372 CVEs — updated 2026-11-02 · vulnfeed
| CVE / ID | Title | Severity | CVSS | EPSS | Source | Date |
|---|---|---|---|---|---|---|
| CVE-2026-61728 | SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. In affected snap | CRITICAL | 9.9 | 40%ile | NVD | 2026-10-30 |
| CVE-2026-63190 | FearlessCMS is a flat-file `content` management system centered on simplicity and open source. Prior to version 0.1.4, f | CRITICAL | 9.4 | 46%ile | NVD | 2026-10-28 |
| CVE-2026-104350 | Adobe Campaign Classic (ACC) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could expl | CRITICAL | 9.3 | 49%ile | NVD | 2026-10-27 |
| CVE-2026-61645 | Docat is a tool for hosting versioned static documentation. In the affected implementation, an arbitrary file upload vul | CRITICAL | 9.1 | 35%ile | NVD | 2026-10-29 |
| CVE-2026-61719 | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored cross-site scripting vulnerability in `saud | HIGH | 8.9 | 15%ile | NVD | 2026-10-29 |
| CVE-2026-45144 | Chamilo LMS is an open-source learning management system. From 2.0.0 until 2.0.1, `GET /user/{username}` is anonymously | HIGH | 8.9 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-116836 | A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site Scr | HIGH | 8.8 | 9%ile | NVD | 2026-10-27 |
| CVE-2026-86794 | The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public ev | HIGH | 8.8 | 20%ile | NVD | 2026-10-29 |
| CVE-2026-117571 | The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 8.8 does not sanitize and escape tracking data der | HIGH | 8.8 | 20%ile | NVD | 2026-10-30 |
| CVE-2026-102800 | Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article | HIGH | 8.7 | 33%ile | NVD | 2026-10-27 |
| CVE-2026-85268 | A Cross-Site Scripting (XSS) (CWE-79) vulnerability in the auth/handler in Google Cloud Identity Platform and Firebase A | HIGH | 8.7 | 48%ile | NVD | 2026-10-30 |
| CVE-2026-62990 | Shopper is a Headless e-commerce Admin Panel. In versions from 2.0.0 prior to 2.10.1 and in the 3.0.0 prereleases beta.1 | HIGH | 8.7 | 16%ile | NVD | 2026-10-30 |
| CVE-2026-102790 | Joomla Extension - icagenda.com - Stored XSS via url-type event Custom Field in iCagenda 3.2.1 to 4.0.16 | HIGH | 8.6 | 21%ile | NVD | 2026-10-28 |
| CVE-2026-67073 | HCL BigFix AEX is affected by an Unrestricted File Upload and Improper Access Control vulnerability. This could allow an | HIGH | 8.6 | 13%ile | NVD | 2026-10-28 |
| CVE-2026-118245 | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartCon | HIGH | 8.6 | 27%ile | NVD | 2026-10-28 |
| CVE-2026-118254 | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination l | HIGH | 8.6 | 36%ile | NVD | 2026-10-28 |
| CVE-2026-103419 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11. | HIGH | 8.6 | — | NVD | 2026-11-02 |
| CVE-2026-105602 | Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate < 2.2.1 | HIGH | 8.6 | — | NVD | 2026-11-02 |
| CVE-2026-116675 | TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates | HIGH | 8.5 | 28%ile | NVD | 2026-10-27 |
| CVE-2026-116797 | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers | HIGH | 8.5 | 24%ile | NVD | 2026-10-28 |
| CVE-2026-118242 | Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path el | HIGH | 8.5 | 23%ile | NVD | 2026-10-28 |
| CVE-2026-119680 | A stored cross-site scripting (XSS) vulnerability exists in the chart feature of SharePoint Manager Plus (SPMP) due to i | HIGH | 8.5 | 15%ile | NVD | 2026-10-30 |
| CVE-2026-118246 | Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts ap | HIGH | 8.4 | 27%ile | NVD | 2026-10-28 |
| CVE-2026-118251 | Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns cre | HIGH | 8.4 | 38%ile | NVD | 2026-10-28 |
| CVE-2026-118252 | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sid | HIGH | 8.4 | 36%ile | NVD | 2026-10-28 |
| CVE-2026-118253 | Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode par | HIGH | 8.4 | 36%ile | NVD | 2026-10-28 |
| CVE-2026-118255 | Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.hre | HIGH | 8.4 | 28%ile | NVD | 2026-10-28 |
| CVE-2026-118648 | n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability be | HIGH | 8.4 | 18%ile | NVD | 2026-10-28 |
| CVE-2026-117493 | Stored cross-site scripting (XSS) in BloX widgets. The /api/dashboards/<id>/widgets/<id> API accepts HTML and JavaScript | HIGH | 8.3 | 21%ile | NVD | 2026-10-27 |
| CVE-2026-117494 | Cross-Site Scripting (XSS) in the processing of SVG images submitted to the /api/v2/ai/sessions API in the format data:i | HIGH | 8.3 | 21%ile | NVD | 2026-10-27 |
| CVE-2026-116688 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 45.0.0 until 47.7.4 and 48.5.1, the en | HIGH | 8.1 | 43%ile | NVD | 2026-10-27 |
| CVE-2026-58205 | GRR is a resource management and reservation application. Prior to version 4.5.0, `maj.php` reflects the `forcemaj` para | HIGH | 8.1 | 21%ile | NVD | 2026-10-27 |
| CVE-2026-61804 | myTinyWMS is a free, open-source warehouse management system. Prior to version 1.6.4, `Product (Artikel)` and `Category` | HIGH | 8.1 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-111089 | Apache Wicket reads texts from the application's resource bundles — a localized label, a css class name — and writes som | HIGH | 7.6 | — | NVD | 2026-11-01 |
| CVE-2026-82956 | Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.ajax.AjaxNewWindowNotif | HIGH | 7.6 | — | NVD | 2026-11-01 |
| CVE-2026-95863 | Improper neutralization of input during web page generation in Apache Wicket. Apache Wicket generates JavaScript that r | HIGH | 7.6 | — | NVD | 2026-11-01 |
| CVE-2026-105972 | The Menu Cart for WooCommerce WordPress plugin before 3.2.1 does not sanitise and escape cart item variation data before | HIGH | 7.5 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-111578 | The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape sev | HIGH | 7.5 | 22%ile | NVD | 2026-10-30 |
| CVE-2026-119764 | Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling ta | HIGH | 7.4 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-120205 | Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows u | HIGH | 7.4 | 18%ile | NVD | 2026-10-31 |
| CVE-2026-83539 | Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.extensions.markup.html. | HIGH | 7.4 | — | NVD | 2026-11-01 |
| CVE-2026-84231 | Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.html.link.Extern | HIGH | 7.4 | — | NVD | 2026-11-01 |
| CVE-2026-9086 | Keycloak vulnerable to cross-site scripting (xss) via case-insensitive uri validation bypass | HIGH | 7.3 | 56%ile | GitHub | 2026-10-29 |
