Apache Sling XSS before 2.4.14 allows XSS via getStyleToken (CVE-2026-123765)
xssAPI.getStyleToken() accepts markup in unquoted URLs; Apache rates it low and fixes it in 2.4.14.
Stories per day · 30 days
7 RSS
Relatedperl5advisory3drupal3svg3account-takeover2apache2chatgpt2cloudflare2content-security-policy2drupal-core2openai2rce2sling2sql-injection2web-simple2woocommerce2wordpress2apache-answer1
92 stories, newest first · one card per story
Stories tagged #xss
Danbooru Flash XSS worm stole viewer IPs and hijacked accounts
The site was taken down in about six minutes; roughly 300 people ran the worm and seven got unused API keys.
Web::Simple before 0.037 fails to escape single quotes
An oss-security post says HTML::Tags output from the Perl module leaves single quotes unescaped.
Apache Axis2/Java 2.0.1 before 2.0.2 has XSS in OpenAPI module (CVE-2026-123766)
The Swagger UI page writes the Host header into the page without encoding
Apache Sling Engine CVE-2026-103863 bypasses include-protection mitigations
Content-Type, charset, and redirect changes from included components evade header enforcement in Sling Engine before 3.0.4.
SQL::Abstract and SQL::Abstract::Tree before 2.000001_04 for Perl allow SQL injection and XSS (CVE-2026-121007,…
Versions before 2.000001_04 allow SQL injection via where values in identifier position and XSS via unescaped SQL text and bind values.
Cisco Unified Communications Manager Faces Cross-Site Scripting Vulnerability
Unvalidated input in the web interface of Cisco Unified Communications Manager and SME could allow unauthenticated remote XSS attacks via crafted links.
ChatGPT share-link chain let attackers run script in signed-in sessions
OpenAI rated the issue P1, paid a $5,000 bounty, and blocked the cross-frame MathLive messages on both web frontends by October 26.
Multiple XSS vulnerabilities patched in WordPress plugins October 2026
Sucuri publishes October 2026 roundup of medium and high-risk flaws in Elementor, LiteSpeed Cache, and WooCommerce.
WebDyne for Perl has five CVEs including cookie and path traversal issues
WebDyne versions 2.014-3.022 for Perl issue insecure session cookies and allow path traversal in PSGI API.
ChatGPT share links executed JavaScript in signed-in sessions
Researchers read a private chat and sent it off-site; OpenAI fixed the P1 issue on October 26.
yarr RSS reader iframe check allows javascript: XSS
A whitelisted host after javascript:// can hide script that runs when a subscriber opens the malicious post.
Cloudflare Image Transformations chain bypasses CSP for XSS
Researchers combined an SVG sanitizer bug, Chromium cache behavior, and redirects; no CVE or wild exploitation is confirmed.
1
Researchers chain Cloudflare image flaws into a CSP-bypass XSS
A public write-up shows script execution via /cdn-cgi/image/ using an SVG namespace bug and a Chromium cache quirk.
18
Researcher bypasses six of eight popular SVG sanitizers
Namespace tricks, animated JavaScript URLs and XSLT data URLs execute script, including via a Firefox response header.
VertiGIS WebOrderSystem through 7.0.8.6 has multiple XSS flaws
SEC Consult lists CVE-2026-4950, CVE-2026-4951 and CVE-2026-4952; the fixed version is unknown.
Roundcube webmail fixes injection, XSS and SSRF flaws
Versions 1.6.20 and 1.7.5, released October 19, fix IMAP command injection via CRLF plus XSS and SSRF issues.
Drupal patches two critical RCE flaws and XSS bugs
Fixes are in Drupal 11.4.10, 11.3.19 and 10.6.19, plus Entity List 3.0.10; Field UI can be uninstalled.
1
CVE-2026-64944: Apache Answer: Stored XSS via unsanitized HTML in imported question content
Apache Answer through 2.0.2 stores imported question HTML unsanitized, enabling stored cross-site scripting.
Wordfence Intelligence Weekly WordPress Vulnerability Report (October 5, 2026 to October 11, 2026)
Wordfence logged 655 WordPress plugin and theme flaws last week, including core XSS and unauthenticated SQL injection.
USN-8933-1: RabbitMQ Server vulnerabilities
Ubuntu’s USN-8933-1 fixes RabbitMQ issues that could enable CSRF, XSS, and denial of service.
Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2026-015
Drupal core Link module XSS CVE-2026-108515 is moderately critical; 11.4.x should update to 11.4.10.
VU#157374: XSS vulnerability in Shopware 6 enables Admin Token Theft and RCE
CERT/CC warns a Shopware 6 stored XSS can steal admin tokens and enable code execution, with no patch.
GitLab patches a max-severity regex flaw alongside five high-severity bugs
GitLab patched unauthenticated CI/CD regex RCE CVE-2026-97229 (CVSS 10) and five high-severity flaws.
3