CVE-2026-12380

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akıllı Ticaret Software Technologies Ltd. Co. E-Commerce Pack allows Reflected XSS. This issue affects E-Commerce Pack: through 2026-10-06. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-79

• https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-1256

Published

Oct 6, 2026

Last Modified

Oct 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12374Improper certificate validation and a time-of-check time-of-…6.4
• CVE-2026-12375The uncanny-automator-pro WordPress plugin before 7.3.0.6 wa…9.8
• CVE-2026-12376The Academy LMS WordPress plugin through 3.8.2 does not rest…4.3
• CVE-2026-12378The Appointment Booking Calendar Plugin and Scheduling Plugi…8.1
• CVE-2026-12379An Open Redirect vulnerability (CWE-601) exists in the OAuth…6.8
• CVE-2026-1238The SlimStat Analytics plugin for WordPress is vulnerable to…7.2
• CVE-2026-12382A flaw was found in the AAP Gateway Envoy proxy configuratio…8.2
• CVE-2026-12383A flaw was found in the Event-Driven Ansible (EDA) server. T…7.5
• CVE-2026-12384Authorization bypass through User-Controlled key vulnerabili…8.8
• CVE-2026-12385The Smart Slider 3 plugin for WordPress is vulnerable to Sen…4.3
• CVE-2026-12386Improper null termination vulnerability in TUBITAK BILGEM So…3.9
• CVE-2026-12387Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…5.1