| CVE-2026-111820 | The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored Cross-Sit | HIGH | 7.2 | 15%ile | NVD | 2026-10-27 |
| CVE-2026-109995 | The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site | HIGH | 7.2 | 15%ile | NVD | 2026-10-27 |
| CVE-2026-109999 | The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media & | HIGH | 7.2 | 22%ile | NVD | 2026-10-28 |
| CVE-2026-111314 | The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display plugin for WordPress is vulnerable to Stored Cr | HIGH | 7.2 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-97019 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headlin | HIGH | 7.2 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-110662 | The MxChat – AI Chatbot & Content Generation for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross- | HIGH | 7.2 | 24%ile | NVD | 2026-10-28 |
| CVE-2026-111111 | The Prime Slider – Hero Slider, Carousel, WooCommerce & Post Slider Elementor Addons plugin for WordPress is vulnerable | HIGH | 7.2 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-116796 | Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts ac | HIGH | 7.2 | 27%ile | NVD | 2026-10-28 |
| CVE-2026-118244 | Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back | HIGH | 7.2 | 27%ile | NVD | 2026-10-28 |
| CVE-2026-118257 | Vue I18n is the internationalization plugin for Vue.js. From 11.1.10 until 11.4.14 and from 12.0.0-alpha.4 until 12.0.0- | HIGH | 7.2 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-96666 | The Schema App Structured Data plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via | HIGH | 7.2 | 22%ile | NVD | 2026-10-29 |
| CVE-2026-96669 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'se | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-96741 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Ou | HIGH | 7.2 | 15%ile | NVD | 2026-10-29 |
| CVE-2026-107743 | The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, | HIGH | 7.2 | 34%ile | NVD | 2026-10-29 |
| CVE-2026-115821 | The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name, billing_la | HIGH | 7.2 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-96767 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | HIGH | 7.2 | 36%ile | NVD | 2026-10-29 |
| CVE-2026-116622 | The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | HIGH | 7.2 | 15%ile | NVD | 2026-10-30 |
| CVE-2026-90437 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Excerpt / Post Custom Field | HIGH | 7.2 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-97645 | The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via List Field in all versions up to | HIGH | 7.2 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-104744 | The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign' p | HIGH | 7.2 | 21%ile | NVD | 2026-10-30 |
| CVE-2026-112365 | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vu | HIGH | 7.2 | 45%ile | NVD | 2026-10-30 |
| CVE-2026-96894 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Si | HIGH | 7.2 | 31%ile | NVD | 2026-10-30 |
| CVE-2026-109234 | The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_content (bbPress reply | HIGH | 7.2 | 32%ile | NVD | 2026-10-31 |
| CVE-2026-109997 | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v | HIGH | 7.2 | 38%ile | NVD | 2026-10-31 |
| CVE-2026-116520 | The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment / s | HIGH | 7.2 | 32%ile | NVD | 2026-10-31 |
| CVE-2026-107653 | The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payment | HIGH | 7.2 | 20%ile | NVD | 2026-10-31 |
| CVE-2026-107750 | The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via t | HIGH | 7.2 | 18%ile | NVD | 2026-10-31 |
| CVE-2026-111254 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all | HIGH | 7.2 | 24%ile | NVD | 2026-10-31 |
| CVE-2026-115840 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'p | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-116522 | The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' par | HIGH | 7.2 | 16%ile | NVD | 2026-10-31 |
| CVE-2026-116548 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'o | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-118070 | The Welcart e-Commerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gid' parameter in all | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-119065 | The Shipping Zones by Drawing for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-119089 | The ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin plugin for WordPress is vulnera | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-119162 | The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-107759 | The WPO365 | MICROSOFT 365 GRAPH MAILER plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subje | HIGH | 7.2 | 20%ile | NVD | 2026-10-31 |
| CVE-2026-118057 | The Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning plugin for WordPress is vulnerabl | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-110530 | The FeedWordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 20 | HIGH | 7.2 | 15%ile | NVD | 2026-10-31 |
| CVE-2026-120075 | The WP Activity Log plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi | HIGH | 7.2 | 14%ile | NVD | 2026-10-31 |
| CVE-2026-120114 | The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site | HIGH | 7.2 | 35%ile | NVD | 2026-10-31 |
| CVE-2026-102636 | A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design, can | HIGH | 7.1 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-102637 | A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is invo | HIGH | 7.1 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-102638 | A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the Librar | HIGH | 7.1 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-111021 | The افزونه پیامک ووکامرس | Persian WooCommerce SMS WordPress plugin before 7.3.2 does not sanitise and escape a paramete | HIGH | 7.1 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-115593 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited Elements | HIGH | 7.1 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-115596 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in impleCode eCommerc | HIGH | 7.1 | 10%ile | NVD | 2026-10-28 |
| CVE-2026-115606 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crowd Favorite DXP | HIGH | 7.1 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-115609 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan GetPaid in | HIGH | 7.1 | 4%ile | NVD | 2026-10-28 |
