CVE-2026-78471: Improper Neutralization of Input During Web Page Generation

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts...

CVE-2026-96578: Improper Neutralization of Input During Web Page Generation

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-97641: Improper Neutralization of Input During Web Page Generation

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2026-104116

Name of the Vulnerable Software and Affected Versions Kubio AI Page Builder versions prior to 2.9.3 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts via the comment...

PT-2026-104142

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-104145

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104138

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed – Simple Social Feeds for WordPress versions prior to 4.13.1 Description Insufficient input sanitization and output escaping in the Admin Builder Preview allow unauthenticated attackers to perform Stored Cross-Si...

PT-2026-104153

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search versions prior to 4.28.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS via comment content. This enables the injection of...

PT-2026-104154

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-97663: Improper Neutralization of Input During Web Page Generation

The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 5.122.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104079

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user...

CVE-2026-95817: Improper Neutralization of Input During Web Page Generation

The DoFollow Case by Case plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-87920: Improper Neutralization of Input During Web Page Generation

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Output-Buffer Regex Rewrite in all versions up to, and including, 2.10.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104177

Name of the Vulnerable Software and Affected Versions W3 Total Cache versions prior to 2.10.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via comment content. This...

CVE-2025-70886

CVE-2025-70886 CVE-2025-70886에 대한 개념 증명PoC 익스플로잇입니다. Halo CMSv2.22.4 및 이전의 지속적 서비스 거부 취약점으로, 원격 공격자가 변조된 페이로드를 제출하여 관리자 댓글 인터페이스를 충돌시킬 수 있습니다. 기본 정보 Product Vendor: 凌霞软件 Vendor Website: https://www.lxware.cn/ Affected Object Type: 소프트웨어 / 웹 애플리케이션 Affected Product: Halo CMS Affected Product...

CVE-2026-104182

stream-json is a micro-library of stream components for processing JSON and JSONC with a minimal memory footprint. Prior to 3.6.0, the JSONC parser at stream-json/jsonc/parser.js and verifier at stream-json/jsonc/verifier.js restart comment-terminator scanning from the opening slash whenever a...

hdwebmobile-photo-video-reviews

HDWebmobile 写真・動画レビュー 顧客が商品レビューに写真や短い動画を添付できるWooCommerceプラグインで、商品ページのレビュー一覧に直接表示されます。 WordPress.org: https://wordpress.org/plugins/hdwebmobile-photo-video-reviews/ 初回提出待ち 必要環境: WordPress 6.9+、WooCommerce、PHP 7.4+ ライセンス: GPLv2 以降 このプラグインが存在する理由 競合する「Customer Reviews for...

postcss: PostCSS: Information disclosure and denial of service via crafted CSS input

A flaw was found in PostCSS, a tool that processes CSS files. An attacker who provides specially crafted CSS input containing a malicious source map comment can cause the system to read arbitrary files from the local filesystem. This can lead to the disclosure of sensitive information, specifical...

CVE-2026-103288

Ghost, an open-source publishing platform, contains an input validation flaw in its comment like feature in versions from 5.9.0 before 6.44.1. An authenticated member can delete comment likes or dislikes belonging to other users that they are not authorized to delete, resulting in an authorizatio...

CVE-2026-103289

The Ghost content management system, specifically versions 5.9.0 before 6.44.1 , is vulnerable to an authorization bypass within its comments feature . An input validation issue allows authenticated members to access and view restricted comment data for which they lack proper authorization. No sp...