CVE-2026-48788

Remark42 is a self-hosted comment engine for blogs, articles, or any other place where readers can add comments. Versions 1.6.0 through 1.15.0 contain a Cross-Site Scripting XSS vulnerability exploitable through content-type spoofing. The Remark42 image proxy fetches an arbitrary remote URL and...

CVE-2026-42385

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

CVE-2026-44587

CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the contenttypedenylist check fails to escape regex metacharacters in string entries, causing the denylist to silently not match the content types it is intended to block. In...

CVE-2026-41557

Unauthenticated Cross Site Scripting XSS in Kapee 1.7.1 versions...

CVE-2026-40765

Unauthenticated Cross Site Scripting XSS in collectchat = 2.4.9 versions...

CVE-2026-39597

Unauthenticated Cross Site Scripting XSS in WPZOOM Addons for Elementor = 1.3.4 versions...

CVE-2026-39548

Unauthenticated Cross Site Scripting XSS in MagOne = 9.0 versions...

CVE-2026-27870

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat in this case, registration action IS required who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting XSS payload into the 'Hostname' field of the configuration...

CVE-2026-22339

Unauthenticated Cross Site Scripting XSS in WPJobster = 6.3.5 versions...

CVE-2026-22329

Unauthenticated Cross Site Scripting XSS in Skillate = 1.2.10 versions...

DEBIAN-CVE-2026-12459

Inappropriate implementation in Serial in Google Chrome prior to 149.0.7827.155 allowed a remote attacker to inject arbitrary scripts or HTML UXSS via a crafted HTML page. Chromium security severity: High...

CVE-2026-11975

Stored cross-site scripting XSS in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw...

CVE-2025-69151

Unauthenticated Cross Site Scripting XSS in Grand Car Rental = 3.7 versions...

CVE-2025-69104

Unauthenticated Cross Site Scripting XSS in Qreatix = 1.9.4 versions...

CVE-2025-59560

Unauthenticated Cross Site Scripting XSS in Sonaar = 4.27.4 versions...

CVE-2024-49269

Unauthenticated Cross Site Scripting XSS in my flatonica = 0.0.8 versions...

EUVD-2026-37692

Unauthenticated Cross Site Scripting XSS in Royal Elementor Addons Pro 1.7.1041 versions...

CVE-2026-40720

Concretely, CVE-2026-40720 affects the WordPress plugin Royal Elementor Addons Pro (versions below 1.7.1041). The issue is an Unauthenticated Cross Site Scripting (XSS) vulnerability discovered in these versions. CVSSv3.1 base score is 7.1 (HIGH) with network exploitation potential, no privileges...

CVE-2025-69140 WordPress SweetDate Core plugin < 1.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SweetDate Core 1.1.5 versions...

CVE-2025-69140

The CVE is for WordPress SweetDate Core plugin versions before 1.1.5, which are affected by an unauthenticated reflected XSS vulnerability. Root cause details aren’t provided in the documents, but the issue is tied to SweetDate Core