| CVE-2026-115612 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.mihai SliceWP | HIGH | 7.1 | 10%ile | NVD | 2026-10-28 |
| CVE-2026-115592 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP oc | HIGH | 7.1 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-115611 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net Table | HIGH | 7.1 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-116409 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell O | HIGH | 7.1 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-108494 | Unauthenticated Cross Site Scripting (XSS) in Chained Quiz <= 1.4.1 versions. | HIGH | 7.1 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-118085 | Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions. | HIGH | 7.1 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-27394 | Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions. | HIGH | 7.1 | 7%ile | NVD | 2026-10-29 |
| CVE-2026-42692 | Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions. | HIGH | 7.1 | 16%ile | NVD | 2026-10-29 |
| CVE-2026-54864 | Unauthenticated Cross Site Scripting (XSS) in Post Video Players <= 1.165 versions. | HIGH | 7.1 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-54866 | Unauthenticated Cross Site Scripting (XSS) in Razorpay Payment Button Elementor Plugin <= 1.2.8 versions. | HIGH | 7.1 | 16%ile | NVD | 2026-10-29 |
| CVE-2026-61988 | Unauthenticated Cross Site Scripting (XSS) in Auction Nudge – Your eBay on Your Site <= 8.4.0 versions. | HIGH | 7.1 | 15%ile | NVD | 2026-10-29 |
| CVE-2026-61989 | Unauthenticated Cross Site Scripting (XSS) in Easy Property Listings <= 3.5.25 versions. | HIGH | 7.1 | 7%ile | NVD | 2026-10-29 |
| CVE-2026-61993 | Unauthenticated Cross Site Scripting (XSS) in Blockonomics 3.11.0 versions. | HIGH | 7.1 | 14%ile | NVD | 2026-10-29 |
| CVE-2026-61995 | Unauthenticated Cross Site Scripting (XSS) in YouTube Showcase <= 4.1.0 versions. | HIGH | 7.1 | 14%ile | NVD | 2026-10-29 |
| CVE-2026-105077 | Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions. | HIGH | 7.1 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-116405 | Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions. | HIGH | 7.1 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-116847 | Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions. | HIGH | 7.1 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-116851 | Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions. | HIGH | 7.1 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-28160 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCa | HIGH | 7.1 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-39786 | Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions. | HIGH | 7.1 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-48201 | Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions. | HIGH | 7.1 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-54855 | Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions. | HIGH | 7.1 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-94175 | Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions. | HIGH | 7.1 | 8%ile | NVD | 2026-10-30 |
| CVE-2026-66570 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress | HIGH | 7.1 | 10%ile | NVD | 2026-11-01 |
| CVE-2026-107098 | The Royal Addons for Elementor WordPress plugin before 1.7.1070 does not sanitise and escape one of its map widget's si | MEDIUM | 6.8 | 25%ile | NVD | 2026-10-28 |
| CVE-2026-110506 | The Page Builder by SiteOrigin WordPress plugin before 2.38.0 does not sanitize or escape a widget property before stori | MEDIUM | 6.8 | 25%ile | NVD | 2026-10-28 |
| CVE-2026-110524 | The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode att | MEDIUM | 6.8 | 25%ile | NVD | 2026-10-28 |
| CVE-2026-111967 | The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before o | MEDIUM | 6.8 | 25%ile | NVD | 2026-10-28 |
| CVE-2026-113487 | The GeoDirectory WordPress plugin before 2.8.196 does not properly sanitise or escape a post badge click-through link v | MEDIUM | 6.8 | 25%ile | NVD | 2026-10-28 |
| CVE-2026-113488 | The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaSc | MEDIUM | 6.8 | 25%ile | NVD | 2026-10-28 |
| CVE-2026-110504 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content is | MEDIUM | 6.8 | 22%ile | NVD | 2026-10-29 |
| CVE-2026-110505 | The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG f | MEDIUM | 6.8 | 33%ile | NVD | 2026-10-29 |
| CVE-2026-118071 | The Joinchat WordPress plugin before 6.4.2 does not escape the message of its button block before outputting it in an H | MEDIUM | 6.8 | 15%ile | NVD | 2026-10-30 |
| CVE-2026-118165 | The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox | MEDIUM | 6.8 | 15%ile | NVD | 2026-10-30 |
| CVE-2026-118438 | The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing | MEDIUM | 6.8 | 22%ile | NVD | 2026-10-31 |
| CVE-2026-113482 | The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputti | MEDIUM | 6.8 | 14%ile | NVD | 2026-11-01 |
| CVE-2026-91907 | Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page Genera | MEDIUM | 6.8 | — | NVD | 2026-11-02 |
| CVE-2026-115966 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing Te | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-26 |
| CVE-2026-116398 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content S | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-26 |
| CVE-2026-116400 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button Bl | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-26 |
| CVE-2026-116408 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery P | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-26 |
| CVE-2026-115957 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Discussion Boar | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-28 |
| CVE-2026-118087 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site R | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-118094 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad Inser | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-24533 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy Bl | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-48196 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali For | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-52709 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video Gal | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-56056 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid The | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-116857 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmar | MEDIUM | 6.5 | 10%ile | NVD | 2026-10-29 |
