EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin SmartSMTP versions = 1.2.0...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...

WordPress Advance Product Search plugin <= 1.4.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by sequenceX0 in WordPress Plugin Advance Product Search versions = 1.4.8...

WordPress Form Maker by 10Web plugin <= 1.15.46 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Elijah Chia in WordPress Plugin Form Maker by 10Web versions = 1.15.46...

OPENSUSE-SU-2026:21593-1 Security update for go1.26

This update for go1.26 fixes the following issues: Update to go1.26.6 released 2026-08-13, bsc1255111. Security issues fixed: - CVE-2026-33818: encoding/asn1: unenforced recursion limit can lead to stack exhaustion when parsing deeply-nested, recursive structures bsc1275034. - CVE-2026-39821:...

BIT-JUPYTERLAB-2026-73417 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 3.3.0 until 4.5.10 and 4.6.2, JupyterLab allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings...

CVE-2026-75981

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

WordPress Global Gallery plugin <= 11.1.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin Global Gallery versions = 11.1.2...

WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Thaer Assfour in WordPress Plugin Contest Gallery versions = 30.0.5...

EUVD-2026-62343

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to unauthenticated Stored Cross-Site Scripting in versions up to and including 3.2.5. The special gettext markers '!trpst' and '!trpen' are unconditionally rewritten to '' by translatepage in...

CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-19055

The ProSolution WP Client WordPress plugin before version 2.0.11 fails to sanitise and escape multiple parameters before reflecting them into HTML attributes on public pages, enabling reflected XSS exploitable against any visitor, including administrators. CVSS 3.1 scores this HIGH (7.1); no in-t...

CVE-2026-19056 ProSolution WP Client < 2.0.11 - Reflected XSS via 'page' Parameter

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

EUVD-2026-62272

The Simple File List WordPress plugin through 6.3.11 does not properly sanitise and escape a file's description before outputting it on the public file list, allowing unauthenticated users when front-end file management is enabled to perform Stored Cross-Site Scripting attacks that execute in the...

CVE-2026-66358

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...

CVE-2026-66358

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...

EUVD-2026-62237

A cross-site scripting vulnerability exists in acmailer, which may allow an attacker to execute an arbitrary script...

CVE-2026-66358

acmailer has a cross-site scripting (XSS) vulnerability allowing an unauthenticated remote attacker to inject arbitrary script. CVSS 3.0 scores it MEDIUM (6.1) with user interaction required. No in-the-wild exploitation or specific affected versions are reported; monitor vendor advisories for pat...

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...