Tag
#Stored XSS
CVE-2026-65048: Critical Unauthenticated Stored XSS in Ninja Forms WordPress Plugin
A critical vulnerability (CVE-2026-65048, CVSS 9.3) exists in the Ninja Forms plugin for WordPress versions 3.10.4 through 3.14.9, allowing unauthenticated stored cross-site scripting (XSS) attacks via the Repeatable Fieldset feature. An attacker can submit a crafted form with malicious script payloads, which execute in an administrator's browser when viewing submissions, enabling session-cookie theft, creation of administrator accounts, and arbitrary modification of site content. Immediate patching is recommended.
CVE-2026-35198: Critical Stored XSS Vulnerability in HeyForm
A critical stored cross-site scripting (XSS) vulnerability exists in HeyForm, an open-source form builder, prior to version 3.0.0-rc.7. A low-privileged team member can inject malicious JavaScript, leading to account takeover through privilege escalation when a team owner views the form. Update to version 3.0.0-rc.7 or later to mitigate.
CVE-2026-61875: Stored Cross-Site Scripting in luci-app-upnp via UPnP IGD AddPortMapping SOAP Requests
A stored cross-site scripting vulnerability exists in luci-app-upnp, allowing unauthenticated LAN clients to inject JavaScript via UPnP IGD AddPortMapping SOAP requests. This vulnerability has a CVSS score of 8.8 and is considered high severity. Affected users should update luci-app-upnp to the latest version.
Understanding and Defending Against Stored Cross-Site Scripting (XSS) Vulnerabilities: A Deep Dive into CVE-2026-2342
This educational analysis delves into CVE-2026-2342, a stored cross-site scripting (XSS) vulnerability in OceanicSoft Informatics Systems Ltd.'s ValeApp. We will explore the root cause, attack surface, exploitation mechanics, real-world impact, and most importantly, defensive strategies to mitigate such threats.
Understanding and Defending Against Stored Cross-Site Scripting (XSS) in AVideo TopMenu Plugin
This educational analysis covers CVE-2026-56347, a stored cross-site scripting vulnerability in the AVideo TopMenu plugin through version 26.0. The vulnerability allows attackers to inject malicious JavaScript through unescaped menu item fields, potentially stealing session cookies or performing unauthorized actions on all site visitors. We will delve into the root cause, attack surface, exploitation mechanics, real-world impact, and defensive strategies.
Understanding and Mitigating Stored XSS in n8n's Chat Trigger Node
A stored XSS vulnerability was discovered in n8n's Chat Trigger Node, allowing authenticated users with workflow edit access to inject arbitrary JavaScript. This could lead to code execution with the privileges of a logged-in user. The vulnerability has been patched in several n8n versions.