Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
35,116 results · page 65 of 703
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47962 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47958 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47957 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47956 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47954 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47953 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47951 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47950 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47949 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47948 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-47947 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-47946 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47945 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47944 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47943 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47942 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47941 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47939 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused byCVE-2026-47936 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-47935 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-47640 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-47639 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-47638 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-47637 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-47636 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoCVE-2026-47631 · Email & office · Microsoft · reported by secure@microsoft.comHigh 8.1
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Exchange Server 2016 Cumulative Update 23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevateCVE-2026-45644 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Live Share Canvas SDK allows an authorized attacker to elevate privileges over a network.
- Product
- Microsoft Live Share Canvas SDK
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoCVE-2026-45500 · Email & office · Microsoft · reported by secure@microsoft.comMedium 6.1
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft Exchange Server 2016 Cumulative Update 23
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to performCVE-2026-45483 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Project Server allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-45481 · Email & office · Microsoft · reported by secure@microsoft.comHigh 7.3
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-45479 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-45468 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-45467 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-45465 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-45464 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoCVE-2026-45462 · Email & office · Microsoft · reported by secure@microsoft.comMedium 4.6
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-45453 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over CVE-2026-41098 · Computers, phones & browsers · Microsoft · reported by secure@microsoft.comHigh 8.4
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.
- Product
- Azure Stack Edge
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability.CVE-2026-34692 · Other software · Adobe · reported by AdobeMedium 5.4
Adobe Experience Manager versions 6.5.24, LTS SP1, 2026.04 and earlier are affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in that a victim must visit a crafted webpage. Scope is changed.
- Product
- Adobe Experience Manager as a Cloud Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform sCVE-2026-33113 · Email & office · Microsoft · reported by secure@microsoft.comMedium 5.4
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- Product
- Microsoft SharePoint Enterprise Server 2016
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Logseq is vulnerable to a stored cross-site scripting (XSS).CVE-2026-47900 · Other software · logseq · reported by cvd@cert.plMedium 4.6
Logseq is vulnerable to a stored cross-site scripting (XSS). A malicious plugin can include a JavaScript payload in the "name" field of its "package.json" file, which is rendered using "innerHTML" without proper sanitization, allowing the execution of arbitrary code in the privileged host context. While only version v0.10.15 was tested and confirmed as vulnerable, status of other versions is unknown since this issue was not addressed by a patch.
- Product
- logseq
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low pCVE-2026-41031 · Other software · Skilja GmbH · reported by info@cert.vde.comCritical 9.3
A Stored Cross-Site Scripting vulnerability in Vinna Process Monitor Version 4.0 Service Pack 1 (Build 63255) allows an authenticated remote attacker with low privileges to inject malicious JavaScript code into the application. This enables attackers to steal administrative access tokens and session credentials.
- Product
- Vinna Process Monitor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages: Stored Cross-Site ScriptingCVE-2026-8677 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Widget HTML Tag Settings in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit succeeds even for users without the unfiltered_html capability because the payload (e.g., 'img src=x onerror=alert(document.domain)') contains no HTML angle brackets and therefore passes through Elementor's wp_kses_post() filter unchanged at save time.
- Product
- Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages
- Affected
- up to 1.3.3
- What to do
- Affects up to 1.3.3. Update Prime Elementor Addons – Lightweight Elementor Widgets for Faster Pages to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails: Stored Cross-Site ScriptingCVE-2026-8599 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Campaign HTML Content Field in all versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The public-facing campaign preview endpoint (/mp-email/{id}-slug/) is not affected by this vulnerability, as it applies a Content-Security-Policy header blocking all inline scripts; exploitation is limited to the admin dashboard preview.
- Product
- MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails
- Affected
- up to 2.0.4
- What to do
- Affects up to 2.0.4. Update MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions.CVE-2026-41539 · Network & remote access · QNAP Systems Inc. · reported by security@qnapsecurity.com.twMedium 6.3
A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. The remote attackers can then exploit the vulnerability to bypass security mechanisms or read application data. We have already fixed the vulnerability in the following versions: QTS 5.2.9.3492 build 20260507 and later QuTS hero h5.2.9.3499 build 20260514 and later QuTS hero h5.3.4.3500 build 20260520 and later QuTS hero h6.0.0.3500 build 20260520 and later
- Product
- QTS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 9, 2026WP GDPR Cookie Consent: Stored Cross-Site ScriptingCVE-2026-8977 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP GDPR Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ninja_gdpr_ajax_actions' AJAX action in versions up to, and including, 1.0.0. This is due to missing capability and nonce checks on the handleAjaxCalls() function, combined with insufficient input sanitization on the gdprConfig values and missing output escaping in the generateCSS() function which echoes stored configuration values directly into a <style> block rendered on wp_head. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP GDPR Cookie Consent
- Affected
- up to 1.0.0
- What to do
- Affects up to 1.0.0. Update WP GDPR Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026kk blog card: Stored Cross-Site ScriptingCVE-2026-8895 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The kk blog card plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'blog-card' shortcode in all versions up to, and including, 1.3. This is due to insufficient input sanitization and output escaping on the shortcode's 'href' and 'type' attributes, which are concatenated directly into HTML attribute contexts in the shortcode callback registered in kk-blog-card-shortcode.php. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- kk blog card
- Affected
- up to 1.3
- What to do
- Affects up to 1.3. Update kk blog card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026Global Body Mass Index Calculator: Stored Cross-Site ScriptingCVE-2026-8883 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Global Body Mass Index Calculator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gbmicalc' shortcode in versions up to, and including, 1.2. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the GBMI_Calc_Widget::widget() function. Shortcode attributes are extracted directly into local variables via @extract($args) and then echoed unescaped into an HTML style attribute (height/width) and HTML body context (title), allowing attribute-breakout payloads. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Global Body Mass Index Calculator
- Affected
- up to 1.2
- What to do
- Affects up to 1.2. Update Global Body Mass Index Calculator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026WP ApplicantStack Jobs Display: Stored Cross-Site ScriptingCVE-2026-8882 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP ApplicantStack Jobs Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- WP ApplicantStack Jobs Display
- Affected
- up to 1.1.1
- What to do
- Affects up to 1.1.1. Update WP ApplicantStack Jobs Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 9, 2026RomanCart Ecommerce: Stored Cross-Site ScriptingCVE-2026-8880 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The RomanCart Ecommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'blclass' attribute (and other attributes) of the romancart_button shortcode in versions up to, and including, 2.0.8. This is due to insufficient input sanitization and output escaping on user supplied attributes within the romancart_button_shortcode() function. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- RomanCart Ecommerce
- Affected
- up to 2.0.8
- What to do
- Affects up to 2.0.8. Update RomanCart Ecommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.