Skip to main content
COSMICBYTEZLABS
NewsSecurityHOWTOsToolsTraining
StudyProjectsNewsletterHire MeAbout
Subscribe

Press Enter to search or Esc to close

News
Security
HOWTOs
Tools
Training
Study
Projects
Newsletter
Hire Me
About
RSS Feed
Reading List
Subscribe

Stay in the Loop

Get the latest security alerts, tutorials, and tech insights delivered to your inbox.

Subscribe NowFree forever. No spam.
COSMICBYTEZLABS

Your trusted source for IT intelligence, cybersecurity insights, and hands-on technical guides.

2614+ Articles
162+ Guides

CONTENT

  • Latest News
  • Security Alerts
  • HOWTOs
  • Checklists
  • Projects
  • Exam Prep

RESOURCES

  • Search
  • Browse Tags
  • Newsletter Archive
  • Reading List
  • RSS Feed

COMPANY

  • About Us
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 CosmicBytez Labs. All rights reserved.

System Status: Operational
All tags
15 articles

#Stored XSS

All CosmicBytez Labs articles tagged #Stored XSS, across news, security advisories, how-to guides, and projects.

  • SecurityAug 18, 2026

    CVE-2026-74800: SiYuan Stored XSS via Asset Upload Enables Full Kernel API Access

    SiYuan before 3.7.4 fails to set Content-Disposition and X-Content-Type-Options headers, enabling stored XSS with full kernel API access.

  • SecurityAug 16, 2026

    CVE-2026-15002: Stored XSS in Autopay WooCommerce Plugin for WordPress

    CVE-2026-15002 is a stored XSS flaw (CVSS 7.2) in the Autopay WooCommerce plugin, letting attackers inject persistent scripts via the CSS editor POST parameter.

  • SecurityAug 16, 2026

    SiYuan Stored XSS via Database Menu Metadata (CVE-2026-73042)

    SiYuan before v3.7.4 fails to escape database menu metadata, enabling stored XSS in group, view, and field-edit menus. CVSS 9.0 Critical.

  • SecurityAug 16, 2026

    SiYuan Column Width API Stored XSS (CVE-2026-73044)

    SiYuan before v3.7.4 allows stored XSS via unescaped table column width values in style attributes. CVSS 9.0 Critical. Patch to v3.7.4.

  • SecurityAug 16, 2026

    SiYuan Stored XSS via Select Option Color Field (CVE-2026-73050)

    SiYuan before v3.7.4 fails to escape the color field in attribute-view select options, enabling stored XSS at eight render sites. CVSS 9.0.

  • SecurityJul 22, 2026

    CVE-2026-65048: Ninja Forms Unauthenticated Stored XSS via Repeatable Fieldset

    A CVSS 9.3 critical stored XSS vulnerability in the Ninja Forms WordPress plugin affects versions 3.10.4 through 3.14.9. The flaw requires no...

  • SecurityJul 20, 2026

    CVE-2026-10081: Unlimited Elements for Elementor Stored XSS via Google Reviews

    A stored cross-site scripting vulnerability in the Unlimited Elements for Elementor WordPress plugin (before 2.0.11) allows unauthenticated attackers to...

  • SecurityJul 11, 2026

    CVE-2026-55879: OpenReplay Stored XSS Enables Dashboard Account Takeover

    A critical stored XSS vulnerability in OpenReplay's session replay SDK allows unauthenticated attackers to inject malicious scripts via the public...

  • SecurityJul 10, 2026

    CVE-2026-2342: ValeApp Stored Cross-Site Scripting (CVSS 9.3)

    A critical stored XSS vulnerability in OceanicSoft's ValeApp allows attackers to inject persistent JavaScript payloads that execute in every victim's...

  • SecurityJun 4, 2026

    CVE-2026-36748: High-Severity Stored XSS in RockRMS via Social Media Profile Links

    RockRMS versions up to v16.13 are vulnerable to a CVSS 9.0 stored cross-site scripting flaw that allows attackers to inject malicious scripts through social…

  • SecurityMay 15, 2026

    CVE-2026-42457: vCluster Platform Stored XSS via templateRef Name Field

    A stored cross-site scripting vulnerability in vCluster Platform allows attackers to inject and execute arbitrary JavaScript via the name field of a...

  • SecurityMay 15, 2026

    CVE-2026-44212: PrestaShop Stored XSS in Customer Service

    A stored Cross-Site Scripting vulnerability (CVSS 9.3) in PrestaShop's back-office Customer Service view allows unauthenticated attackers to inject...

  • SecurityApr 24, 2026

    Hackage Haskell Repository Stored XSS Enables Credential

    A critical stored XSS vulnerability in hackage-server allows HTML and JavaScript files uploaded via source packages or documentation to execute in...

  • SecurityMar 16, 2026

    CVE-2015-20115: RealtyScript 4.0.2 Stored XSS via File

    CVE-2015-20115 is a stored cross-site scripting vulnerability in RealtyScript 4.0.2 that allows authenticated attackers to upload malicious script files...

  • SecurityMar 8, 2026

    CVE-2026-29192: ZITADEL Stored XSS via Default Redirect URI

    A stored cross-site scripting vulnerability in ZITADEL's login V2 interface allows organization administrators to inject malicious JavaScript via a...