1140333 matches found
CVE-2026-66581
JetEngine plugin (Crocoblock) version 3.8.14.1 and earlier is vulnerable to unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 HIGH. Upgrade to a patched version beyond 3.8.14.1; Patchstack advisory referenced. No exploitation evidence reported. Monitor for upda...
EUVD-2026-63330
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...
CVE-2026-66581 WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...
WordPress TranslatePress - Translate Multilingual sites with AI Translation plugin <= 3.2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability
WordPress TranslatePress - Translate Multilingual sites with AI Translation plugin = 3.2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Pham Duc Anh in WordPress Plugin TranslatePress versions = 3.2.5...
CVE-2026-77072
n8n before 1.123.69 , 2.33.4 , and 2.34.1 contains a stored cross-site scripting (XSS) vulnerability in the Form node's completion page . The root cause is a logic flaw: the sandboxing Content-Security-Policy was applied only when respondWith was not set to 'redirect', yet responseText was always...
WordPress WP Statistics plugin <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'utmcampaign' Parameter vulnerability discovered by tipsen in WordPress Plugin WP Statistics versions = 14.16.8...
WordPress NotificationX Pro plugin <= 3.1.4 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh - HPT Vietnam Corporation in WordPress Plugin NotificationX Pro versions = 3.1.4...
WordPress WP BASE Booking plugin <= 6.3.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by moonge in WordPress Plugin WP BASE Booking versions = 6.3.2...
WordPress Divi theme 5.0-5.8.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by ,.$n.,Sico.eX in WordPress Theme Divi versions 5.0-5.8.1...
WordPress YMC Filter plugin < 3.12.9 - Author+ Stored XSS via SVG Icon Upload vulnerability
Author+ Stored XSS via SVG Icon Upload vulnerability discovered by Artus KG in WordPress Plugin Filter & Grids versions 3.12.9...
CVE-2026-76569
Phoca Download extension versions 5.0.0 through 6.1.4 for Joomla contains a reflected XSS flaw in the search GET parameter; attacker-supplied input is reflected unescaped, enabling script execution in a victim's browser. CVSS 4.0 scores it Medium (5.3). No exploitation or patch version is documen...
EUVD-2026-63210
Joomla Extension - phoca.cz - Reflected XSS via pricefrom & priceto filter parameters in Phoca Cart 5.0.0-6.1.7...
CVE-2026-71368
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...
WordPress Flatastic theme <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Flatastic versions = 2.0...
WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Son Bach & Lan Vy HPT Vietnam in WordPress Theme Aora versions = 1.3.19...
CVE-2026-71368
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...
CVE-2026-71368
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...
EUVD-2026-63208
F-RevoCRM contains a cross-site scripting vulnerability. If a user views a crafted page while logged in to the affected product, unintended operations may be performed...
CVE-2026-71368
F-RevoCRM contains a stored/reflected XSS flaw; an authenticated user viewing a crafted page may have unintended actions performed on their session. CVSS 3.0 scores 6.1 MEDIUM (network, no privileges, active user interaction). No exploitation or fix details are provided in the documents. Monitor ...
