#Stored XSS
All CosmicBytez Labs articles tagged #Stored XSS, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-107657: HivePress Directory Plugin Unauthenticated Stored XSS
An unauthenticated stored XSS in HivePress's custom profile attributes lets attackers inject scripts that fire on every visitor to an affected page.
- Security
CVE-2026-103305: Missing CSRF Checks in Prenotazioni Enable Unauthenticated Stored XSS
Prenotazioni ≤ 1.7.5 saves settings without authorization or CSRF checks and fails to escape output, enabling stored XSS attacks.
- News
Ninja Forms and WPC Product Bundles Flaws Exploited to Backdoor WordPress Sites
Attackers are chaining stored XSS bugs in Ninja Forms and WPC Product Bundles for WooCommerce to plant hidden admins and backdoors on 530,000+ sites.
- Security
CVE-2026-92977: Unauthenticated Stored XSS in Real Cookie Banner WordPress Plugin
Real Cookie Banner ≤5.3.5 lets unauthenticated attackers plant stored XSS via WordPress comments; CVSS 7.2. Patch to 5.3.6+ now.
- Security
CVE-2026-96270: Unauthenticated Stored XSS in Ultimate Member via form_id
Unauthenticated stored XSS in Ultimate Member (≤ 2.13.1) via form_id fires when admins open the Users page in wp-admin. Patched in 2.14.0.
- Security
CVE-2026-92244: Unauthenticated Stored XSS in WooCommerce PDF Invoices Plugin
High-severity stored XSS (CVSS 7.2) in PDF Invoices & Packing Slips for WooCommerce, 300K+ sites, triggered via guest checkout fields.
- Security
Unauthenticated Stored XSS in Download Manager Pro Subscription Form (CVE-2026-86609)
Download Manager Pro fails to sanitize its email-locked subscription form, letting unauthenticated attackers plant stored XSS against admins.
- Security
CVE-2026-56736: phpMyFAQ Stored XSS via Admin Review
Unauthenticated users can plant stored XSS in phpMyFAQ FAQ submissions that executes in an admin's browser on review, enabling session theft.
- Security
CVE-2026-17037: Kirki WordPress Plugin Unauthenticated Stored XSS
Unauthenticated Stored XSS in the Kirki WordPress plugin (≤ 6.2.0) via the comment parameter lets attackers inject persistent scripts. CVSS 7.2.
- Security
CVE-2026-74800: SiYuan Stored XSS via Asset Upload Enables Full Kernel API Access
SiYuan before 3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers, enabling stored XSS with full kernel API access.
- Security
CVE-2026-15002: Stored XSS in Autopay WooCommerce Plugin for WordPress
CVE-2026-15002 is a stored XSS flaw (CVSS 7.2) in the Autopay WooCommerce plugin, letting attackers inject persistent scripts via the CSS editor POST parameter.
- Security
SiYuan Stored XSS via Database Menu Metadata (CVE-2026-73042)
SiYuan before v3.7.4 fails to escape database menu metadata, enabling stored XSS in group, view, and field-edit menus. CVSS 9.0 Critical.
- Security
SiYuan Column Width API Stored XSS (CVE-2026-73044)
SiYuan before v3.7.4 allows stored XSS via unescaped table column width values in style attributes. CVSS 9.0 Critical. Patch to v3.7.4.
- Security
SiYuan Stored XSS via Select Option Color Field (CVE-2026-73050)
SiYuan before v3.7.4 fails to escape the color field in attribute-view select options, enabling stored XSS at eight render sites. CVSS 9.0.
- Security
CVE-2026-65048: Ninja Forms Unauthenticated Stored XSS via Repeatable Fieldset
A CVSS 9.3 critical stored XSS vulnerability in the Ninja Forms WordPress plugin affects versions 3.10.4 through 3.14.9. The flaw requires no...
- Security
CVE-2026-10081: Unlimited Elements for Elementor Stored XSS via Google Reviews
A stored cross-site scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin (before 2.0.11) allows unauthenticated attackers to...
- Security
CVE-2026-55879: OpenReplay Stored XSS Enables Dashboard Account Takeover
A critical stored XSS vulnerability in OpenReplay's session replay SDK allows unauthenticated attackers to inject malicious scripts via the public...
- Security
CVE-2026-2342: ValeApp Stored Cross-Site Scripting (CVSS 9.3)
A critical stored XSS vulnerability in OceanicSoft's ValeApp allows attackers to inject persistent JavaScript payloads that execute in every victim's...
- Security
CVE-2026-36748: High-Severity Stored XSS in RockRMS via Social Media Profile Links
RockRMS versions up to v16.13 are vulnerable to a CVSS 9.0 stored cross-site scripting flaw that allows attackers to inject malicious scripts through social…
- Security
CVE-2026-42457: vCluster Platform Stored XSS via templateRef Name Field
A stored cross-site scripting vulnerability in vCluster Platform allows attackers to inject and execute arbitrary JavaScript via the name field of a...
- Security
CVE-2026-44212: PrestaShop Stored XSS in Customer Service
A stored Cross-Site Scripting vulnerability (CVSS 9.3) in PrestaShop's back-office Customer Service view allows unauthenticated attackers to inject...
- Security
Hackage Haskell Repository Stored XSS Enables Credential
A critical stored XSS vulnerability in hackage-server allows HTML and JavaScript files uploaded via source packages or documentation to execute in...
- Security
CVE-2015-20115: RealtyScript 4.0.2 Stored XSS via File
CVE-2015-20115 is a stored cross-site scripting vulnerability in RealtyScript 4.0.2 that allows authenticated attackers to upload malicious script files...
- Security
CVE-2026-29192: ZITADEL Stored XSS via Default Redirect URI
A stored cross-site scripting vulnerability in ZITADEL's login V2 interface allows organization administrators to inject malicious JavaScript via a...