EUVD-2026-62343

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

CVE-2026-75981

TranslatePress ≤3.2.5 has an unauthenticated stored XSS in translate_page() (class-translation-render.php:538-539), where plain-text markers #!trpst#/#!trpen# survive wp_kses and are rewritten to , enabling execution in visitors' browsers; CVSS 7.2 HIGH. Exploitation in the wild is not reported ...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-62341

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15780

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

EUVD-2026-62342

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-19056

The ProSolution WP Client WordPress plugin (versions before 2.0.11) reflects the unsanitized page parameter into an HTML attribute on an administrative page, enabling reflected XSS. An attacker who induces an admin to submit a crafted request can execute arbitrary JavaScript in the admin's sessio...

CVE-2026-19055

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

EUVD-2026-62286

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

EUVD-2026-62287

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

EUVD-2026-62278

The JetEngine WordPress plugin before 3.8.14 adds SVG to the site-wide list of allowed upload types without sanitising the file contents, allowing users with the upload files capability, such as Authors, to upload a file containing malicious JavaScript that executes in the browser of any user who...

CVE-2026-18202

JetEngine WordPress plugin before 3.8.14 enables SVG uploads site-wide without sanitising file contents, letting Authors upload SVG files containing malicious JavaScript that executes as stored XSS when viewed. On multisite installs, this also overrides network administrator upload-type restricti...

CVE-2026-16617

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 reflects unescaped query-string parameters on an admin page, enabling reflected XSS against administrators via crafted links. No exploit code or in-the-wild exploitation is reported; update to version 4.4.8 to remediate.

EUVD-2026-62268

The Easy Media Replace WordPress plugin through 0.2.0 does not sanitise and escape an attachment title before outputting it in an HTML attribute in the media library list view, allowing users with the Author role and above to inject arbitrary web scripts that are executed in the browser of a high...

CVE-2026-15253

The Easy Media Replace WordPress plugin (≤ 0.2.0) fails to sanitise attachment titles before rendering them in HTML attributes within the media library list view. Authors can store malicious scripts that execute in administrators' browsers when viewing the media library, enabling privilege escala...

CVE-2026-14287

The 10Web Booster WordPress plugin before version 2.33.5 has two flaws: an unauthenticated request handler does not validate the access token, and attacker-supplied stylesheet content is not escaped before being rendered into the page head. This enables an unauthenticated attacker to store markup...

CVE-2026-14334

Booking calendar, Appointment Booking System WordPress plugin (≤ 3.2.36) fails to sanitize uploaded SVG files. Unauthenticated attackers can bypass the plugin's script-stripping, upload a malicious SVG, and execute arbitrary JavaScript when an administrator reviews the booking — a stored XSS vect...

EUVD-2026-62264

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...