CVE-2021-41184
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()
CVSS
6.5
Média
EPSS
40.8%
p99
KEV
—
Exploit Today
30
0-100
Publicado: 26 de out. de 2021 · Última mod.: 2 de nov. de 2026 · CWE-79
40.8%EPSS · 30 dias40.8%
2026-10-112026-11-08
jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the `of` option of the `.position()` util from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the `of` option is now treated as a CSS selector. A workaround is to not accept the value of the `of` option from untrusted sources.
- blog.jqueryui.comhttps://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
- github.comhttps://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
- github.comhttps://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NXIUUBRVLA4E7G7MMIKCEN75YN7UFERW/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O74SXYY7RGXREQDQUDQD4BPJ4QQTD2XQ/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGSY236PYSFYIEBRGDERLA7OSY6D7XL4/
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SNXA7XRKGINWSUIPIZ6ZBCTV6N3KSHES/
- security.netapp.comhttps://security.netapp.com/advisory/ntap-20211118-0004/
- www.drupal.orghttps://www.drupal.org/sa-core-2022-001
- www.oracle.comhttps://www.oracle.com/security-alerts/cpuapr2022.html
- www.oracle.comhttps://www.oracle.com/security-alerts/cpujul2022.html
- www.tenable.comhttps://www.tenable.com/security/tns-2022-09
- seclists.orghttp://seclists.org/fulldisclosure/2024/Aug/37
- blog.jqueryui.comhttps://blog.jqueryui.com/2021/10/jquery-ui-1-13-0-released/
- github.comhttps://github.com/jquery/jquery-ui/commit/effa323f1505f2ce7a324e4f429fa9032c72f280
- github.comhttps://github.com/jquery/jquery-ui/security/advisories/GHSA-gpqq-952q-5327
- lists.debian.orghttps://lists.debian.org/debian-lts-announce/2023/08/msg00040.html
- lists.fedoraproject.orghttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HVKIOWSXL2RF2ULNAP7PHESYCFSZIJE3/
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-1226736.5 MÉD—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine shopengine allows Stored XSS.This issue affects ShopEngine: from n/a through 4.9.8.3hCVE-2026-1208567.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway invoice-gateway-for-woocommerce allows Reflected XSS.This issue affects Invoice Gateway for WooCommerce – Invoice Payment Gateway: from n/a through 1.1.6.3hCVE-2026-112204——
———WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpoint. An attacker can prepare an URL that, when opened, results in arbitrary JavaScript execution in the victim's browser, allowing e.g session cookie theft.
This issue has been fixed in version 2.5.3hCVE-2026-123766——
———Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability in the OpenAPI module of Apache Axis2/Java. The Swagger UI page served by the OpenAPI module wrote a value derived from the request's Host header into the page without encoding, allowing script injection in the context of the Axis2 origin. This issue affects Apache Axis2/Java: 2.0.1. Users are recommended to upgrade to version 2.0.2, which fixes the issue.5hCVE-2026-1234767.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured Image from URL featured-image-from-url allows Stored XSS.This issue affects Featured Image from URL: from n/a through 6.1.4.5hCVE-2026-1234607.1 ALT—
———Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.2.5h