Stored-Xss

WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791) newCVE-2026-40791webHIGH 7.2Patched2026-07-05VvvebJs SVG Upload Stored Cross-Site Scripting — CVE-2026-5615 newCVE-2026-5615webHIGH 8.5Patched2026-07-05TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621) newCVE-2026-27621webMEDIUMPatched2026-07-05Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35) newCVE-2026-22804webHIGHPatched2026-07-05Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499) newCVE-2026-23499webHIGHPatched2026-07-05Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849) newCVE-2026-22849webHIGHPatched2026-07-05Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487) newCVE-2026-40487 / GHSA-44wg-r34q-hvfxwebHIGH 8.9Patched2026-07-05oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331) newCVE-2026-33331webHIGHPatched2026-07-05NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228) newCVE-2026-3228webMEDIUM 6.4Unverified2026-07-05Immich Stored XSS to API Key Exfiltration and Account Hijacking (CVE-2026-35455) newCVE-2026-35455webHIGHPatched2026-07-05EspoCRM 9.3.3 Stored HTML Injection in Email Notifications — CVE-2026-33657 newCVE-2026-33657webMEDIUMPatched2026-07-05ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600) newCVE-2026-2600webMEDIUM 6.4Patched2026-07-05Bookly Booking Form Cookie-Based Stored XSS — CVE-2026-5513 newCVE-2026-5513webHIGH 7.2Patched2026-07-05BentoPDF Stored XSS to File Exfiltration (CVE-2026-41653) newCVE-2026-41653webCRITICALPatched2026-07-05Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862 newCVE-2026-30862webCRITICAL 9.1Patched2026-07-05