| CVE-2026-48195 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF Poste | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-54862 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import a | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-110881 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force S | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-114706 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong Te | MEDIUM | 6.5 | 3%ile | NVD | 2026-10-29 |
| CVE-2026-115610 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Publi | MEDIUM | 6.5 | 3%ile | NVD | 2026-10-29 |
| CVE-2026-116849 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins StreamCas | MEDIUM | 6.5 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-116850 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Happy Addon | MEDIUM | 6.5 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-118095 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Medi | MEDIUM | 6.5 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-118097 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Flash & H | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-39737 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElem | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-29 |
| CVE-2026-39742 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell | MEDIUM | 6.5 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-116848 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in POSIMYTH Innovatio | MEDIUM | 6.5 | 3%ile | NVD | 2026-10-29 |
| CVE-2026-54865 | Subscriber Cross Site Scripting (XSS) in Podamibe Custom User Gravatar <= 1.0.8 versions. | MEDIUM | 6.5 | 13%ile | NVD | 2026-10-29 |
| CVE-2026-119370 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-65444 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes Bl | MEDIUM | 6.5 | 6%ile | NVD | 2026-10-30 |
| CVE-2026-119369 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / Stell | MEDIUM | 6.5 | 12%ile | NVD | 2026-10-30 |
| CVE-2026-119365 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media Pla | MEDIUM | 6.5 | 10%ile | NVD | 2026-10-30 |
| CVE-2026-114711 | Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions. | MEDIUM | 6.5 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-116854 | Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions. | MEDIUM | 6.5 | 9%ile | NVD | 2026-10-30 |
| CVE-2026-27061 | Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions. | MEDIUM | 6.5 | 14%ile | NVD | 2026-10-30 |
| CVE-2026-39739 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force U | MEDIUM | 6.5 | 10%ile | NVD | 2026-10-30 |
| CVE-2026-10511 | The Jupiter X Core plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'forget_password_link' para | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-27 |
| CVE-2026-107625 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugi | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-109209 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is | MEDIUM | 6.4 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-109974 | The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-111727 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vs_text_subm | MEDIUM | 6.4 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-103370 | The Awesome Support – WordPress HelpDesk & Support Plugin plugin for WordPress is vulnerable to Stored Cross-Site Script | MEDIUM | 6.4 | 17%ile | NVD | 2026-10-28 |
| CVE-2026-103996 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored C | MEDIUM | 6.4 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-104729 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tab_index, empty_n | MEDIUM | 6.4 | 5%ile | NVD | 2026-10-28 |
| CVE-2026-104740 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored C | MEDIUM | 6.4 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-107710 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Sc | MEDIUM | 6.4 | 10%ile | NVD | 2026-10-28 |
| CVE-2026-108366 | The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is vu | MEDIUM | 6.4 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-109370 | The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Bas | MEDIUM | 6.4 | 12%ile | NVD | 2026-10-28 |
| CVE-2026-109385 | The UiChemy – Convert Figma, Prompts and AI Builds to Elementor, Gutenberg and Bricks plugin for WordPress is vulnerable | MEDIUM | 6.4 | 17%ile | NVD | 2026-10-28 |
| CVE-2026-109590 | The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and | MEDIUM | 6.4 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-109972 | The s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions plugin | MEDIUM | 6.4 | 20%ile | NVD | 2026-10-28 |
| CVE-2026-109975 | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPre | MEDIUM | 6.4 | 10%ile | NVD | 2026-10-28 |
| CVE-2026-109978 | The Cozy Blocks – Website Builder for WordPress Block Editor | Gutenberg Blocks, Patterns & Templates plugin for WordPre | MEDIUM | 6.4 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-110071 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versio | MEDIUM | 6.4 | 10%ile | NVD | 2026-10-28 |
| CVE-2026-116749 | The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'c | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-118164 | The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored C | MEDIUM | 6.4 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-77188 | The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting vi | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-77871 | The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Sc | MEDIUM | 6.4 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-93293 | The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's | MEDIUM | 6.4 | 8%ile | NVD | 2026-10-29 |
| CVE-2026-104727 | The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cond | MEDIUM | 6.4 | 17%ile | NVD | 2026-10-29 |
| CVE-2026-109215 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parame | MEDIUM | 6.4 | 27%ile | NVD | 2026-10-29 |
| CVE-2026-118500 | The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross | MEDIUM | 6.4 | 12%ile | NVD | 2026-10-30 |
| CVE-2026-118634 | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width' parameter in all | MEDIUM | 6.4 | 10%ile | NVD | 2026-10-30 |
| CVE-2026-102918 | The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and includi | MEDIUM | 6.4 | 24%ile | NVD | 2026-10-30 |
