Catalog

Findings

Filter the merged record by severity, source, stack, and weakness type.

SearchSeveritySourceStackWeaknessSort

Known exploited only

Reset

Low2.1Concrete CMS version 9.0 to 9.5.0 is vulnerable to Stored XSS via page name in the Atomik theme.CVE-2026-8353 · concretecms · concrete cms · CVE.org · NIST NVDMay 22, 2026
Medium6.4The Draft List plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Draft Post Title in all versions up to, and including, 2.6.3 due to insufficient i…CVE-2026-9104 · CVE.org · NIST NVD · WordPressMay 22, 2026
Medium6.4The KIA Subtitle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode and attributes in all versions up to, and including, 4.0.1.CVE-2026-7509 · CVE.org · NIST NVD · WordPressMay 22, 2026
Medium6.1The CBX 5 Star Rating & Review plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 1.0.…CVE-2026-6864 · CVE.org · NIST NVD · WordPressMay 22, 2026
Medium6.1The WP Blockade plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'shortcode' parameter in all versions up to and including 0.9.14.CVE-2026-3481 · CVE.org · NIST NVD · WordPressMay 22, 2026
Low2.0Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via external-link page cvName because updateCollectionAliasExternal bypasses being sanitized.CVE-2026-8139 · concretecms · concrete cms · CVE.org · NIST NVDMay 21, 2026
Medium5.1Simple Hierarchical Select (SHS) for Drupal 7 contains cross-site scripting risk due to improper output escaping of term-derived text.CVE-2026-4929 · simple hierarchical select project · simple hierarchical select · CVE.org · NIST NVD · DrupalMay 21, 2026
Medium5.1In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline.CVE-2026-4093 · taxonomy term reference tree widget project · taxonomy term reference tree widget · CVE.org · NIST NVD · DrupalMay 21, 2026
Medium5.1Webmin before 2.641 contains a stored cross-site scripting vulnerability in the email template description field of the System and Server Status module that allows low…CVE-2026-22678 · webmin · webmin · CVE.org · FIRST EPSS · NIST NVDEPSS 0.2%May 21, 2026
High7.3Concrete CMS 9.5.0 and below has Stored XSS on the height parameter.CVE-2026-8203 · concretecms · concrete cms · CVE.org · NIST NVDMay 21, 2026
High7.3Concrete CMS 9.5.0 and below is vulnerable to Stored XSS via OAuth integration name.CVE-2026-8197 · concretecms · concrete cms · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ticketsmdb_import.php that allows authenticated attackers to inject arbitrar…CVE-2026-48230 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in routes_i.php that allows authenticated attackers to inject arbitrary JavaScr…CVE-2026-48229 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient_w.php that allows authenticated attackers to inject arbitrary JavaSc…CVE-2026-48228 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in patient.php that allows authenticated attackers to inject arbitrary JavaScri…CVE-2026-48227 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in os_watch.php that allows authenticated attackers to inject arbitrary JavaScr…CVE-2026-48226 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in landb.php that allows authenticated attackers to inject arbitrary JavaScript…CVE-2026-48225 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics214.php that allows authenticated attackers to inject arbitrary JavaScrip…CVE-2026-48224 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213rr.php that allows authenticated attackers to inject arbitrary JavaScr…CVE-2026-48223 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics213.php that allows authenticated attackers to inject arbitrary JavaScrip…CVE-2026-48222 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205a.php that allows authenticated attackers to inject arbitrary JavaScri…CVE-2026-48221 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics205.php that allows authenticated attackers to inject arbitrary JavaScrip…CVE-2026-48220 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in ics202.php that allows authenticated attackers to inject arbitrary JavaScrip…CVE-2026-48219 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in icons/buttons/landb.php that allows authenticated attackers to inject arbitr…CVE-2026-48218 · CVE.org · NIST NVDMay 21, 2026
Medium5.1Open ISES Tickets before 3.44.2 contains a reflected cross-site scripting vulnerability in delete_module.php that allows authenticated attackers to inject arbitrary Ja…CVE-2026-48217 · CVE.org · NIST NVDMay 21, 2026