Topic
A web vulnerability class where attackers inject malicious scripts into trusted sites, which then execute in victims' browsers to steal data or hijack sessions.
Telegram patched a stored XSS in Telegram Desktop's HTML chat export in July, after the flaw shipped in stable releases for about 28 months. No CVE or advisory came with the fix, so teams that track exposure by CVE ID had nothing to match against.
Reality
CVE-2026-93485 lets an anonymous WordPress comment run script in a logged-in admin's browser the moment the page loads, with no click required. The sanitizer that cleans the comment on save and the display filters that reformat it read a stray newline differently, and an admin who views it lends the script their plugin-install rights, enough to reach remote code execution.
Reality
CVE-2026-93485 was fixed on September 17 in WordPress 7.1.1. An anonymous comment plants a script, an administrator opens the page, and the script uploads a plugin carrying a web shell. Affected versions go back to 4.7.
Perspective Coverage
5 publishersReality
One actor is exploiting stored XSS flaws in two WordPress plugins, one installed on more than 500,000 sites, to plant backdoors and rogue administrator accounts. Patchstack says updating the plugins blocks further exploitation but will not clean a site that is already compromised.
Reality
CISA's Malcolm before v26.06.0 lets an attacker with no account run script in an analyst's session through one crafted link. Four other flaws in the same advisory need a login, and CISA's fix for all five is the September 2026 release.
Reality
Microsoft will allow only scripts from its own CDN domains during Entra ID browser sign-ins under a Content Security Policy enforced from mid-October 2026. Browser extensions and tools that inject code into the sign-in page will stop working as the rollout completes in late October.
Reality
Google's PageBreak agent confirmed over 500 XSS flaws in ordinary Google web apps and two in hundreds built on its hardened frameworks. The gap supports building defences into frameworks, and the agent that measured it had more inside access than an outside attacker would.
Reality
The release Zimbra rates High severity closes a command injection in SNMP monitoring plus four Classic Web Client scripting bugs. Sites that acted on the June advisory still have work queued.
Reality
ExPatch says Telegram Desktop wrote bot button text into HTML chat exports without escaping it from March 2024 until a July fix, and updating the app leaves every file the earlier builds wrote unchanged on disk.
Reality
GitHub patched CVE-2026-77987, a GitHub Enterprise Server flaw that let an unauthenticated attacker read instance secrets by timing notebook viewer responses. The secrets could yield remote code execution, and with private mode off the attack needed no login.
Reality
The strict-dynamic directive passes a script's trust to everything that script loads, and Ryan Chaplin of Raxis used that rule to get an XSS payload executing under a nonce-based policy that had blocked it.
Reality
CVE-2026-58113 sits in the /auth/ redirect flow of Siemens Teamcenter. The attacker needs no credentials and no more than a link an engineer loads, and Siemens has shipped fixed builds for four release branches.
Reality
A PortSwigger researcher turns a tag name into executed script by reading its lowercase copy from localName, a spot sanitizers and WAF signatures treat as inert. It reportedly works everywhere.
Reality
CVE-2026-71368 affects F-RevoCRM 7.3.0 through 8.0.3 and runs attacker script inside the CRM's own origin. JVN rates it Medium; the published remedy is a version bump.
Reality