| CVE-2026-110533 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_vide | MEDIUM | 6.4 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-115869 | The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater fiel | MEDIUM | 6.4 | 22%ile | NVD | 2026-10-30 |
| CVE-2026-119113 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to | MEDIUM | 6.4 | 30%ile | NVD | 2026-10-30 |
| CVE-2026-119176 | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Subject' pa | MEDIUM | 6.4 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-9239 | The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label a | MEDIUM | 6.4 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-107765 | The Discussion Board – WordPress Forum Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versi | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-31 |
| CVE-2026-116546 | The WP Job Portal – AI-Powered Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to | MEDIUM | 6.4 | 11%ile | NVD | 2026-10-31 |
| CVE-2026-111592 | The Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors plugin for WordPress is vu | MEDIUM | 6.4 | 9%ile | NVD | 2026-10-31 |
| CVE-2026-116535 | The SEOPress – AI SEO Plugin & On-site SEO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'di | MEDIUM | 6.4 | 14%ile | NVD | 2026-10-31 |
| CVE-2026-119160 | The Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News plugin for WordPress is vulnerab | MEDIUM | 6.4 | 14%ile | NVD | 2026-10-31 |
| CVE-2026-107711 | The FlexStock – Product Stock Sync with Google Sheets for WooCommerce plugin for WordPress is vulnerable to Stored Cross | MEDIUM | 6.4 | 28%ile | NVD | 2026-10-31 |
| CVE-2026-116752 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to | MEDIUM | 6.4 | 26%ile | NVD | 2026-10-31 |
| CVE-2026-96554 | The BuddyBoss Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Name in all versions | MEDIUM | 6.4 | 10%ile | NVD | 2026-10-31 |
| CVE-2026-61673 | WeGIA is a web manager for charitable institutions. Prior to 3.8.7, a stored DOM cross-site scripting vulnerability in ` | MEDIUM | 6.3 | 27%ile | NVD | 2026-10-29 |
| CVE-2026-112353 | GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webma | MEDIUM | 6.2 | 16%ile | NVD | 2026-10-27 |
| CVE-2026-33520 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allo | MEDIUM | 6.1 | 17%ile | NVD | 2026-10-26 |
| CVE-2026-50095 | There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some co | MEDIUM | 6.1 | 17%ile | NVD | 2026-10-26 |
| CVE-2026-50096 | There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allo | MEDIUM | 6.1 | 17%ile | NVD | 2026-10-26 |
| CVE-2026-105323 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software and | MEDIUM | 6.1 | 8%ile | NVD | 2026-10-27 |
| CVE-2026-92098 | The Webheadcoder Multi-Step Forms for Contact Form 7 plugin for WordPress is vulnerable to Reflected Cross-Site Scriptin | MEDIUM | 6.1 | 12%ile | NVD | 2026-10-28 |
| CVE-2026-101935 | The Echo Knowledge Base – Documentation, FAQs, Chat & Smart Search plugin for WordPress is vulnerable to Reflected Cross | MEDIUM | 6.1 | 17%ile | NVD | 2026-10-28 |
| CVE-2026-117621 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace brow | MEDIUM | 6.1 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-117622 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler HttpRespons | MEDIUM | 6.1 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-118652 | Echo is a Go web framework. Prior to 4.16.0 and 5.4.0, Context.JSONP and Context.JSONPBlob concatenate an unvalidated ca | MEDIUM | 6.1 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-11854 | The authentication endpoint generates an error message that includes reflected data directly from the request without su | MEDIUM | 6.1 | 12%ile | NVD | 2026-10-28 |
| CVE-2026-61573 | AVideo is a video-sharing Platform. Prior to 8.1.0, the anonymous login interface reflects request values into HTML and | MEDIUM | 6.1 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-91152 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulne | MEDIUM | 6.1 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-114538 | Bootstrap - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-236 | MEDIUM | 6.1 | 5%ile | Microsoft | 2026-10-13 |
| CVE-2026-37468 | Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary | MEDIUM | 6.1 | 11%ile | NVD | 2026-10-30 |
| CVE-2026-111109 | The Webmention plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Open Graph og:title meta tag of | MEDIUM | 6.1 | 20%ile | NVD | 2026-10-31 |
| CVE-2026-88942 | The Product Filter for WooCommerce by WBW plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'wpf_ | MEDIUM | 6.1 | 19%ile | NVD | 2026-10-31 |
| CVE-2026-103962 | The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post | MEDIUM | 6.1 | 12%ile | NVD | 2026-10-31 |
| CVE-2026-100151 | The Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress is v | MEDIUM | 6.1 | 14%ile | NVD | 2026-10-31 |
| CVE-2026-104926 | The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ' | MEDIUM | 6.1 | 19%ile | NVD | 2026-10-31 |
| CVE-2026-2102 | wrensec-commons contains a reflected cross-site scripting (XSS) vulnerability in the CREST framework's HTTP binding. The | MEDIUM | 6.1 | — | NVD | 2026-11-02 |
| CVE-2026-102329 | Chromium CVE-2026-102329: Cross-site scripting | MEDIUM | 6.1 | 7%ile | Microsoft | 2026-10-13 |
| CVE-2026-50571 | WebSub is a W3C recommendation produced by the Social Web Working Group. In recommendation REC-websub-20180123, the inte | MEDIUM | 5.7 | 14%ile | NVD | 2026-10-27 |
| CVE-2026-87099 | Cross-site scripting (XSS) vulnerability due to improper input validation. The following products are affected: Acronis | MEDIUM | 5.7 | 15%ile | NVD | 2026-10-28 |
| CVE-2026-100175 | The Postie plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Email Body URL Autolink in all versions | MEDIUM | 5.4 | 26%ile | NVD | 2026-10-28 |
| CVE-2026-116761 | The CMB2 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cmb43ex1_grp[0][txt] (wysiwyg field | MEDIUM | 5.4 | 13%ile | NVD | 2026-10-28 |
| CVE-2026-16020 | Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fazile BACAK Defte | MEDIUM | 5.4 | 3%ile | NVD | 2026-10-28 |
| CVE-2026-117613 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization, al | MEDIUM | 5.4 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-117623 | Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar over | MEDIUM | 5.4 | 8%ile | NVD | 2026-10-28 |
| CVE-2026-103485 | The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feat | MEDIUM | 5.4 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-107627 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scr | MEDIUM | 5.4 | 26%ile | NVD | 2026-10-29 |
