EUVD-2026-102254

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3...

CVE-2026-109893 WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force Presto Player presto-player allows Stored XSS.This issue affects Presto Player: from n/a through 4.5.3...

WordPress Presto Player plugin <= 4.5.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Presto Player versions = 4.5.3...

WordPress Ultra Addons for Contact Form 7 plugin <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Ultimate Addons for Contact Form 7 versions = 3.5.54...

CVE-2026-110890

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6...

CVE-2026-108175

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0...

CVE-2026-106707

XXL-JOB =3.5.0-SNAPSHOT contains a stored Cross-Site Scripting XSS vulnerability in the job log list page /joblog. An authenticated user who holds permission on a target executor job group can inject arbitrary JavaScript via the executorParam argument of the manual-trigger endpoint POST...

CVE-2026-106706

XXL-JOB through 3.5.0-SNAPSHOT is vulnerable to stored cross-site scripting XSS in the GLUE code editor. JobCodeController.save stores the user-supplied glueSource parameter without output encoding, and the FreeMarker template job.code.ftl renders the stored value unescaped...

WordPress SQL Chart Builder plugin <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by rwcpower100 in WordPress Plugin SQL Chart Builder versions = 3.0.6...

WordPress WPConsent plugin <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS vulnerability discovered by daroo in WordPress Plugin WPConsent versions = 1.1.9...

CVE-2026-110375 WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

CVE-2026-110375

The WordPress Download Monitor plugin (versions

EUVD-2026-102248

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

WordPress Download Monitor plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Download Monitor versions = 5.3.3...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sebastian Albrecht mySebbe in WordPress Plugin HivePress versions = 1.7.32...

WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin Simply Schedule Appointments versions = 1.6.12.35...

WordPress GeoDirectory plugin <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'twitterusername' Custom Field vulnerability discovered by OKISO - OKISO in WordPress Plugin GeoDirectory versions = 2.8.192...

WordPress TranslatePress – Translate Multilingual sites with AI Translation plugin <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin TranslatePress versions = 3.3.7...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.9 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Elieve in WordPress Plugin WPeMatico RSS Feed Fetcher versions = 2.9...

WordPress HivePress – Business Directory, Listings & Classified Ads Plugin plugin <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by braintx in WordPress Plugin HivePress versions = 1.7.32...