CVE-2026-107648 | High | 7.2 | 2026-10-16 | The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action (also function, plugin, post_t… |
CVE-2026-96768 | High | 7.2 | 2026-10-16 | The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1… |
CVE-2026-110703 | Medium | 6.4 | 2026-10-16 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'po… |
CVE-2026-107649 | Medium | 5.4 | 2026-10-16 | The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]' parameter in all versions up to, and incl… |
CVE-2026-93681 | Medium | 6.4 | 2026-10-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name Parameter in all versio… |
CVE-2026-109224 | High | 7.2 | 2026-10-16 | The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to… |
CVE-2026-104726 | Medium | 6.4 | 2026-10-16 | The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in all versions up to, and including, 1.34.2… |
CVE-2026-96870 | Medium | 6.4 | 2026-10-16 | The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in all… |
CVE-2026-87111 | High | 7.2 | 2026-10-16 | The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scr… |
CVE-2026-100108 | Medium | 6.4 | 2026-10-16 | The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing share_url)' parameter in all versions up t… |
CVE-2026-100106 | Medium | 6.4 | 2026-10-16 | The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchased_plan' parameter in all versio… |
CVE-2026-97640 | High | 7.2 | 2026-10-16 | The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored… |
CVE-2026-96339 | High | 7.1 | 2026-10-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue a… |
CVE-2026-111069 | Medium | 6.4 | 2026-10-16 | The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tw… |
CVE-2026-110701 | High | 7.2 | 2026-10-16 | The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, an… |
CVE-2026-110664 | Medium | 6.4 | 2026-10-16 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'note' parameter in all version… |
CVE-2026-110290 | Medium | 6.4 | 2026-10-16 | The WebberZone Top 10 — Popular Posts plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'other_attributes (parsed to inject instance_id… |
CVE-2026-110252 | Medium | 5.4 | 2026-10-16 | The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.9 This is due to the plugi… |
CVE-2026-109388 | Medium | 6.4 | 2026-10-16 | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message' parame… |
CVE-2026-109193 | High | 7.2 | 2026-10-16 | The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user at… |
CVE-2026-107768 | High | 7.2 | 2026-10-16 | The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' param… |
CVE-2026-96570 | High | 7.2 | 2026-10-16 | The Schema & Structured Data for WP & AMP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'saswp_review_text' parameter in all versio… |
CVE-2026-95809 | High | 7.2 | 2026-10-16 | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cros… |
CVE-2026-95686 | High | 7.2 | 2026-10-16 | The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cros… |
CVE-2026-89051 | High | 7.2 | 2026-10-16 | The WP Ghost (Hide My WP Ghost) – Security & Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'replaceHeadersAndTags' functio… |
CVE-2026-88963 | Medium | 6.1 | 2026-10-16 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirect_url' parameter in v… |
CVE-2026-111122 | High | 7.2 | 2026-10-16 | The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1… |
CVE-2026-110017 | Medium | 6.4 | 2026-10-16 | The Quick PayPal Payments: Payment Button & Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form' parameter in all versions up… |
CVE-2026-109513 | High | 7.2 | 2026-10-16 | The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for Word… |
CVE-2026-109232 | High | 7.2 | 2026-10-16 | The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<c… |
CVE-2026-107764 | High | 7.2 | 2026-10-16 | The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url (comment_author_url)' parameter in all versions up… |
CVE-2026-107748 | Medium | 6.4 | 2026-10-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-104000 | High | 7.2 | 2026-10-16 | The Simply Schedule Appointments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'status' parameter in all versions up to, and includ… |
CVE-2026-103999 | High | 7.2 | 2026-10-16 | The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5… |
CVE-2026-103480 | Medium | 6.4 | 2026-10-16 | The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' parameter… |
CVE-2026-100186 | High | 7.2 | 2026-10-16 | The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scriptin… |