| CVE-2026-107629 | The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scr | MEDIUM | 5.4 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-111318 | The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM | MEDIUM | 5.4 | 20%ile | NVD | 2026-10-29 |
| CVE-2026-116763 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all | MEDIUM | 5.4 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-107252 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax: La | MEDIUM | 5.4 | 4%ile | NVD | 2026-10-30 |
| CVE-2026-107265 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet all | MEDIUM | 5.4 | 8%ile | NVD | 2026-10-30 |
| CVE-2026-109984 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' param | MEDIUM | 5.4 | 34%ile | NVD | 2026-10-30 |
| CVE-2026-110001 | The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment (short | MEDIUM | 5.4 | 28%ile | NVD | 2026-10-30 |
| CVE-2026-116563 | The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Stored DOM-Based | MEDIUM | 5.4 | 29%ile | NVD | 2026-10-31 |
| CVE-2026-120019 | The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all | MEDIUM | 5.4 | 13%ile | NVD | 2026-10-31 |
| CVE-2026-111070 | The Content Pilot – Autoblogging & Affiliate Marketing Suite plugin for WordPress is vulnerable to Stored Cross-Site Scr | MEDIUM | 5.4 | 13%ile | NVD | 2026-10-31 |
| CVE-2025-49745 | Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability | MEDIUM | 5.4 | 48%ile | Microsoft | 2025-08-12 |
| CVE-2026-116583 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. F | MEDIUM | 5.3 | 19%ile | NVD | 2026-10-26 |
| CVE-2026-116823 | YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to in | MEDIUM | 5.3 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116824 | YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in handlers/page/referrers_sites.php that allo | MEDIUM | 5.3 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116874 | SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti | MEDIUM | 5.3 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116875 | SemanticMediaWiki from 3.0.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in Special:Ask, which | MEDIUM | 5.3 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116881 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a cross-site scripting vulnerability that allows attackers to inject | MEDIUM | 5.3 | 5%ile | NVD | 2026-10-27 |
| CVE-2026-116884 | SemanticMediaWiki from 5.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability in ext.smw.tooltip.tippy. | MEDIUM | 5.3 | 5%ile | NVD | 2026-10-27 |
| CVE-2026-116885 | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability in the Special:SMWAdm | MEDIUM | 5.3 | 8%ile | NVD | 2026-10-27 |
| CVE-2026-116886 | Semantic MediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with p | MEDIUM | 5.3 | 3%ile | NVD | 2026-10-27 |
| CVE-2026-116887 | Semantic MediaWiki from 3.0.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with p | MEDIUM | 5.3 | 3%ile | NVD | 2026-10-27 |
| CVE-2026-116889 | SemanticMediaWiki from 2.5.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with pa | MEDIUM | 5.3 | 5%ile | NVD | 2026-10-27 |
| CVE-2026-116892 | SemanticMediaWiki from 3.1.0 before 7.3.1 contains a reflected cross-site scripting vulnerability that allows unauthenti | MEDIUM | 5.3 | 11%ile | NVD | 2026-10-27 |
| CVE-2026-66911 | Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachments. Due | MEDIUM | 5.3 | 46%ile | NVD | 2026-10-29 |
| CVE-2026-66912 | Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in Cla | MEDIUM | 5.3 | 40%ile | NVD | 2026-10-29 |
| CVE-2026-105454 | RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the link. A | MEDIUM | 5.3 | 38%ile | NVD | 2026-10-30 |
| CVE-2026-105455 | RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an inciden | MEDIUM | 5.3 | 35%ile | NVD | 2026-10-30 |
| CVE-2026-105456 | RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link tha | MEDIUM | 5.3 | 39%ile | NVD | 2026-10-30 |
| CVE-2026-119761 | Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows un | MEDIUM | 5.3 | 25%ile | NVD | 2026-10-30 |
| CVE-2026-117645 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in phoenixframework p | MEDIUM | 5.3 | 24%ile | NVD | 2026-10-30 |
| CVE-2026-105601 | Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5 | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-120500 | An Otter Wiki before 2.26.2 contains a stored cross-site scripting vulnerability in OtterwikiMdRenderer.block_code that | MEDIUM | 5.3 | — | NVD | 2026-11-02 |
| CVE-2026-70382 | Some externally supplied values stored by the device may be rendered in the web interface without sufficient output enco | MEDIUM | 5.1 | 17%ile | NVD | 2026-10-26 |
| CVE-2026-116802 | DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL attribute | MEDIUM | 5.1 | 12%ile | NVD | 2026-10-27 |
| CVE-2026-116803 | DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers armed | MEDIUM | 5.1 | 6%ile | NVD | 2026-10-27 |
| CVE-2026-116804 | DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template expression | MEDIUM | 5.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116891 | SemanticMediaWiki from 4.2.0 before 7.2.1 contains a reflected cross-site scripting vulnerability that allows unauthenti | MEDIUM | 5.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-116900 | REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by | MEDIUM | 5.1 | 3%ile | NVD | 2026-10-27 |
| CVE-2026-117535 | REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, wher | MEDIUM | 5.1 | 10%ile | NVD | 2026-10-27 |
| CVE-2026-117539 | darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow att | MEDIUM | 5.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-105987 | KGS Software tia Viewer is vulnerable to Stored XSS via the annotation API. Due to the lack of input validation, an auth | MEDIUM | 5.1 | 15%ile | NVD | 2026-10-27 |
| CVE-2026-112356 | GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail comp | MEDIUM | 5.1 | 16%ile | NVD | 2026-10-28 |
| CVE-2026-7190 | A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environment. The vulnera | MEDIUM | 5.1 | 27%ile | NVD | 2026-10-29 |
| CVE-2026-113689 | Stored cross-site scripting in the SmartIT work-notes feature of BMC IT Service Management Suite versions 25.3.01, 25.4. | MEDIUM | 5.1 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-113691 | Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions 25.3.01 | MEDIUM | 5.1 | 38%ile | NVD | 2026-10-29 |
