CVE-2026-96765

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in all versions up to and including 44.1 . The root cause is insufficient input sanitization and output escaping of the id_token paramet...

CVE-2026-100178 WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advertslocation' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-97396 Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

CVE-2026-100178

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.3.4 . The root cause is insufficient input sanitization and output escaping specifically involving the 'adverts_location' parameter. This flaw allows unauthent...

CVE-2026-97396

The Email Marketing for WordPress and WooCommerce – Retainful plugin is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.0.10 . The flaw originates from insufficient input sanitization and output escaping within the 'data' parameter of the /updateOptions REST ...

EUVD-2026-96282

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advertslocation' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-96281

The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION WPO365 | LOGIN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'idtoken' parameter in all versions up to, and including, 44.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96280

The Email Marketing for WordPress and WooCommerce – Retainful plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 1.0.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticate...

EUVD-2026-96278

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-101921 WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'attacker-chosen key referenced by the smart tag e.g. "x"' parameter in all versions up to, and including, 2.0.2.1 due ...

CVE-2026-101921

The WPForms WordPress plugin (versions up to and including 2.0.2.1 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the 'query_var' Smart Tag parameter. An unauthenticated attacker can inject arbitrary web sc...

CVE-2026-101920 Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment href attribute inside comment content' parameter in all versions up to, and including, 5.2.12 due to insufficient input...

CVE-2026-100147

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.16.0.5 . The root cause is insufficient input sanitization and output escaping involving the shipping_first_name parameter. This fl...

EUVD-2026-96275

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shippingfirstname' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-100147 FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)

The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shippingfirstname' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96277

The Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment href attribute inside comment content' parameter in all versions up to, and including, 5.2.12 due to insufficient input...

CVE-2026-101920

The Molongui Authorship WordPress plugin (versions up to and including 5.2.12 ) is vulnerable to Unauthenticated Stored DOM-Based Cross-Site Scripting . The flaw exists in the 'comment (href attribute inside comment content)' parameter due to insufficient input sanitization and output escaping. U...

CVE-2026-96563 Motors <= 1.4.123 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-96292

The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'stmfs' parameter in all versions up to, and including, 1.4.123 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-96293

The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUESTURI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...