Total
47216 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2026-59556 | 2026-07-27 | N/A | 7.1 HIGH | ||
| Unauthenticated Cross Site Scripting (XSS) in Dynamic Pricing With Discount Rules for WooCommerce <= 4.5.11 versions. | |||||
| CVE-2026-59559 | 2026-07-27 | N/A | 6.5 MEDIUM | ||
| Subscriber Cross Site Scripting (XSS) in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. | |||||
| CVE-2026-66433 | 2026-07-27 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Location Weather <= 3.0.6 versions. | |||||
| CVE-2026-65562 | 2026-07-27 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in BetterDocs <= 4.6.2 versions. | |||||
| CVE-2026-65561 | 2026-07-27 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.0 versions. | |||||
| CVE-2026-66448 | 2026-07-27 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions. | |||||
| CVE-2026-66475 | 2026-07-27 | N/A | 5.9 MEDIUM | ||
| Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions. | |||||
| CVE-2026-65557 | 2026-07-27 | N/A | 5.9 MEDIUM | ||
| Shop manager Cross Site Scripting (XSS) in Abandoned Cart Lite for WooCommerce <= 6.8.0 versions. | |||||
| CVE-2026-65563 | 2026-07-27 | N/A | 5.9 MEDIUM | ||
| Author Cross Site Scripting (XSS) in Orbit Fox by ThemeIsle <= 3.0.7 versions. | |||||
| CVE-2026-66445 | 2026-07-27 | N/A | 6.5 MEDIUM | ||
| Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions. | |||||
| CVE-2026-48535 | 2026-07-27 | N/A | 5.4 MEDIUM | ||
| GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page. | |||||
| CVE-2026-64795 | 2026-07-27 | N/A | 5.4 MEDIUM | ||
| Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’ browsers. | |||||
| CVE-2026-63281 | 2026-07-27 | N/A | 4.8 MEDIUM | ||
| Joomla Extension - regularlabs.com - XSS vulnerability in Regular Labs conditions manager - Stored condition values could also execute HTML/JavaScript in administrator summaries. | |||||
| CVE-2021-47925 | 2026-07-25 | N/A | 6.4 MEDIUM | ||
| CMDBuild 3.3.2 contains multiple stored cross-site scripting vulnerabilities that allow authenticated attackers to inject arbitrary web script or HTML via crafted input in card creation and file upload endpoints. Attackers can inject XSS payloads through Employee card parameters or SVG file attachments in the classes endpoint, which execute when other users view the affected records or preview attachments. | |||||
| CVE-2021-47927 | 2026-07-25 | N/A | 6.4 MEDIUM | ||
| WordPress Plugin WP Symposium Pro 2021.10 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by exploiting insufficient sanitization of the forum name parameter. Attackers can submit POST requests to the admin setup page with JavaScript payloads in the wps_admin_forum_add_name parameter, which are stored and executed when the forum is accessed. | |||||
| CVE-2021-47910 | 2026-07-25 | N/A | 6.4 MEDIUM | ||
| AccessPress Social Icons 1.8.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by entering JavaScript payloads into the 'icon title' field. Attackers can store XSS payloads like image tags with onerror event handlers that execute when the plugin page is viewed, affecting all users who access the plugin interface. | |||||
| CVE-2021-47907 | 2026-07-25 | N/A | 6.4 MEDIUM | ||
| Rocket LMS 1.1 contains a persistent cross-site scripting vulnerability in the support ticket module that allows authenticated users to inject malicious script code through the title parameter. Attackers can submit support tickets with embedded HTML/JavaScript payloads that execute in the browsers of other users viewing the message history, enabling session hijacking and phishing attacks. | |||||
| CVE-2021-47922 | 2026-07-25 | N/A | 6.4 MEDIUM | ||
| Slider by Soliloquy 2.6.2 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts through the title parameter. Attackers can add JavaScript payloads in the title field when creating or editing sliders, which executes in the browsers of users viewing the slider on both administrative and frontend pages. | |||||
| CVE-2025-15437 | 1 Ligerosmart | 1 Ligerosmart | 2026-07-25 | 4.0 MEDIUM | 3.5 LOW |
| A vulnerability was found in LigeroSmart up to 6.1.24. This affects an unknown part of the component Environment Variable Handler. Performing a manipulation of the argument REQUEST_URI results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used. Upgrading to version 6.1.26 and 6.3 is able to mitigate this issue. The patch is named 264ac5b2be5b3c673ebd8cb862e673f5d300d9a7. The affected component should be upgraded. | |||||
| CVE-2026-25133 | 1 Octobercms | 1 October | 2026-07-25 | N/A | 4.8 MEDIUM |
| October is a Content Management System (CMS) and web platform. Versions prior to 3.7.14 and 4.1.10 contain a stored cross-site scripting (XSS) vulnerability in the SVG sanitization logic. The regex pattern used to strip event handler attributes (such as onclick or onload) could be bypassed using a crafted payload that exploits how the pattern matches attribute boundaries, allowing malicious SVG files to be uploaded through the Media Manager with embedded JavaScript. Exploitation could lead to privilege escalation if a superuser views or embeds the malicious SVG, and requires authenticated backend access with media upload permissions. The SVG must be viewed or embedded in a page for the payload to trigger. This issue has been fixed in versions 3.7.14 and 4.1.10. | |||||