CVE-2026-100158 | Medium | 6.4 | 2026-10-16 | The SQL Chart Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'X-axis column value ($value->$xarg_s from $wpdb->get_results()… |
CVE-2026-109998 | High | 7.2 | 2026-10-16 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to… |
CVE-2026-109512 | Medium | 6.4 | 2026-10-16 | The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.4 due to… |
CVE-2026-103481 | Medium | 6.1 | 2026-10-16 | The Gwolle Guestbook plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 5… |
CVE-2026-97339 | High | 7.2 | 2026-10-16 | The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker… |
CVE-2026-93535 | Medium | 6.4 | 2026-10-16 | The Dark Mode – Improve Accessibility with AI Powered Dark Theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'icon_light' Shortco… |
CVE-2026-77829 | Medium | 6.4 | 2026-10-16 | The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, an… |
CVE-2026-111442 | | | 2026-10-16 | Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 does not sufficiently validate uploaded SVG images to ensure they lack potentially dangerous SV… |
CVE-2026-109990 | High | 7.2 | 2026-10-16 | The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' pa… |
CVE-2026-109207 | High | 7.2 | 2026-10-16 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Script… |
CVE-2026-107758 | High | 7.2 | 2026-10-16 | The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1… |
CVE-2026-111284 | Medium | 5.4 | 2026-10-15 | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability in HolidayAction.php that allows authenticated users to inject scripts via unesca… |
CVE-2026-63430 | | | 2026-10-15 | ammonia is a Rust library for repairing and securing untrusted HTML. Prior to 3.3.2, 4.0.2, and 4.1.3, applications that explicitly allow the math tag, annotat… |
CVE-2026-55872 | High | 8.7 | 2026-10-15 | GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php render… |
CVE-2026-111233 | Medium | 4.7 | 2026-10-15 | Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewall_rules.php that allows remote attackers to inject scr… |
CVE-2026-111232 | Medium | 4.8 | 2026-10-15 | Netgate pfSense CE 2.3.0 through 2.9.0 contains a stored cross-site scripting vulnerability that allows authenticated users with Firewall: Rules or NAT: Port F… |
CVE-2026-111168 | Medium | 5.4 | 2026-10-15 | LibreDesk before 2.9.0-rc.8 contains a stored cross-site scripting vulnerability that allows authenticated agents to execute script by uploading SVGs with malf… |
CVE-2026-110878 | Medium | 5.4 | 2026-10-15 | Aureus ERP through 1.6.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts via unescaped Operation Type an… |
CVE-2026-110375 | Medium | 6.5 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Download Monitor download-monitor allows Stored… |
CVE-2026-109893 | Medium | 6.5 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Presto Player presto-player allows Store… |
CVE-2026-109131 | Medium | 5.4 | 2026-10-15 | The Hub collection module documentation renderer in the unified Ansible Automation Platform UI (built from upstream ansible-ui, frontend/hub) renders a documen… |
CVE-2026-106604 | Medium | 6.5 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare al… |
CVE-2026-104828 | High | 7.2 | 2026-10-15 | HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encodi… |
CVE-2026-55876 | Low | 3.5 | 2026-10-15 | Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated… |
CVE-2026-110890 | Medium | 6.5 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Store… |
CVE-2026-108175 | Medium | 6.5 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter… |
CVE-2026-106707 | Medium | 5.4 | 2026-10-15 | XXL-JOB <=3.5.0-SNAPSHOT contains a stored Cross-Site Scripting (XSS) vulnerability in the job log list page (/joblog). An authenticated user who holds permiss… |
CVE-2026-57568 | | | 2026-10-15 | Lychee is a free, open-source photo-management tool. Prior to 7.6.0, Lychee permits an authenticated user with album-edit permissions to store a javascript URI… |
CVE-2026-105065 | High | 7.1 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue… |
CVE-2026-97667 | | | 2026-10-15 | Sonatype Nexus Repository 3 allows a user account that holds the edit permission on a hosted R repository to store script content in the metadata of an uploade… |
CVE-2026-58394 | Medium | 5.2 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, src/www/system_advanced_admin.php reads certificate records into $a_cert b… |
