EUVD-2026-70008

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

CVE-2026-81167 Address Suggestion - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-103

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Address Suggestion allows Cross-Site Scripting XSS. This issue affects Address Suggestion versions: from 0.0.0 to 1.0.25...

EUVD-2026-69997

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Monster Menus allows Stored XSS. This issue affects Monster Menus versions: from 0.0.0 to 9.5.3...

EUVD-2026-69996

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Slick Carousel allows Stored XSS. This issue affects Slick Carousel versions: from 0.0.0 to 2.1.0...

Important: Red Hat Security Advisory: golang security update

An update for golang is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

html/template: golang: Go html/template: Cross-Site Scripting via pathological input

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-84781

Contributor Cross Site Scripting XSS in Gallery PhotoBlocks = 1.3.4 versions...

CVE-2026-81770

Unauthenticated Cross Site Scripting XSS in Interactive Geo Maps = 1.6.30 versions...

CVE-2026-81775

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-81288

Unauthenticated Cross Site Scripting XSS in Upsell Order Bump Offer for WooCommerce = 3.1.5 versions...

WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Marc-André Beaulieu h3dg3h0g in WordPress Plugin Ninja Forms File Uploads Extension versions = 3.3.26...

WordPress BP Better Messages plugin <= 2.15.27 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin BP Better Messages versions = 2.15.27...

WordPress Product Variations Swatches for WooCommerce plugin <= 1.1.18 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Roll in WordPress Plugin Product Variations Swatches for WooCommerce versions = 1.1.18...

EUVD-2026-69934

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

CVE-2026-83562

CVE-2026-83562 is a Contributor Cross Site Scripting (XSS) vulnerability in the WordPress plugin WCFM Marketplace (versions ≤ 3.8.2 ). Discovered by Ananda Dhakal via Patchstack, the flaw requires an authenticated contributor-level user and user interaction to exploit, but results in a changed sc...

CVE-2026-83562 WordPress WCFM Marketplace plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in WCFM Marketplace = 3.8.2 versions...

EUVD-2026-69932

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-81775

CVE-2026-81775 affects the WordPress Estatik plugin, versions 4.3.4 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning an attacker can inject malicious scripts without prior authentication. The CVSS 3.1 score is 7.1 (HIGH) with the vector AV:N/AC:L/PR:N/U...

CVE-2026-81775 WordPress Estatik plugin <= 4.3.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Estatik = 4.3.4 versions...

CVE-2026-81771

Unauthenticated Cross-Site Scripting (XSS) was identified in the WordPress TrustedSite plugin , affecting versions 1.2.5 and earlier . The flaw allows an unauthenticated attacker to inject script that executes in the context of a different site (scope changed), with low impact on confidentiality,...