until 2.1.2, runHighlighterWithAstro() returned code unchanged when Prism had no grammar for the requested language, and callers inserted that result as raw HTML. A code block labeled with an unsupported language could therefore render embedded HTML and script instead of displaying it as text. The Prism component was affected when applications supplied untrusted code with an unsupported or attacker-controlled lang, and the @astrojs/markdoc prism() extension was affected for less-trusted content authors even when Markdoc's ordinary HTML rendering was disabled. This issue is fixed in @astrojs/prism 4.1.2 and @astrojs/markdoc 2.1.2.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126363

Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js

Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107710

Hustle <= 7.8.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Module Content Title

The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpmudev

Products

Hustle Hustle – Email Marketing, Lead Generation, Optins, Popups

CVE-2026-126362

Astro: Reflected XSS via unescaped slot names in @astrojs/svelte

Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126361

Astro: XSS via attribute injection in dynamic tag names

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126359

Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when &lt; ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the &lt;Style /&gt; element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after &lt; in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-125338

Winter CMS: Stored XSS through cached Brand Settings and Editor Settings custom styles

Winter CMS is a content management system built on the Laravel PHP framework. Prior to 1.2.14, BrandSetting::renderCss() and EditorSetting::renderCss() store raw LESS compiler output with Cache::forever() but apply strip_tags() only to the value returned on a cache miss. The first render after saving custom CSS appears sanitized while priming an unsafe cache entry, and later cache hits return unsanitized output into the backend style element, allowing a user with backend.manage_branding or backend.manage_editor to cause stored cross-site scripting when another backend page renders the styles. The styles also appear on unauthenticated backend sign-in, password restore, and password reset layouts. This issue is fixed in version 1.2.14.

CVSS 3.1 · 4.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wintercms

Products

Winter

CVE-2026-125341

Winter CMS: Stored XSS through Backend List widget image columns

Winter CMS is a content management system built on the Laravel PHP framework. From 1.1.0 until 1.2.14, Backend\Widgets\Lists::evalImageTypeValue() interpolates the result of ImageResizer::filterGetUrl() into a single-quoted image source attribute without escaping it. In a third-party plugin that renders an attacker-influenced value through an image list column, an unsupported image value is returned verbatim, can break out of the attribute, and can inject event handlers that execute when a backend user views the list. Winter core ships no image list column, so a default installation is unaffected. This issue is fixed in version 1.2.14.

CVSS 3.1 · 2 Low EPSS < 1% KEV · Not listed

Vendors

Wintercms

Products

Winter

CVE-2026-124752

WordPress Element Pack Elementor Addons plugin <= 10.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BdThemes Element Pack Elementor Addons bdthemes-element-pack-lite allows Stored XSS.This issue affects Element Pack Elementor Addons: from n/a through 10.0.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bdthemes Wordpress-extensions

Products

Element Pack Elementor Addons Element Pack Elementor Addons

CVE-2026-123288

Stored Cross‑Site Scripting via Vega Editor Link in JetBrains Datalore

In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Datalore

CVE-2026-17139

Multiple Vulnerabilities in IBM API Connect

IBM API Connect 10.0.8.0 through 10.0.8.12 and 12.1.0.0 through 12.1.1.2 could allow a remote authenticated attacker to execute arbitrary scripts due to cross-site scripting. Certain URL fields are not sufficiently validated, so malicious script content could run in another user's browser session.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Api Connect

CVE-2026-118634

Events Made Easy <= 3.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'width' Shortcode Attribute

The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all versions up to, and including, 3.3.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Liedekef Wordpress-extensions

Products

Events Made Easy Events Made Easy

CVE-2026-115277

WP User Frontend < 4.3.14 - Reflected XSS via 'field_attr' Parameter

The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecting them into HTML attributes in a publicly reachable AJAX response, leading to Reflected Cross-Site Scripting. The affected action is gated by an anonymous nonce that only validates for logged-out requests, so the payload executes against logged-out visitors rather than authenticated users.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

User Frontend

CVE-2026-118071

Joinchat 6.3.2 - 6.4.1 - Author+ Stored XSS via Button Block Message Attribute

The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an HTML attribute on the front end, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks against any visitor of the post, including administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Joinchat

CVE-2026-118165

Firelight Lightbox < 2.3.23 - Contributor+ Stored XSS via Lightbox Link 'href' Attribute

The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it into the page as HTML, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks against users who click a crafted link.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Firelight Lightbox

CVE-2026-116622

Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions Wpscripts

Products

Food Store Food Store – Online Food Delivery & Pickup

CVE-2026-65444

WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Creativethemes Wordpress-extensions

Products

Blocksy Companion Blocksy Companion

CVE-2026-119365

WordPress Media Player Addons for Elementor – Media Player widget for WP plugin <= 1.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Player Addons for Elementor – Media Player widget for WP media-player-addons-for-elementor allows Stored XSS.This issue affects Media Player Addons for Elementor – Media Player widget for WP: from n/a through 1.1.10.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Bplugins Wordpress-extensions

Products

Media Player Addons For Elementor – Media Player Widget For Wp Media Player Addons For Elementor – Media Player Widget For Wp

CVE-2026-110001

FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (shortcode attribute 'align')' parameter in all versions up to, and including, 7.5.55.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the plugin's 'Parse Vimeo and YouTube links' (parse_comments) setting to be enabled by an administrator, which causes the plugin to register do_shortcode on the comment_text filter, allowing attacker-supplied shortcode attributes stored in comments to be rendered unescaped to all subsequent visitors.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Foliovision Wordpress-extensions

Products

Fv Flowplayer Video Player Fv Flowplayer Video Player