PT-2026-65429

The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including, 1.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acces...

PT-2026-65600

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

PT-2026-65526

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1 2, and 6.2.2.0 through 6.2.2.0 1 is vulnerable to stored cross-site scripting. This vulnerability allows a...

PT-2026-65391

The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...

CVE-2026-65441

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.16.3 versions...

CVE-2026-65447

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.6 versions...

CVE-2026-65448

Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner AcyChecker = 1.8.1 versions...

CVE-2026-65446

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

CVE-2026-65443

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

CVE-2026-65437

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

CVE-2026-65439

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

CVE-2026-51565

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

CVE-2026-61957

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

CVE-2026-65438

Unauthenticated Cross Site Scripting XSS in Message Filter for Contact Form 7 = 1.6.3.9 versions...

CVE-2026-65440

Unauthenticated Cross Site Scripting XSS in GetGenie = 4.4.3 versions...

CVE-2026-65448

Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner - AcyChecker = 1.8.1 versions...

CVE-2026-65447

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.6 versions...

CVE-2026-65447 WordPress Contest Gallery plugin <= 30.0.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.6 versions...

CVE-2026-65447

CVE-2026-65447 concerns an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress plugin Contest Gallery , affecting versions up to 30.0.6 . The root cause is an XSS flaw that can be triggered without authentication, with CVSS v3.1 metrics indicating a base score of 7.1 (HIGH),...

CVE-2026-65448 WordPress Anti Spam and list cleaner – AcyChecker plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner AcyChecker = 1.8.1 versions...