Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

35,098 results · page 12 of 702

Oct 14, 2026FV Player 8: Stored Cross-Site ScriptingCVE-2026-95807 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.
Product
FV Player 8
Affected
up to 8.1.7
What to do
Affects up to 8.1.7. Update FV Player 8 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com plugins.trac.wordpress.org
Oct 14, 2026Verified Reviews (Avis Vérifiés): Stored Cross-Site ScriptingCVE-2026-94377 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Verified Reviews (Avis Vérifiés) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The authentication bypass is possible because ntav_check_data() uses loose != comparisons for signature verification, allowing a JSON body with boolean true values for idWebsite and sign to pass all checks on any configured installation.
Product
Verified Reviews (Avis Vérifiés)
Affected
up to 2.4.6
What to do
Affects up to 2.4.6. Update Verified Reviews (Avis Vérifiés) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Cryptocurrency Donation Box – Bitcoin & Crypto Donations: Stored Cross-Site ScriptingCVE-2026-93885 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data_object Parameter in all versions up to, and including, 2.2.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable by unauthenticated attackers because the cdbbc_payment_verify AJAX action is registered under wp_ajax_nopriv_ and its only authentication gate — a nonce check — is bypassable, as the cdbbc_donation_box nonce is publicly exposed to anonymous visitors via the wallets_data JavaScript object emitted by the [crypto-donation-box] shortcode.
Product
Cryptocurrency Donation Box – Bitcoin & Crypto Donations
Affected
up to 2.2.13
What to do
Affects up to 2.2.13. Update Cryptocurrency Donation Box – Bitcoin & Crypto Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Contact Form DB for Enfold: Stored Cross-Site ScriptingCVE-2026-83592 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Contact Form DB for Enfold plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Contact Form Field Values in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is echoed unescaped both inside a title HTML attribute and in the table cell body in admin/ecf_index.php; base64 encoding and serialization of the stored values do not neutralize the malicious content.
Product
Contact Form DB for Enfold
Affected
up to 2.0.2
What to do
Affects up to 2.0.2. Update Contact Form DB for Enfold to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Document Gallery: Stored Cross-Site ScriptingCVE-2026-77114 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dg_thumber_webhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only the default state when WP_DEBUG is true; otherwise an administrator must manually enable it.
Product
Document Gallery
Affected
up to 5.1.1
What to do
Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Countdown Timer – Widget Countdown: Stored Cross-Site ScriptingCVE-2026-16495 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Countdown Timer – Widget Countdown plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect_url' Shortcode Attribute in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Countdown Timer – Widget Countdown
Affected
up to 3.0.1
What to do
Affects up to 3.0.1. Update Countdown Timer – Widget Countdown to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Oct 14, 2026Tutor LMS – eLearning and online course solution: Reflected Cross-Site ScriptingCVE-2026-100193 · WordPress plugins & themes · reported by WordfenceMedium 4.7
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted lesson page to have an empty nav-items array — a condition that occurs naturally when a lesson has no post content, no attachments, and comments are disabled or the viewer is not logged in — which bypasses the in_array() tab validation and allows the raw attacker-controlled value to reach the sink.
Product
Tutor LMS – eLearning and online course solution
Affected
up to 4.1.0
What to do
Affects up to 4.1.0. Update Tutor LMS – eLearning and online course solution to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026Directorist: AI-Powered Business Directory, Listings & Classified Ads: Stored Cross-Site ScriptingCVE-2026-100185 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the plugin grants the edit_at_biz_dirs and publish_at_biz_dirs capabilities to the subscriber role, allowing any subscriber-level user to submit and publish listings without moderation.
Product
Directorist: AI-Powered Business Directory, Listings & Classified Ads
Affected
up to 8.10.2.1
What to do
Affects up to 8.10.2.1. Update Directorist: AI-Powered Business Directory, Listings & Classified Ads to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 14, 2026NewStatPress: Stored Cross-Site ScriptingCVE-2026-100153 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY_STRING / REQUEST_URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has placed the [NewStatPress type="Top Pages"] shortcode on a publicly viewable page, and that the attacker's crafted URL accumulates enough hits to appear in the top-N ranking.
Product
NewStatPress
Affected
up to 1.4.5
What to do
Affects up to 1.4.5. Update NewStatPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026AnyComment: Stored Cross-Site ScriptingCVE-2026-103422 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The AnyComment plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'email' parameter in versions up to, and including, 0.3.6. This is due to insufficient input sanitization on the public /wp-json/anycomment/v1/subscribe REST endpoint and missing output escaping in AnyCommentSubscriptionsTable::column_default(), which returns the stored email verbatim into an HTML <td> when the subscription's user_ID does not resolve to an existing WP_User. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator accesses the AnyComment → Subscriptions admin page.
