CVE-2026-73354

The WordPress SimplyRETS Real Estate IDX plugin (≤ 3.2.8) allows unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 (HIGH) reflects network exposure requiring user interaction. No in-the-wild exploitation is reported. PatchStack notes a fix is available; upgrade...

EUVD-2026-62382

Unauthenticated Cross Site Scripting XSS in SimplyRETS Real Estate IDX = 3.2.8 versions...

EUVD-2026-62379

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

CVE-2026-73184

The WordPress Global Gallery plugin (versions ≤ 11.1.2) contains an unauthenticated reflected/stored XSS vulnerability exploitable via a crafted URL; no specific vulnerable file or root cause is documented. CVSS 3.1 scores it HIGH (7.1) with network attack vector and no authentication required. P...

CVE-2026-73184 WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Global Gallery = 11.1.2 versions...

EUVD-2026-62377

Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...

CVE-2026-73182 WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...

CVE-2026-66596

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the WordPress Newsletter plugin in versions 9.3.3 and earlier . The flaw allows an unauthenticated attacker to inject and execute arbitrary scripts in the context of a victim's browser, requiring user interaction. The CVSS 3.1 ba...

CVE-2026-66596 WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

EUVD-2026-62374

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

CVE-2026-61986

CVE-2026-61986 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Contest Gallery plugin , affecting versions 30.0.5 and earlier . The flaw allows an unauthenticated attacker to inject malicious scripts, with a CVSS 3.1 base score of 7.1 (HIGH) — network vector, low c...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

EUVD-2026-62369

HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users...

CVE-2026-18371

An authenticated attacker in M-Files Web before version 26.8.16330.2 can inject HTML to alter UI contents shown to other users, enabling potential phishing or content spoofing. CVSS 4.0 rates it MEDIUM (5.1) with low privileges required and passive user interaction. No exploitation evidence is re...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

OPENSUSE-SU-2026:21592-1 Security update for go1.25

This update for go1.25 fixes the following issues: Update to go1.25.13 released 2026-08-13, bsc1244485. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

CVE-2026-75981

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

CVE-2026-15446

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-15780

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...