EUVD-2026-63294

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66607 WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...

CVE-2026-66605 WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

EUVD-2026-63293

Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...

EUVD-2026-63344

Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...

CVE-2026-66606

An unauthenticated reflected/stored XSS vulnerability exists in the WordPress SmartSMTP plugin through version 1.2.0. An attacker can inject malicious scripts without authentication; a victim triggering the payload could have their session cookies stolen or admin actions hijacked. CVSS 3.1 scores...

CVE-2026-66604 WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

EUVD-2026-63343

Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...

CVE-2026-66604

An unauthenticated reflected/stored XSS vulnerability exists in the GeoDirectory WordPress plugin (versions ≤ 2.8.173), allowing an attacker to inject malicious scripts into pages viewed by other users without authentication, enabling session hijacking or credential theft. No in-the-wild exploita...

EUVD-2026-63342

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601

Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...

EUVD-2026-63340

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598

CVE-2026-66598 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin B2BKing Premium , affecting versions 5.6.07 and earlier . The vulnerability was discovered by dutafi and is rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating ...

EUVD-2026-63339

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66597 WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66597

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the wpDataTables WordPress plugin in versions 6.5.1.4 and earlier . The flaw allows an attacker to inject malicious scripts that execute in the context of a victim's browser, requiring user interaction. The CVSS 3.1 base score is...

CVE-2026-66590 WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

EUVD-2026-63334

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

CVE-2026-66590

Unauthenticated reflected XSS affects the Tagembed WordPress plugin (≤7.4), reachable over the network with no authentication. CVSS 7.1 (HIGH) reflects changed scope and low confidentiality/integrity/availability impact. A Patchstack advisory provides details; no exploitation evidence is reported...