Product
AnyComment
Affected
up to 0.3.6
What to do
Affects up to 0.3.6. Update AnyComment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Booking Package: Stored Cross-Site ScriptingCVE-2026-103425 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Booking Package
Affected
up to 1.7.29
What to do
Affects up to 1.7.29. Update Booking Package to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by suCVE-2026-63171 · Other software · Omnispace · reported by VulnCheckMedium 5.1
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious script by submitting a crafted forum category description containing a double-quote character that breaks out of an HTML input value attribute. Attackers can exploit the HTMLPurifier configuration that preserves double-quotes to escape the attribute context and execute arbitrary script in the browser of users viewing the forum category.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attackerCVE-2026-63169 · Other software · Omnispace · reported by VulnCheckMedium 5.3
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to post messages containing attacker-controlled iframes through the messenger's HTMLPurifier SafeIframe branch. Attackers can craft a message with a malicious iframe that is stored and automatically rendered to other channel members, enabling zero-click drive-by downloads and framed JavaScript execution in recipients' browsers.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup CVE-2026-63168 · Other software · Omnispace · reported by VulnCheckMedium 5.1
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to persist unneutralized markup by submitting malicious values as two-dimensional POST arrays through the LDAP/person import flow, bypassing the paramsFilter() request parameter filter which failed to recurse into nested arrays. Attackers can inject arbitrary script code into a user profile that is later rendered to other users, resulting in execution of malicious scripts in victims' browsers.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submiCVE-2026-63157 · Other software · Omnispace · reported by VulnCheckMedium 5.1
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious scripts by submitting an unsanitized link address (adress) field that is echoed into an onclick event-handler attribute without neutralizing quotes. Attackers can store a crafted payload through the Links module that executes in the browser of any user viewing the links list, enabling session hijacking or further client-side compromise.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML atCVE-2026-63156 · Other software · Omnispace · reported by VulnCheckMedium 5.1
Omnispace Agora Project before 26.10.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject malicious HTML attributes by manipulating the visioUrl parameter, which was not routed through the URL-sanitizing branch of the parameter filter and was urldecoded after filtering. Attackers can craft a malicious URL containing the visioUrl parameter with an attribute breakout payload to execute arbitrary JavaScript in the victim's browser pre-authentication, with the issue fixed in version 26.10.0 via changes to app/Common/Req.php.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issCVE-2026-19810 · Other software · Broadcom · reported by secure@symantec.comMedium 5.4
Symantec Endpoint Detection and Response (SEDR) Console, prior to 4.13, may be susceptible to a Cross-Site Scripting (XSS) vulnerability, which is a type of issue whereby an attacker may attempt to inject malicious script that executes in the context of another user’s session, potentially resulting in unauthorized access to functionality or information normally restricted to that user.
Product
Symantec Endpoint Detection and Response
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.broadcom.com
Oct 13, 2026blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability.CVE-2026-104587 · Other software · reported by MITREMedium 5.4
blob42 gosuki through commit 6e2bf34 contains a Stored Cross-Site Scripting (XSS) vulnerability. The application uses text/template instead of html/template, failing to perform context-aware auto-escaping on the URL and DisplayURL fields of bookmarks in internal/webui/templates/bookmarks.html. An attacker can craft a malicious bookmark URL containing HTML attribute-breaking payloads that execute arbitrary JavaScript in the victim's browser context when rendered in the local web interface.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-83960 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager as a Cloud Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-83958 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager as a Cloud Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2026-83662 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
Product
Adobe Experience Manager as a Cloud Service
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by CVE-2026-63148 · Other software · Omnispace · reported by VulnCheckMedium 5.1
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject HTML/script markup by uploading a poll-response attachment with a malicious filename that bypasses the paramFilter sanitization applied to $_FILES. Attackers can submit a crafted filename that is stored and later rendered in components such as the dashboard controller (CtrlDashboard), executing arbitrary script in the browsers of users who view the affected page.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploadCVE-2026-63147 · Other software · Omnispace · reported by VulnCheckMedium 5.1
Omnispace Agora Project before 26.10.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject malicious script by uploading a file with HTML/script markup embedded in its filename, which bypasses the paramFilter since uploaded-file names arrive through $_FILES rather than $_GET/$_POST. Attackers can upload a file with a crafted name such as an SVG onload payload to have the unsanitized filename stored and later rendered to other users, resulting in script execution in their browsers.
Product
Agora Project
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com agora-project.net
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-48398 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability.CVE-2026-110082 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-110081 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110080 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110079 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110078 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110077 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110076 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110075 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-110074 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-110073 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-110037 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-109415 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-107682 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-107305 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-106633 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-106632 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious CVE-2026-106631 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vCVE-2026-106630 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vCVE-2026-106629 · Other software · Adobe · reported by AdobeCritical 9.3
Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-106628 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
Product
Adobe Experience Manager 6.5 LTS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record helpx.adobe.com
Oct 13, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-97783 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
Product
Microsoft SharePoint Enterprise Server 2016
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.CVE-2026-97782 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.8
Observable discrepancy in Microsoft Office SharePoint allows an authorized attacker to perform tampering over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a netwCVE-2026-96230 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.8
Improper neutralization of input during web page generation ('cross-site scripting') in ASP.NET Core allows an unauthorized attacker to execute code over a network.
Product
Microsoft Visual Studio 2022 version 17.14
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.CVE-2026-96044 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.8
No cwe for this issue in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Product
Microsoft SharePoint Server Subscription Edition
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record msrc.microsoft.com
Oct 13, 2026Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts iCVE-2026-92922 · Websites & servers · Adobe · reported by AdobeHigh 8.1
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com
Oct 13, 2026Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts inCVE-2026-92911 · Websites & servers · Adobe · reported by AdobeHigh 8.7
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
Product
Adobe Commerce
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record adobe.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.