CVE-2026-66448: Improper Neutralization of Input During Web Page Generation

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

PT-2026-64944

Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...

PT-2026-65090

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Name...

PT-2026-65095

Name of the Vulnerable Software and Affected Versions Ekushey Project Manager CRM versions prior to 5.1 Description A stored cross-site scripting issue exists where authenticated client users can inject arbitrary HTML and JavaScript. This occurs when malicious payloads are entered into the Reply...

PT-2026-65301

A stored cross-site scripting vulnerability existed in the capture tree visualization page. The application embedded the serialized capture tree directly into an inline JavaScript block using the Jinja safe filter. Because the tree data can contain values derived from captured and potentially...

PT-2026-65302

Pivotick contains a cross-site scripting vulnerability in the sidebar property-list component. Values associated with link-like properties, such as url, uri, href, link, website, or homepage, were rendered as hyperlinks without validating their URL scheme. An attacker able to supply or influence...

PT-2026-65324

Name of the Vulnerable Software and Affected Versions Kali Forms versions 2.4.18 and earlier Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update Kali Forms to a...

PT-2026-65325

Name of the Vulnerable Software and Affected Versions Contest Gallery versions prior to 30.0.7 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update Contest Gallery to ...

PT-2026-65322

Name of the Vulnerable Software and Affected Versions BackWPup versions prior to 5.7.5 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update BackWPup to version...

PT-2026-64963

Contributor Cross Site Scripting XSS in Photonic Gallery & Lightbox for Flickr, SmugMug & Others = 3.33 versions...

PT-2026-64968

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.3 versions...

PT-2026-64967

Contributor Cross Site Scripting XSS in Open User Map = 1.4.46 versions...

PT-2026-65326

Name of the Vulnerable Software and Affected Versions Anti Spam and list cleaner – AcyChecker versions prior to 1.8.2 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations...

PT-2026-65318

Name of the Vulnerable Software and Affected Versions Ultimate Addons for Contact Form 7 versions prior to 3.5.46 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring authentication. Recommendations Update...

PT-2026-65320

Name of the Vulnerable Software and Affected Versions GiveWP versions prior to 4.16.4 Description Unauthenticated Cross Site Scripting XSS allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations Update GiveWP to version 4.16...

PT-2026-64954

Contributor Cross Site Scripting XSS in BetterDocs = 4.6.2 versions...

PT-2026-64953

Contributor Cross Site Scripting XSS in WordPress Social Login and Register = 7.8.0 versions...

CVE-2026-65557: Improper Neutralization of Input During Web Page Generation

Shop manager Cross Site Scripting XSS in Abandoned Cart Lite for WooCommerce = 6.8.0 versions...

CVE-2026-65439: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-65448: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner – AcyChecker = 1.8.1 versions...