CVE-2026-97470 Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escapin...

CVE-2026-97470

The Tourfic WordPress plugin (versions up to and including 3.0.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via comment content. The root cause is insufficient input sanitization and output escaping involving the unfiltered_html grant for the Customer role. While the plugin's listing-pa...

CVE-2026-96768

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

EUVD-2026-102830

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-96768

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.2.3 . The root cause is insufficient input sanitization and output escaping within the Comment Content via Email Log Body functionality. Specifically, because WordPress com...

CVE-2026-96768 GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-97640

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance GDPR / CCPA / EU Compliance Cookie Notice plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS in all versions up to, and including, 1.1.9 d...

CVE-2026-97640 WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance GDPR / CCPA / EU Compliance Cookie Notice plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS in all versions up to, and including, 1.1.9 d...

EUVD-2026-102799

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance GDPR / CCPA / EU Compliance Cookie Notice plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS in all versions up to, and including, 1.1.9 d...

CVE-2026-97640

The WPConsent WordPress plugin (versions up to and including 1.1.9 ) is vulnerable to Stored Cross-Site Scripting (XSS) via mXSS in the comment content. The root cause is insufficient input sanitization and output escaping within the Simple HTML DOM Parser during Noise-Key Restoration. An unauthe...

CVE-2026-97339

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97339

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 7.5.5 . The root cause is insufficient input sanitization and output escaping within the yotu-wp Cookie-Blocker Filter . An unauthenticated att...

EUVD-2026-102614

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-97339 Complianz GDPR/CCPA Cookie Consent Banner <= 7.5.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-115612

Name of the Vulnerable Software and Affected Versions Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access or higher to perform Stored...

CVE-2026-96768: Improper Neutralization of Input During Web Page Generation

The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-97640: Improper Neutralization of Input During Web Page Generation

The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance GDPR / CCPA / EU Compliance Cookie Notice plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS in all versions up to, and including, 1.1.9 d...

PT-2026-115503

Name of the Vulnerable Software and Affected Versions WPConsent versions prior to 1.2.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. This occurs through a mutation XSS mXSS technique...

CVE-2026-97339: Improper Neutralization of Input During Web Page Generation

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for...

WordPress WPConsent plugin <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration mXSS vulnerability discovered by daroo in WordPress Plugin WPConsent versions = 1.1.9...