What is stored cross-site scripting?
Stored Cross-Site Scripting (XSS)
Azərbaycanca: Saxlanılan saytlararası skript (Stored Cross-Site Scripting, XSS)
How it works
Stored XSS works by exploiting a vulnerability that allows malicious scripts to be stored on a web application and then served to users. This typically occurs due to improper sanitization of user inputs and/or lack of output encoding.
Defense checklist6
- 01
Sanitize and validate user inputs
- 02
Encode output
- 03
Regularly apply security updates
- 04
Use a web application firewall (WAF)
- 05
Conduct security audits and penetration testing
- 06
Follow secure coding practices
Real-world evidence
Vulnerabilities found in various WordPress plugins such as CVE-2026-47685 (FOG system), CVE-2026-15787 (Ultimate Addons for Elementor), CVE-2026-12421 (ARforms), CVE-2026-7232 (FormCraft), CVE-2026-7534 (SUMO Reward Points), CVE-2026-9635 (WP Shortcode by MyThemeShop), CVE-2026-9729 (Webpushr Push Notifications), CVE-2026-15404 (Lpagery), CVE-2026-15646 and CVE-2026-15647 (Brands for WooCommerce), CVE-2026-15394 (Header Footer Script Adder), and CVE-2026-14481 (Equalize Digital Accessibility Checker) are examples of this.
Sources
- CVE-2026-47685: FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Priornvd
- CVE-2026-15787: The Ultimate Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Sitenvd
- CVE-2026-12421: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'passwornvd
- CVE-2026-7232: The FormCraft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '[nvd
- CVE-2026-7534: The SUMO Reward Points plugin for WordPress is vulnerable to Unauthenticated Stored Cross-nvd
- CVE-2026-9635: The WP Shortcode by MyThemeShop plugin for WordPress is vulnerable to Stored Cross-Site Scnvd
- CVE-2026-9729: The Webpushr Push Notifications plugin for WordPress is vulnerable to Stored Cross-Site Scnvd
- CVE-2026-15404: The Lpagery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titnvd
- CVE-2026-15646: The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scriptinvd
- CVE-2026-15394: The Header Footer Script Adder – Insert Code in Header, Body & Footer plugin for WordPressnvd
- CVE-2026-15647: The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scriptinvd
- CVE-2026-14481: The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plunvd
Other attack types
See also6
This guide is AI-written from the real incident sources skopnix collected — the examples above are drawn from those cited items, nothing is invented.