EUVD-2026-96211

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

CVE-2026-102402 Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttpfiltertaxonomy meta of the attacker-chosen post' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-100196 LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

EUVD-2026-96212

The Team – Team Members Showcase Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ttpfiltertaxonomy meta of the attacker-chosen post' parameter in all versions up to, and including, 6.0.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-102402

The Team – Team Members Showcase Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 6.0.2 . The root cause is insufficient input sanitization and output escaping regarding the 'ttp_filter_taxonomy' parameter (meta of an attacker-chosen post...

CVE-2026-100196

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.0 . The root cause is insufficient input sanitization and output escaping within the comment_content parameter. Attackers can bypass Wor...

CVE-2026-5725 Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

EUVD-2026-96213

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

EUVD-2026-96214

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'fvrt' prefixed request parameters in all versions up to, and including, 1.2.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.28.36 . The root cause is the get_dynamic_values function, which performs text-level find-and-replace operations on post content without utilizing HTML-aw...

CVE-2026-5725

The Favicon Rotator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.2.11 . The root cause is insufficient input sanitization and output escaping of request parameters prefixed with 'fvrt_' . An unauthenticated attacker could execute...

CVE-2026-100161 Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-89100 Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-103897 Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-96219

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-96220

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'response' URL Fragment in all versions up to, and including, 4.0.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

CVE-2026-89100

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 4.0.17 . The root cause is insufficient input sanitization and output escaping specifically via the '#response' URL Fragment . This allows unau...

CVE-2026-103897

The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.7.9 . The root cause is insufficient input sanitization and output escaping of the 'comment' parameter. This allows authenticated attackers with editor-l...

CVE-2026-96574

The User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 4.3.12 . The root cause is insufficient input sanitizatio...