CVE-2026-66616

CVE-2026-66616 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Form Maker by 10Web , affecting versions ≤ 1.15.46 . The flaw allows a remote, unauthenticated attacker to inject malicious scripts into the context of a victim's browser, requiring user interact...

EUVD-2026-63299

Unauthenticated Cross Site Scripting XSS in Podlove Podcast Publisher = 4.5.4 versions...

CVE-2026-66614

The WordPress SEO Plugin by Squirrly SEO (versions ≤ 14.2.2) contains an unauthenticated reflected/stored XSS vulnerability exploitable via crafted input, with CVSS 3.1 score 7.1 (HIGH). No exploit code or in-the-wild exploitation details are provided in the documents; patch version is not specif...

CVE-2026-66614 WordPress SEO Plugin by Squirrly SEO plugin <= 14.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

EUVD-2026-63298

Unauthenticated Cross Site Scripting XSS in SEO Plugin by Squirrly SEO = 14.2.2 versions...

CVE-2026-66611 WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

CVE-2026-66612

Unauthenticated reflected XSS vulnerability in the WordPress Aora theme (versions ≤ 1.3.19), exploitable via a crafted link requiring user interaction. CVSS 7.1 HIGH (network, no privileges). No fix version or exploitation details provided; monitor Patchstack advisory for updates.

EUVD-2026-63296

Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...

EUVD-2026-63297

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

CVE-2026-66611

CVE-2026-66611 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Paymob for WooCommerce WordPress plugin, affecting versions ≤ 4.1.10 . The flaw was discovered by dutafi and rated CVSS 7.1 (HIGH) with a changed scope, indicating an attacker can execute scripts in a different s...

CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...

EUVD-2026-63294

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66605 WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

EUVD-2026-63293

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

EUVD-2026-63344

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

CVE-2026-66606

An unauthenticated reflected/stored XSS vulnerability exists in the WordPress SmartSMTP plugin through version 1.2.0. An attacker can inject malicious scripts without authentication; a victim triggering the payload could have their session cookies stolen or admin actions hijacked. CVSS 3.1 scores...

CVE-2026-66604 WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

EUVD-2026-63343

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66604

An unauthenticated reflected/stored XSS vulnerability exists in the GeoDirectory WordPress plugin (versions ≤ 2.8.173), allowing an attacker to inject malicious scripts into pages viewed by other users without authentication, enabling session hijacking or credential theft. No in-the-wild exploita...