CVE-2026-14331 Subscribe2 < 10.46 - Reflected XSS via email Parameter

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

EUVD-2026-54378

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

CVE-2026-14331

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...

CVE-2026-15032 wpDiscuz < 7.6.60 - Unauthenticated Stored XSS via Image URL Conversion

The Comments WordPress plugin before 7.6.60 does not properly escape a user-supplied URL before outputting it inside an HTML attribute, allowing unauthenticated users to store a Cross-Site Scripting payload that executes in the browser of any user, including administrators, who views the affected...

WordPress WP-Stats plugin <= 2.56 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by testoun in WordPress Plugin WP-Stats versions = 2.56...

EUVD-2026-54365

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-12801

The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Range Slider 'data-label' and 'data-separator' attributes in all versions up to, and including, 3.5.43 due to insufficient input sanitization and output escaping. This makes it possible f...

EUVD-2026-54184

AIL Framework contains a stored cross-site scripting vulnerability in the crawler domain view. Crawled URLs were embedded directly into the JavaScript onclick handler used to display a stored screenshot, without context-appropriate encoding. An attacker who can cause a specially crafted URL to be...

EUVD-2026-54194

AIL Project contains a stored cross-site scripting vulnerability in the translation controls displayed for chat messages and forum posts. The affected templates inserted message and post identifiers directly into inline JavaScript onclick handlers: onclick="translateMessageToPreferredLanguage'...

EUVD-2026-54305

AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...

EUVD-2026-54146

A vulnerability was determined in DataGear up to 5.0.0. The impacted element is the function HtmlTplDashboardWidgetHtmlRenderer of the file HtmlTplDashboardWidgetHtmlRenderer.java of the component Chart Name Handler. This manipulation of the argument Title causes cross site scripting. It is...

PT-2026-69025

Name of the Vulnerable Software and Affected Versions ShareOpenly versions prior to 1.2.1 Description Cross-Site Scripting occurs due to the missing esc url escaping function on the $url variable before it is rendered into HTML content. This variable is constructed using home url add query arg...

PT-2026-69129

Name of the Vulnerable Software and Affected Versions Domoticz versions prior to 2026.3 Description A stored cross-site scripting issue exists in the mobile dashboard. Authenticated attackers can inject arbitrary HTML and JavaScript by updating device values of the Text or Alert subtypes through...

WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Content Block

Description Gutenberg does not restrict a block attribute used as an HTML tag name, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the Gutenberg plugin and,...

WP < 7.0.3 - Contributor+ Stored XSS via Gutenberg Post Date Block

Description Gutenberg does not escape a block attribute before outputting it in an HTML attribute context, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against anyone viewing the affected post. The affected block ships both in the...

CVE-2026-19207: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in PHPGurukul Company Visitor Management System 1.0. This issue affects some unknown processing of the file /manage-newvisitors.php. The manipulation of the argument fullname leads to cross site scripting. The attack can be initiated remotely. The exploi...

IBM Engineering Requirements Management DOORS 9.6.1.1 <= 9.6.1.13 / 9.7.2.1 <= 9.7.2.11 Multiple Vulnerabilities (7279145)

The version of IBM Engineering Requirements Management DOORS formerly IBM Rational DOORS installed on the remote host is 9.6.1.1 prior or equal to 9.6.1.13 or 9.7.2.1 prior or equal to 9.7.2.11. It is, therefore, affected by multiple vulnerabilities as referenced in the 7279145 advisory. - IBM...

CVE-2026-19209: Improper Neutralization of Input During Web Page Generation

A flaw has been found in SourceCodester Photo Share Website 1.0. The affected element is an unknown function of the file /social/index.php?page=home. This manipulation of the argument Comment causes cross site scripting. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-48094: Improper Neutralization of Input During Web Page Generation

The ShareOpenly WordPress plugin prior to version 1.2.1 contains a Cross-Site Scripting vulnerability caused by the absence of WordPress's escurl escaping function on the $url variable before it is rendered into HTML content. This variable is constructed from homeurl addqueryarg array, $wp-reques...

CVE-2026-14331: Improper Neutralization of Input During Web Page Generation

The Subscribe2 WordPress plugin before 10.46 does not properly escape a user-supplied value before reflecting it into a public subscription form, leading to Reflected Cross-Site Scripting that executes in the browser of an unauthenticated visitor who interacts with the form through a crafted link...