| CVE-2026-119054 | Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Cont | MEDIUM | 5.1 | 13%ile | NVD | 2026-10-29 |
| CVE-2025-68395 | ARKETEAM Protectel modules PROTECTELMAJ and BDF contain a note editor module vulnerable to Stored XSS. A low privileged | MEDIUM | 5.1 | 16%ile | NVD | 2026-10-30 |
| CVE-2026-119563 | phpMyAdmin through 5.2.3 contains a stored cross-site scripting vulnerability that allows database users with CREATE pri | MEDIUM | 5.1 | 6%ile | NVD | 2026-10-30 |
| CVE-2015-20130 | Netsweeper before 4.0.11 and 4.1.0 before 4.1.5 contains a reflected cross-site scripting vulnerability in webadmin/repo | MEDIUM | 5.1 | 22%ile | NVD | 2026-10-30 |
| CVE-2026-39375 | Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version | MEDIUM | 5.1 | 28%ile | NVD | 2026-10-30 |
| CVE-2026-7004 | WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that allow | MEDIUM | 5.1 | 19%ile | NVD | 2026-10-30 |
| CVE-2026-120428 | PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated attacke | MEDIUM | 5.1 | — | NVD | 2026-11-02 |
| CVE-2026-120443 | GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to inje | MEDIUM | 5.1 | — | NVD | 2026-11-02 |
| CVE-2026-120488 | LaraDashboard before 1.4.9 contains a stored cross-site scripting vulnerability that allows authenticated users with pos | MEDIUM | 5.1 | — | NVD | 2026-11-02 |
| CVE-2026-120491 | Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client u | MEDIUM | 5.1 | — | NVD | 2026-11-02 |
| CVE-2026-118169 | The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Sc | MEDIUM | 4.9 | 9%ile | NVD | 2026-10-28 |
| CVE-2026-109216 | The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via th | MEDIUM | 4.9 | 14%ile | NVD | 2026-10-29 |
| CVE-2026-116882 | Semantic MediaWiki from 4.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticate | MEDIUM | 4.8 | 4%ile | NVD | 2026-10-27 |
| CVE-2026-116883 | Semantic MediaWiki from 3.1.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows authenticate | MEDIUM | 4.8 | 4%ile | NVD | 2026-10-27 |
| CVE-2026-116888 | SemanticMediaWiki from 3.2.0 before 7.3.1 contains a stored cross-site scripting vulnerability that allows users with th | MEDIUM | 4.8 | 4%ile | NVD | 2026-10-27 |
| CVE-2013-20009 | Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated attackers | MEDIUM | 4.8 | 13%ile | NVD | 2026-10-28 |
| CVE-2026-113409 | The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to store | MEDIUM | 4.8 | 9%ile | NVD | 2026-10-29 |
| CVE-2026-16889 | In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does not | MEDIUM | 4.8 | 24%ile | NVD | 2026-10-29 |
| CVE-2026-66092 | In openEQUELLA before 2026.2, the pre-login notice is stored as HTML and rendered on the legacy logon page without encod | MEDIUM | 4.8 | 26%ile | NVD | 2026-10-29 |
| CVE-2026-5697 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code | MEDIUM | 4.8 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-5698 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code | MEDIUM | 4.8 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-5699 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code | MEDIUM | 4.8 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-5700 | Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code | MEDIUM | 4.8 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-113690 | Stored cross-site scripting in the SmartIT attachment feature of BMC IT Service Management Suite versions 25.3.01, 25.4. | MEDIUM | 4.8 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-113695 | Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite version | MEDIUM | 4.8 | 28%ile | NVD | 2026-10-29 |
| CVE-2026-113697 | Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows authenticate | MEDIUM | 4.8 | 38%ile | NVD | 2026-10-29 |
| CVE-2025-12544 | The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role to | MEDIUM | 4.8 | — | NVD | 2026-11-02 |
| CVE-2026-116582 | Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities. P | MEDIUM | 4.7 | 8%ile | NVD | 2026-10-26 |
| CVE-2026-61575 | AVideo is a video-sharing Platform. Prior to 8.1.0, `view/queue.php` uses `pathinfo` on the caller-controlled `fileURI` | MEDIUM | 4.7 | 7%ile | NVD | 2026-10-28 |
| CVE-2026-103875 | The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' | MEDIUM | 4.7 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-110707 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is | MEDIUM | 4.7 | 23%ile | NVD | 2026-10-29 |
| CVE-2026-115277 | The User Frontend WordPress plugin before 4.3.14 does not sanitise and escape some user-supplied values before reflecti | MEDIUM | 4.7 | 7%ile | NVD | 2026-10-30 |
| CVE-2026-48164 | Collabora Online is a collaborative online office suite based on LibreOffice technology. Prior to 24.04.18 and 25.04.11, | MEDIUM | 4.7 | 26%ile | NVD | 2026-10-30 |
| CVE-2026-116552 | The Like Button Rating ♥ LikeBtn plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_CLIENT_ | MEDIUM | 4.7 | 24%ile | NVD | 2026-10-30 |
| CVE-2026-120248 | Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office administr | MEDIUM | 4.6 | 15%ile | NVD | 2026-11-01 |
| CVE-2024-7075 | The user search function within the management console fails to properly encode user-supplied input before rendering it | MEDIUM | 4.6 | — | NVD | 2026-11-02 |
| CVE-2026-109988 | The Product Addons for Woocommerce – Product Options with Custom Fields plugin for WordPress is vulnerable to Stored Cro | MEDIUM | 4.4 | 11%ile | NVD | 2026-10-28 |
| CVE-2026-111068 | The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all ver | MEDIUM | 4.4 | 12%ile | NVD | 2026-10-28 |
| CVE-2026-107306 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link A | LOW | 3.8 | 9%ile | NVD | 2026-10-30 |
| CVE-2024-3586 | The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high | LOW | 3.5 | 7%ile | NVD | 2026-10-29 |
| CVE-2026-105258 | The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings | LOW | 3.5 | 7%ile | NVD | 2026-10-29 |
| CVE-2026-114555 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Data field | LOW | 3.5 | 8%ile | NVD | 2026-10-30 |
| CVE-2026-116687 | CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture. From 29.0.0 until 47.7.4 and 48.5.1, specia | LOW | 3.1 | 17%ile | NVD | 2026-10-27 |
| CVE-2026-107308 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country all | LOW | 3.1 | 4%ile | NVD | 2026-10-30 |
| CVE-2026-57196 | Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 2 | LOW | 2.3 | 56%ile | NVD | 2026-10-26 |
