AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and ...

CVE-2026-56347

AVideo TopMenu插件（版本26.0及之前）存在存储型跨站脚本（XSS）漏洞。该漏洞源于菜单项渲染过程中，图标类、URL和文本标签缺少输出编码。攻击者可以通过未转义的菜单项字段注入恶意JavaScript代码，当其他用户访问网站时

历史摘要 · 未重新核验 · NVD

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting...

CVE-2026-56317

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript compo

历史摘要 · 未重新核验 · GitHub Advisory

Nuxt before 4.4.7 (and the 3.x branch before 3.21.7) contains a cross-site scripting vulnerability in the NoScript component that writes slot content to innerHTML without escapi...

CVE-2026-56317

CVE-2026-56317 是一个影响 Nuxt 前端框架的跨站脚本（XSS）漏洞。该漏洞存在于 Nuxt 4.4.7 之前版本（包括 4.x 分支）以及 3.21.7 之前版本（3.x 分支）的 NoScript 组件中。NoScrip

历史摘要 · 未重新核验 · NVD

appium-mcp: Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI)

## Unescaped Locator Data XSS in MCP-UI Resource (createLocatorGeneratorUI) ### Summary `appium-mcp`'s `createLocatorG

历史摘要 · 未重新核验 · GitHub Advisory

Sveltia CMS: Stored XSS in Markdown/RichText preview via unsandboxed same-origin iframe

### Impact A stored cross-site scripting (XSS) vulnerability affected the Markdown/RichText field preview renderer in S

历史摘要 · 未重新核验 · GitHub Advisory

symfony/ux-icons: XSS via unsanitized SVG content in local files and Iconify on-demand responses

CVE-2026-55877

### Description The `ux_icon()` Twig function is marked `is_safe=['html']`, so Twig never escapes its output. `Icon::to

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via malformed src url with $wgEmbedVideoRequireConsent enabled

CVE-2026-55692

### Summary With $wgEmbedVideoRequireConsent enabled (the default), the urls for videos are stored in a json-ified data

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft...

CVE-2026-32208

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

历史摘要 · 未重新核验 · GitHub Advisory

Outerbase Studio: Stored XSS in Text Widget Leads to Authentication Token Exposure

CVE-2026-55650

## Summary A Stored Cross-Site Scripting (XSS) issue previously existed in the Text Widget in Board of Outerbase Studio

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based) allows an authorized attacker to perform spoofing over a ...

CVE-2026-32208

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge (Chromium-based)

历史摘要 · 未重新核验 · NVD

Allure Report: Stored XSS via unescaped ANSI helper in status message/trace rendering

CVE-2026-55847

## Summary The `ansi.js` Handlebars helper in allure-generator passes user-controlled `statusMessage` and `statusTrace`

历史摘要 · 未重新核验 · GitHub Advisory

TinaCMS: Cross-origin postMessage handlers and rich-text URL-sanitization bypass enable stored XSS and session takeover

CVE-2026-55660

TinaCMS registers window message listeners — the useTina overlay handler, the OAuth authentication popup handler, and th

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized class passed to template

CVE-2026-55691

### Summary The user supplied class value is fed directly into the sprintf call that creates HTML. You can add a quote t

历史摘要 · 未重新核验 · GitHub Advisory

StarCitizenWiki Extension Embed Video: Stored XSS via unsanitized service name in exception text

CVE-2026-55690

### Summary When passing an unknown service name to embedvideo, an error message is rendered containing the invalid serv

历史摘要 · 未重新核验 · GitHub Advisory

Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form) allows XSS. This issue affects GridTime 3000: from 1.0...

CVE-2026-12621

Improper neutralization of input during web page generation XSS vulnerability in the GridTime 3000 (password reset form

历史摘要 · 未重新核验 · NVD

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip GridTime 3000 allows Cross-Site Scripting (XSS). This iss...

CVE-2026-12619

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip G

历史摘要 · 未重新核验 · NVD

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to properly validate all HTML input thereby allowing malicious co...

CVE-2026-21768

The compose-rich-editor library (v1.0.0-rc14) used in HCL Verse for Android's rich text email composition fails to prope

历史摘要 · 未重新核验 · NVD

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking field labels in all versions up to, and including, 1.4.4 du...

CVE-2026-1856

The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via custom booking fi

历史摘要 · 未重新核验 · NVD

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.1.45 due to insufficient input...

CVE-2026-12430

The Blocksy Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versio

历史摘要 · 未重新核验 · NVD

The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the blockId attribute of t...

CVE-2026-12157

The BetterDocs - Knowledge Base Docs & FAQ Solution for Elementor & Block Editor plugin for WordPress is vulnerable to S

历史摘要 · 未重新核验 · NVD