CVE-2026-16655

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

CVE-2026-8791 Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

EUVD-2026-50273

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

CVE-2026-8791

The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...

CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-16655 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

EUVD-2026-50270

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

CVE-2026-16655

Fluent Forms (WordPress plugin) up to version 6.2.7 is affected by an unauthenticated stored XSS in the Name field via a nested password member, due to insufficient input sanitization and output escaping. Impact stated: unauthenticated attackers can inject scripts on pages that users visit. The c...

EUVD-2026-50266

The GTM4WP – A Google Tag Manager GTM plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16597 GTM4WP <= 1.22.3 - Unauthenticated Stored Cross-Site Scripting via WooCommerce Billing Fields

The GTM4WP – A Google Tag Manager GTM plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via WooCommerce Billing Fields in all versions up to, and including, 1.22.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16597

Summary: CVE-2026-16597 affects the GTM4WP WordPress plugin (versions ≤ 1.22.3) and allows unauthenticated stored XSS via WooCommerce Billing Fields when the GTM4WP_OPTION_INTEGRATE_WCORDERDATA option is enabled. The root cause is insufficient input sanitization and output escaping in the plugin’...

CVE-2026-13425

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-18197

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Link Library allows Cross-Site Scripting XSS. This issue affects Link Library: before 7.9.4...

CVE-2026-13425

The CVE covers the WordPress plugin Database for CF7, affected up to version 1.2.6, vulnerable to unauthenticated Stored XSS via array-form field values. Root cause: insufficient input sanitization and output escaping; data stored with serialize() into wp_cf7db bypasses WordPress save-time filter...

CVE-2026-13425 Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-13425

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

EUVD-2026-50198

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-13425 Database for CF7 <= 1.2.6 - Unauthenticated Stored Cross-Site Scripting via Array Form Field Values

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-14234

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...