EUVD-2026-81518

Contributor Cross Site Scripting XSS in Geo Mashup = 1.13.21 versions...

CVE-2026-66579 WordPress JetElements For Elementor plugin <= 2.9.2.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetElements For Elementor = 2.9.2.1 versions...

CVE-2026-66576 WordPress JetBlocks For Elementor plugin <= 1.5.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetBlocks For Elementor = 1.5.2 versions...

CVE-2026-66573

CVE-2026-66573 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress JetTabs plugin, affecting versions 2.3.3.1 and earlier . The vulnerability was discovered by nh4tvd and rated CVSS 3.1 6.5 (Medium) with a changed scope, indicating potential impact beyond the vulnerab...

CVE-2026-66641

Contributor Cross Site Scripting XSS in Video Conferencing with Zoom = 4.6.8 versions...

CVE-2026-66645 WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Table Of Contents Block = 1.5.0 versions...

CVE-2026-66644

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

PT-2026-77071

Contributor Cross Site Scripting XSS in Typing Effect = 1.3.7 versions...

CVE-2026-66434

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

SEOPress < 7.8 - Contributor+ Stored XSS

Description The plugin does not sanitise and escape some of its Post settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks. As a contributor, create a new Post, at the bottom of the page put the following payload in the "SEO Title" fie...

Medialist < 1.4.1 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks medialist style='"...

OSM – OpenStreetMap <= 6.01 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attack. osmmap mapborder='3px solid black;background:red;width:100px;height:100px;" onmouseover="alert1"'...

menu shortcode <= 1.0 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC Exploit shortcode: redirect duration="1"...

MonsterInsights < 8.12.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. As a contributor, add an "Inline Popular Posts" to a...

Wonder PDF Embed < 1.7 - Contributor+ Stored XSS

The plugin does not escape parameters of its wonderpluginpdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks. PoC wonderpluginpdf src="a" onload="alert1"...