1045715 matches found
CVE-2026-73426 Trix: Stored XSS vulnerability through serialized attributes
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.17, Trix is vulnerable to cross-site scripting when a data-trix-serialized-attributes attribute bypasses the DOMPurify sanitizer. An attacker can craft HTML containing a data-trix-serialized-attributes...
CVE-2026-32333
Unauthenticated Cross Site Scripting XSS in Mayosis Core = 5.4.7 versions...
CVE-2026-28568
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
CVE-2026-28569
Unauthenticated Cross Site Scripting XSS in SSL Zen = 4.7.43 versions...
CVE-2026-75872 HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of t...
CVE-2026-73393
The WordPress Subscribe2 plugin (versions ≤ 10.46) contains an unauthenticated reflected XSS flaw, exploitable via network without privileges; CVSS 7.1 (High). Patchstack is the CNA. No exploitation evidence or fix version is provided in the documents. Monitor for updates. Patchstack advisory: ht...
CVE-2026-73393 WordPress Subscribe2 plugin <= 10.46 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
EUVD-2026-60800
Unauthenticated Cross Site Scripting XSS in Subscribe2 = 10.46 versions...
CVE-2026-73382 WordPress Site Reviews plugin <= 8.2.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73382
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
EUVD-2026-60797
Unauthenticated Cross Site Scripting XSS in Site Reviews = 8.2.0 versions...
CVE-2026-73382
The WordPress Site Reviews plugin (versions ≤ 8.2.0) has an unauthenticated Cross-Site Scripting (XSS) vulnerability, exploitable over the network with no privileges required, rated CVSS 7.1 HIGH. No in-the-wild exploitation has been reported. No patch version is provided in the available documen...
CVE-2026-73378 WordPress Contact Form by Supsystic plugin < 1.10.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
CVE-2026-73378
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
EUVD-2026-60793
Unauthenticated Cross Site Scripting XSS in Contact Form by Supsystic 1.10.0 versions...
EUVD-2026-60790
Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...
CVE-2026-73375
The WordPress Ultimate Maps by Supsystic plugin versions prior to 1.5.0 allow unauthenticated attackers to inject arbitrary scripts via reflected XSS, potentially enabling session hijacking and credential theft. CVSS 3.1 scores it HIGH (7.1). Exploitation details are not provided; upgrading to ve...
CVE-2026-73375
Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...