Xss

WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell") new EPSS 31%CVE-2026-64638webHIGH 8.9Unverified2026-08-09WordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594) newCVE-2026-0594webMEDIUMUnverified2026-07-05OWASP CoreRuleSet Multipart Charset WAF Bypass (CVE-2026-21876) new EPSS 14%CVE-2026-21876webCRITICALPatched2026-07-05oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331) newCVE-2026-33331webHIGHPatched2026-07-05OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415) newCVE-2026-24415webMEDIUMPatched2026-07-05NextScripts Social Networks Auto-Poster — WordPress Stored XSS (CVE-2026-3228) newCVE-2026-3228webMEDIUM 6.4Unverified2026-07-05Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406) newCVE-2026-4406webMEDIUM 6.1Patched2026-07-05BentoPDF Stored XSS to File Exfiltration (CVE-2026-41653) newCVE-2026-41653webCRITICALPatched2026-07-05FirefUXSS: Universal XSS in Firefox Focus for iOS via Redirect-Scheme Validation Race Condition new—webCRITICAL 9.3Unpatched2026-06-08Next.js CSP Nonce Cache-Poisoned XSS (CVE-2026-44581) newCVE-2026-44581webMEDIUM 4.7Patched2026-05-17Next.js beforeInteractive Script XSS (CVE-2026-44580) newCVE-2026-44580webMEDIUM 6.1Patched2026-05-17