CVE-2026-58392 | Medium | 5.4 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the NTP GPS page stores the operator-supplied initcmd value in base64 form… |
CVE-2026-58391 | Medium | 5.4 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, Firewall Rules and NAT views place stored category names and alias descrip… |
CVE-2026-58390 | High | 8.0 | 2026-10-15 | OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widg… |
CVE-2026-111096 | Medium | 6.7 | 2026-10-15 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic build log was possible |
CVE-2026-111095 | High | 8.0 | 2026-10-15 | In JetBrains TeamCity before 2026.2,
2026.1.4,
2025.11.8 stored XSS in the classic project overview was possible |
CVE-2026-59994 | Medium | 4.3 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email to a monitored gro… |
CVE-2026-55184 | Low | 3.5 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, a user with Email Template or PDF Template edit permission can store cr… |
CVE-2026-53575 | Low | 2.7 | 2026-10-15 | EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an authenticated administrator can place crafted content in the applica… |
CVE-2026-106153 | Medium | 5.4 | 2026-10-15 | In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title witho… |
CVE-2026-106150 | Medium | 5.4 | 2026-10-15 | In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting… |
CVE-2026-109702 | High | 7.1 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in maxfoundry Social Share Buttons share-button allows Store… |
CVE-2026-109685 | High | 7.1 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Re… |
CVE-2026-105882 | Medium | 6.5 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill User Registration user-registration allows Sto… |
CVE-2026-108498 | High | 7.1 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored X… |
CVE-2026-108491 | High | 7.1 | 2026-10-15 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms Everest Forms everest-forms allows Stored X… |
CVE-2026-47790 | | | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect QuFTP Service. If a remote attacker gains a user account, they can then exploit the vuln… |
CVE-2026-39991 | | | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect Notes Station 3. If a remote attacker gains a user account, they can then exploit the vu… |
CVE-2026-74920 | High | 7.1 | 2026-10-15 | The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the respo… |
CVE-2026-22896 | | | 2026-10-15 | A cross-site scripting (XSS) vulnerability has been reported to affect Network & Virtual Switch. If a remote attacker gains an administrator account, they can… |
CVE-2026-88043 | High | 7.2 | 2026-10-15 | The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 d… |
CVE-2026-78087 | Medium | 6.4 | 2026-10-15 | The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.12… |
CVE-2026-78001 | Medium | 6.4 | 2026-10-15 | The Post and Page Builder by BoldGrid – Visual Drag and Drop Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Table Designer 'd… |
CVE-2026-18586 | High | 7.2 | 2026-10-15 | The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in al… |
CVE-2026-18557 | Medium | 6.1 | 2026-10-15 | The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in al… |
CVE-2026-18548 | High | 7.2 | 2026-10-15 | The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all ve… |
CVE-2026-17001 | Medium | 6.4 | 2026-10-15 | The Import and export users and customers plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Column User Meta Profile Fields in all v… |
CVE-2026-15180 | Medium | 6.1 | 2026-10-15 | The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, an… |
CVE-2026-14572 | Medium | 6.4 | 2026-10-15 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Page Builder Text Content… |
CVE-2026-110849 | | | 2026-10-14 | n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an un… |
CVE-2026-110847 | | | 2026-10-14 | n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains a stored cross-site scripting vulnerability in the Chat Trigger hosted-chat page, whe… |
CVE-2026-69194 | Medium | 4.8 | 2026-10-14 | FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.21.0, FileRise returns the stored branding.f… |
CVE-2026-0316 | | | 2026-10-14 | A stored cross-site scripting (XSS) vulnerability in Palo Alto Networks PAN-OS® software enables a malicious authenticated administrator to store or execute a… |
CVE-2026-54701 | | | 2026-10-14 | Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, Markdown Preview Enhanced reads repository-controlled .cross… |