tag
Stored-Xss
High
WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791)
CVE-2026-40791·
WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin)
patched
High
VvvebJs SVG Upload Stored Cross-Site Scripting — CVE-2026-5615
CVE-2026-5615·
VvvebJs (drag-and-drop website builder)
unpatched
Medium
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
CVE-2026-27621 (GHSA-xfvg-8v67-j7wp)·
TypiCMS Core (typicms/core)
patched
High
Termix Stored XSS via Malicious SVG Upload -> LFI / Session Hijack (CVE-2026-22804 / GHSA-m3cv-5hgp-hv35)
CVE-2026-22804 (GHSA-m3cv-5hgp-hv35)·
Termix (Electron-based SSH/terminal manager), File Manager component (FileViewer.tsx)
patched
High
Saleor Stored XSS via Unrestricted File Upload (CVE-2026-23499)
CVE-2026-23499·
Saleor (saleor/saleor)
patched
High
Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv)·
Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products)
unpatched
High
Postiz Arbitrary File Upload to Stored XSS / Account Takeover (CVE-2026-40487)
CVE-2026-40487 / GHSA-44wg-r34q-hvfx·
Postiz (open-source social media management platform, gitroomhq/postiz-app)
patched
High
oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)
CVE-2026-33331 (GHSA-7f6v-3gx7-27q8)·
middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts)
patched
Medium
NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228)
CVE-2026-3228·
NextScripts: Social Networks Auto-Poster (WordPress plugin)
unpatched
High
Immich Stored XSS to API Key Exfiltration and Account Hijacking (CVE-2026-35455)
CVE-2026-35455·
Immich (self-hosted photo/video management)
unpatched
Medium
EspoCRM 9.3.3 Stored HTML Injection in Email Notifications — CVE-2026-33657
CVE-2026-33657·
EspoCRM 9.3.3
patched
Medium
ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)
CVE-2026-2600·
ElementsKit Elementor Addons (WordPress plugin)
patched
High
Bookly Booking Form Cookie-Based Stored XSS — CVE-2026-5513
CVE-2026-5513·
Bookly — Online Scheduling and Appointment Booking System (WordPress plugin)
patched
Critical
BentoPDF Stored XSS to File Exfiltration (CVE-2026-41653)
CVE-2026-41653·
BentoPDF (self-hosted browser-side PDF toolbox)
patched
Critical
Appsmith Table Widget Stored XSS to Admin Account Takeover — CVE-2026-30862
CVE-2026-30862 (GHSA-5hw4-whxv-6794)·
Appsmith
patched