The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed' Episode Meta Field in all versions up to, and including...

CVE-2026-12098

The PowerPress Podcasting plugin by Blubrry plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'embed

历史摘要 · 未重新核验 · NVD

The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'link' Block Attribute in all vers...

CVE-2026-11402

The Services Section Block – Showcase Service Details in Grid or Columns plugin for WordPress is vulnerable to Stored Cr

历史摘要 · 未重新核验 · NVD

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings i...

CVE-2026-11358

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More plugin for WordPress is vulne

历史摘要 · 未重新核验 · NVD

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page...

CVE-2026-54386

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenti

历史摘要 · 未重新核验 · GitHub Advisory

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is unauthenticated and uses unsanitized fileName input to c...

CVE-2026-48768

TypeBot is a chatbot builder tool. In versions 3.16.1 and earlier, POST /api/blocks/file-input/v3/generate-upload-url is

历史摘要 · 未重新核验 · NVD

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are vulnerable to XSS through a flaw in the strip_html filte...

CVE-2026-44644

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. Versions 10.25.7 and below are

历史摘要 · 未重新核验 · NVD

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenticated attackers to inject arbitrary JavaScript by exploit...

CVE-2026-54386

marimo before 0.23.9 contains a reflected cross-site scripting vulnerability in the notebook page that allows unauthenti

历史摘要 · 未重新核验 · NVD

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vulnerability in the Thumbnail Synchronizer feature. When an ...

CVE-2026-48821

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting (XSS) vuln

历史摘要 · 未重新核验 · NVD

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the tag filtering functionality of Shaarli. An ...

CVE-2026-48823

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnera

历史摘要 · 未重新核验 · NVD

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnerability in the Markdown-to-HTML conversion process used in...

CVE-2026-48822

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a stored Cross-Site Scripting (XSS) vulnera

历史摘要 · 未重新核验 · NVD

Filament: Disabled RichEditor field state can be used for XSS

CVE-2026-55409

In Filament v3, a disabled `RichEditor` field rendered its raw state without sanitizing HTML. Where the data stored in t

历史摘要 · 未重新核验 · GitHub Advisory

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

CVE-2026-28737

## Summary Me again. Gitea's built-in 3D file viewer (powered by Online3DViewer) is vulnerable to stored cross-site sc

历史摘要 · 未重新核验 · GitHub Advisory

Open WebUI: Stored XSS to Account Takeover via Model Profile Images

CVE-2026-54013

# Stored XSS to Account Takeover via Model Profile Images in Open WebUI **Affected:** Open WebUI ` tags. On the output

历史摘要 · 未重新核验 · GitHub Advisory

Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization bypass

CVE-2026-54326

# Potential XSS in HTML session exports via Markdown URL handling Pi HTML exports render session Markdown into a static

历史摘要 · 未重新核验 · GitHub Advisory

Cross-site scripting via <NoScript> slot content in Nuxt's head components

### Impact Nuxt's globally registered `` component (from `@unhead/vue` head components, re-exported by Nuxt) wrote its

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Stored XSS in Chat Trigger Node

CVE-2026-54302

## Impact An authenticated user with workflow edit access could inject arbitrary JavaScript into the Chat Trigger's gene

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Reflected XSS via Facebook, WhatsApp, and Microsoft Teams Trigger Webhook Verification Endpoints

CVE-2026-54303

## Impact An endpoint in the Meta and Microsoft Teams trigger nodes reflects a query parameter into the HTTP response wi

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')...

CVE-2026-12425

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool

历史摘要 · 未重新核验 · GitHub Advisory

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in PowerSchool Employee Access Center allows Cross-Site Scripting (XSS)...

CVE-2026-12425

CVE-2026-12425 是 PowerSchool Employee Access Center 产品中的一个跨站脚本（XSS）漏洞。该漏洞影响版本 23.10，属于输入中和不当（Improper Neutralization of

历史摘要 · 未重新核验 · NVD

PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-privileged malicious actor could potentially exploit this v...

CVE-2024-30476

PowerStore contains a Stored Cross-Site Scripting Vulnerability in the PowerStore Manager. A remote authenticated low-pr

历史摘要 · 未重新核验 · NVD