Justinnealey Designsetgo vulnerabilities

• justin nealey designsetgo DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute CVE-2026-111068 4.4 MediumOctober 28, 2026