CVE-2026-112199
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-wo
CVSS
6.5
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Oct 19, 2026 · Last modified: Oct 19, 2026 · CWE-79
Not enough EPSS history yet.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Wishlist yith-woocommerce-wishlist allows Stored XSS.This issue affects YITH WooCommerce Wishlist: from n/a through 4.18.1.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1128336.5 MED—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0.7hCVE-2026-182056.1 MED—
———Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS.
This issue affects Ticimax E-Commerce Platform: through 2026-09-02.8hCVE-2026-14933——
———Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part in the attacker's co-browsing session, via content of the co-browsed page that the agent's browser renders as HTML.
The JavaScript runs in the context and under the identity of the agent's session in the Agent Desk or the Single Conversation Desk.
Exploitation requires an agent to join an embedded co-browsing session with the attacker. Mobile co-apping isn't affected.10hCVE-2026-1135836.1 MED—
———Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.10hCVE-2026-1133834.3 MED—
———A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early about this disclosure but did not respond in any way.8hCVE-2026-1133554.8 MED—
———Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src attribute in render_embed_from_match, executing scripts for public visitors and stealing cw_conversation widget tokens.8h