CVE-2026-66655

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-66468

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

CVE-2026-66471

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

CVE-2026-66460

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

CVE-2026-66449

Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...

CVE-2026-66456

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-65580

Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...

CVE-2026-66426

Unauthenticated Cross Site Scripting XSS in WP-Stats = 2.56 versions...

CVE-2026-61974

Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.3.4 versions...

CVE-2026-61960

Unauthenticated Cross Site Scripting XSS in WP Full Stripe Free = 8.5.0 versions...

CVE-2026-61965

Unauthenticated Cross Site Scripting XSS in GeekyBot = 1.2.6 versions...

CVE-2026-28170

Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-28158

Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...

CVE-2026-28003

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

CVE-2026-27539

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

CVE-2026-27537

Unauthenticated Cross Site Scripting XSS in Popup by Supsystic = 1.11.2 versions...

CVE-2026-27536

Unauthenticated Cross Site Scripting XSS in MailChimp Subscribe Forms = 4.3.3 versions...

CVE-2025-62318

HCL AION is affected by a vulnerability where JavaScript responses containing data could be referenced by external pages, potentially allowing sensitive information to be captured by an attacker-controlled page JavaScript hijacking under certain conditions...

ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...