| CVE-2026-116514 | A weakness has been identified in itsourcecode Airline Reservation System 1.0. This affects an unknown part of the file | LOW | 2.1 | 28%ile | NVD | 2026-10-26 |
| CVE-2026-117533 | REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves up | LOW | 2.1 | 2%ile | NVD | 2026-10-27 |
| CVE-2026-117537 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inje | LOW | 2.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-117538 | REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the func | LOW | 2.1 | 7%ile | NVD | 2026-10-27 |
| CVE-2026-118256 | Vue I18n is the internationalization plugin for Vue.js. From 9.0.0-beta.5 until 11.4.14 and 12.0.0-alpha.5, enabling esc | LOW | 2.1 | 41%ile | NVD | 2026-10-28 |
| CVE-2026-120339 | A security flaw has been discovered in mathurvishal CloudClassroom-PHP-Project. This vulnerability affects unknown code | LOW | 2.1 | — | NVD | 2026-11-02 |
| CVE-2026-120343 | A flaw has been found in mathurvishal CloudClassroom-PHP-Project. The impacted element is an unknown function of the fil | LOW | 2.1 | — | NVD | 2026-11-02 |
| CVE-2026-116385 | A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.0. This issue affects some u | LOW | 2.0 | 15%ile | NVD | 2026-10-26 |
| CVE-2026-116482 | A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a2 | LOW | 2.0 | 17%ile | NVD | 2026-10-26 |
| CVE-2026-116554 | A flaw has been found in Argilla up to 2.8.0. The affected element is the function Dataset.from_disk of the file argilla | LOW | 2.0 | 17%ile | NVD | 2026-10-26 |
| CVE-2026-116639 | A vulnerability was detected in MD-MAFUJUL-HASAN Online-Payroll-Management-System up to a8902bf64575e325f6d6bf93a55f7bd2 | LOW | 2.0 | 10%ile | NVD | 2026-10-27 |
| CVE-2026-116640 | A flaw has been found in Saruf-Ratul HR-Payroll-Management-System e7cd81477001afdee95b843fd4137894d9418c9f/3fd6f45ead9f8 | LOW | 2.0 | 10%ile | NVD | 2026-10-27 |
| CVE-2026-118585 | A vulnerability was identified in configuroweb inventariobasico c9377cdba474deb3eb5a0704d197b5733af16b47/f9db0c0a04d79ad | LOW | 2.0 | 10%ile | NVD | 2026-10-29 |
| CVE-2026-120190 | A security flaw has been discovered in PostyBirb Plus up to 3.1.75. Affected by this vulnerability is an unknown functio | LOW | 2.0 | 33%ile | NVD | 2026-11-01 |
| CVE-2026-120218 | A flaw has been found in Typemill up to 2.26.0. The impacted element is the function ControllerApiImage::saveImage of th | LOW | 2.0 | 17%ile | NVD | 2026-11-01 |
| CVE-2026-116555 | A vulnerability has been found in Argilla up to 2.8.0. The impacted element is an unknown function of the file argilla-f | LOW | 1.9 | 11%ile | NVD | 2026-10-26 |
| CVE-2026-116556 | A vulnerability was found in Argilla up to 2.8.0. This affects an unknown function of the file argilla-frontend/componen | LOW | 1.9 | 11%ile | NVD | 2026-10-26 |
| CVE-2026-120242 | A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1 | LOW | 1.9 | 10%ile | NVD | 2026-11-01 |
| CVE-2026-61448 | Parse Server vulnerable to stored XSS via malformed Content-Type bypassing file upload extension blocklist | LOW | — | 36%ile | GitHub | 2026-10-29 |
| CVE-2026-116627 | Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in Dev | UNKNOWN | — | 5%ile | NVD | 2026-10-27 |
| CVE-2026-107260 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector Dist | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-108514 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core | UNKNOWN | — | 9%ile | NVD | 2026-10-30 |
| CVE-2026-108515 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal core | UNKNOWN | — | 9%ile | NVD | 2026-10-30 |
| CVE-2026-110738 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin T | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114525 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal ABC allows | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114526 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Black Hole | UNKNOWN | — | 6%ile | NVD | 2026-10-30 |
| CVE-2026-114527 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons al | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114528 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Zero Point | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114529 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal CSV Field a | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114531 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Swiper form | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114532 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal UI Icons al | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114534 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Block Attri | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-114536 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal USWDS Parag | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-118545 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific | UNKNOWN | — | 6%ile | NVD | 2026-10-30 |
| CVE-2026-118546 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific | UNKNOWN | — | 6%ile | NVD | 2026-10-30 |
| CVE-2026-118549 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific | UNKNOWN | — | 6%ile | NVD | 2026-10-30 |
| CVE-2026-118552 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific | UNKNOWN | — | 6%ile | NVD | 2026-10-30 |
| CVE-2026-118553 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI (Artific | UNKNOWN | — | 6%ile | NVD | 2026-10-30 |
| CVE-2026-118560 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Commerce St | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-118575 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Signature p | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-118576 | Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Stage File | UNKNOWN | — | 5%ile | NVD | 2026-10-30 |
| CVE-2026-117182 | An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 all | UNKNOWN | — | 23%ile | NVD | 2026-10-30 |
| CVE-2026-78190 | WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing | UNKNOWN | — | 15%ile | NVD | 2026-10-31 |
| CVE-2026-113429 | Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that i | UNKNOWN | — | 6%ile | NVD | 2026-11-01 |
| CVE-2026-115897 | Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body | UNKNOWN | — | 24%ile | Microsoft | 2026-10-13 |
| CVE-2026-87632 | Chromium CVE-2026-87632: Cross-site scripting in SanitizerAPI | UNKNOWN | — | 19%ile | Microsoft | 2026-09-08 |
| FG-IR-26-149 | Cross-Site Scripting in Domain parameter | UNKNOWN | — | — | Fortinet | 2026-07-14 |
| FG-IR-26-150 | SSL-VPN Reflected XSS | UNKNOWN | — | — | Fortinet | 2026-07-14 |