CVE-2026-78325
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to exe
CVSS
—
Sin CVSS
EPSS
0.1%
p2
KEV
—
Exploit Today
1
0-100
Publicado: 7 sept 2026 · Última mod.: 9 sept 2026 · CWE-79
0.1%EPSS · 30 días0.1%
2026-10-052026-11-02
Cross-site scripting in the Evernote and Google Keep note importers in Standard Notes for Android through 3.201.24 allows an attacker to execute arbitrary JavaScript in the application context when a victim imports a crafted .enex or Google Keep HTML file, leading to theft of encryption keys and note data, and arbitrary invocation of native device APIs.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1215886.1 MED—
———TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessing local projects and repository credentials.3hCVE-2026-1208436.5 MED—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.3hCVE-2026-1195216.5 MED—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Stored XSS.This issue affects Paid Member Subscriptions: from n/a through 3.1.3.3hCVE-2026-1141856.5 MED—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.3hCVE-2026-1215515.4 MED—
———PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.4hCVE-2026-1214476.1 MED—
———svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization by placing javascript: URLs in the animateTransform values attribute. Attackers can upload crafted SVG files whose animateTransform targets the href attribute, executing arbitrary JavaScript when Safari users click the link.5h