Security Risk Category
Cross-site Scripting Security Risks
Published vulnerability pages connected to Cross-site Scripting. Each page keeps one canonical URL and focused remediation guidance.
260 published Cross-site Scripting risks
Cross-site Scripting risks
Showing 1–36 of 260 published risks.
CVE-2026-65470 Fluent Support vulnerability
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
Updated Jul 24, 2026
CVE-2026-65473 Virtue/Ascend/Pinnacle Toolkit vulnerability
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
Updated Jul 24, 2026
CVE-2026-65475 Modula Image Gallery vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Updated Jul 24, 2026
CVE-2026-65480 TheGem vulnerability
Contributor Cross Site Scripting (XSS) in TheGem <= 5.11.1 versions.
Updated Jul 24, 2026
CVE-2026-65482 LA-Studio Element Kit for Elementor vulnerability
Contributor Cross Site Scripting (XSS) in LA-Studio Element Kit for Elementor <= 1.6.2 versions.
Updated Jul 24, 2026
CVE-2026-65483 HashThemes Demo Importer vulnerability
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
Updated Jul 24, 2026
CVE-2026-65492 Dokan Pro vulnerability
Unauthenticated Cross Site Scripting (XSS) in Dokan Pro <= 5.0.0 versions.
Updated Jul 24, 2026
CVE-2026-65503 Ultimate Store Kit Elementor Addons vulnerability
Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
Updated Jul 24, 2026
CVE-2026-65510 PeproDev Ultimate Invoice vulnerability
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
Updated Jul 24, 2026
CVE-2026-65511 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Updated Jul 24, 2026
CVE-2026-65514 Appointment Hour Booking vulnerability
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
Updated Jul 24, 2026
CVE-2026-65518 Accept Donations with PayPal & Stripe vulnerability
Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
Updated Jul 24, 2026
CVE-2026-65519 Photo Gallery vulnerability
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
Updated Jul 24, 2026
CVE-2026-65522 Manual - Documentation, Knowledge Base & Education WordPress Theme vulnerability
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Updated Jul 24, 2026
CVE-2026-65527 LIQUID SPEECH BALLOON vulnerability
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
Updated Jul 24, 2026
CVE-2026-65528 BSK PDF Manager vulnerability
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Updated Jul 24, 2026
CVE-2026-65533 Smart SEO Tool vulnerability
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
Updated Jul 24, 2026
CVE-2026-65534 Custom links in Elementor Image Carousel vulnerability
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
Updated Jul 24, 2026
CVE-2026-65538 Machete vulnerability
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
Updated Jul 24, 2026
CVE-2026-65550 Tabs vulnerability
Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
Updated Jul 24, 2026
CVE-2026-65605 siyuan vulnerability
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
Updated Jul 24, 2026
CVE-2026-65606 siyuan vulnerability
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.
Updated Jul 24, 2026
CVE-2026-65898 DOMPurify vulnerability
DOMPurify before 3.4.11 fails to clone the ALLOWED_ATTR allowlist when setConfig() is used with an uponSanitizeAttribute hook, allowing the hook to permanently mutate the shared allowlist. Attackers can register a hook that conditionally allows dangerous attributes like onerror for trusted elements, then submit untrusted content that inherits the polluted allowlist and executes event handlers as stored XSS.
Updated Jul 24, 2026
CVE-2026-65900 DOMPurify vulnerability
DOMPurify versions >=3.0.0 and before 3.4.8, when configured with SAFE_FOR_TEMPLATES together with a DOM output mode (RETURN_DOM, RETURN_DOM_FRAGMENT, or IN_PLACE), fail to strip template expressions (e.g. ${evil}, {{evil}}, <%evil%>) inside <template> element content. The final normalization/scrub pass (_scrubTemplateExpressions) uses a NodeIterator and node.normalize() that do not descend into template.content, so expressions that only form after adjacent text nodes merge survive sanitization. This bypasses SAFE_FOR_TEMPLATES and can allow a downstream template engine to evaluate attacker-supplied expressions. The string output path is not affected.
Updated Jul 24, 2026
CVE-2026-65901 DOMPurify vulnerability
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Updated Jul 24, 2026
CVE-2026-65904 DOMPurify vulnerability
DOMPurify through 3.3.3 fails to sanitize DOM elements passed via IN_PLACE mode when the element originates from a different window/realm (e.g., an iframe's contentDocument). A cross-realm instanceof check in the private _isNode() function returns false for foreign-realm nodes, causing DOMPurify to stringify the element (yielding '[object HTMLDivElement]'), silently reset IN_PLACE to false, and return the unsanitized element unchanged with any XSS payloads intact. The vendor considers this an edge case outside DOMPurify's threat model and, at time of publication, no fix was planned.
Updated Jul 24, 2026
CVE-2026-65911 DOMPurify vulnerability
In DOMPurify through 3.3.3, function predicates supplied via ADD_ATTR or ADD_TAGS to DOMPurify.sanitize() persist in internal state (EXTRA_ELEMENT_HANDLING) across subsequent sanitize() calls on the same instance. If a later call on the same instance provides ADD_ATTR or ADD_TAGS as an array rather than a function, the previously set function handler is neither cleared nor overwritten, so it continues to approve attacker-controlled attributes or tags. This can allow dangerous event-handler attributes or forbidden tags (bypassing FORBID_TAGS) to survive sanitization, resulting in cross-site scripting. The vendor (Cure53) considers this an edge case outside DOMPurify's threat model; the referenced advisory lists 3.4.0 as the patched version.
Updated Jul 24, 2026
CVE-2026-65913 DOMPurify vulnerability
DOMPurify before 3.3.2 contains a prototype pollution vulnerability in USE_PROFILES mode that allows attackers to bypass attribute filtering by polluting Array.prototype properties. Attackers can set Array.prototype properties like onclick to true, causing DOMPurify to accept event handlers as allowlisted attributes and resulting in DOM-based XSS when sanitized markup is rendered.
Updated Jul 24, 2026
CVE-2026-65912 DOMPurify vulnerability
DOMPurify before 3.3.2 contains a URI validation bypass vulnerability when ADD_ATTR is provided as a predicate function via EXTRA_ELEMENT_HANDLING.attributeCheck. Attackers can supply a predicate that accepts specific attribute and tag combinations to bypass URI-safe validation, allowing unsafe protocols like javascript: to survive sanitization and execute as DOM-based XSS when the link is activated.
Updated Jul 24, 2026
CVE-2026-65914 DOMPurify vulnerability
DOMPurify before 3.3.2 contains a mutation-XSS vulnerability when sanitized HTML is reinserted into special parsing contexts using innerHTML with wrappers like script, xmp, iframe, noembed, noframes, or noscript. Attackers can craft payloads with closing sequences that break out of the wrapper context during reparsing, reactivating dangerous markup with event handlers to execute JavaScript.
Updated Jul 24, 2026
CVE-2026-48531 GFI Archiver vulnerability
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Retention and Spam Policies page.
Updated Jul 24, 2026
CVE-2026-48532 GFI Archiver vulnerability
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page.
Updated Jul 24, 2026
CVE-2026-48530 GFI Archiver vulnerability
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
Updated Jul 24, 2026
CVE-2026-48534 GFI Archiver vulnerability
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
Updated Jul 24, 2026
CVE-2026-48535 GFI Archiver vulnerability
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
Updated Jul 24, 2026
CVE-2026-48536 GFI Archiver vulnerability
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
Updated Jul 24, 2026