GHSA-FJGC-3MJ7-8RG8 ep_etherpad-lite: Cache-poisoning Cross-site Scripting and Open Redirect via x-proxy-path Header

GHSA-03 — x-proxy-path header reflected into admin HTML/JS/CSS cache-poisoning XSS and concatenated into redirect open-redirect Severity: Medium CVSS v3.1 vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS suggested base score: 6.1 — Medium Re-validate in the first.gov calculator before...

CVE-2026-73357

CVE-2026-73357 is a Donor Cross Site Scripting (XSS) in the WordPress GiveWP plugin, affecting versions before 4.16.6. The CVSS v3.1 base score is 6.5 (MEDIUM). Patch: upgrade to 4.16.6 or newer. Connected sources confirm GiveWP

CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

EUVD-2026-57914

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

CVE-2026-73357 WordPress GiveWP plugin < 4.16.6 - Cross Site Scripting (XSS) vulnerability

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

CVE-2026-73340 WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-73340

The CVE covers a Cross Site Scripting (XSS) vulnerability in the WordPress plugin Featured Image from URL , affecting versions

CVE-2026-73344

The CVE-2026-73344 entry concerns the WordPress WP Data Access plugin, affected versions

CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

EUVD-2026-57910

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

EUVD-2026-57909

Contributor Cross Site Scripting XSS in Featured Image from URL = 5.3.3 versions...

CVE-2026-66700

CVE-2026-66700 affects the WordPress plugin “Smart Online Order for Clover” (versions &lt;= 1.6.1). The vulnerability is an Unauthenticated Cross Site Scripting (XSS) flaw reported for that plugin, indicating an attacker can inject scripts without authentication. Connected records confirm the aff...

CVE-2026-66700 WordPress Smart Online Order for Clover plugin <= 1.6.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

CVE-2026-66700

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

EUVD-2026-57904

Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66697 WordPress Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin <= 2.10.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66697

CVE-2026-66697 corresponds to an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Colissimo Officiel : Méthodes de livraison pour WooCommerce, affecting versions up to and including 2.10.0. The connected CVE records confirm the affected product (Colissimo Officiel:...

CVE-2026-66698

Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...

CVE-2026-66697

Unauthenticated Cross Site Scripting XSS in Colissimo Officiel : Méthodes de livraison pour WooCommerce = 2.10.0 versions...

CVE-2026-66698

CVE-2026-66698 : WordPress SureDash plugin, versions up to 1.10.1, contains an unauthenticated XSS vulnerability. The CVSS 3.1 metrics indicate network access, low impact on confidentiality/ integrity/ availability, and required user interaction. The connected documents do not provide details on ...