CVE-2026-28143

Forminator plugin for WordPress is affected by CVE-2026-28143: unauthenticated XSS in versions up to and including 1.56.0. The vulnerability arises in the plugin code path handling input that can be crafted by an attacker without authentication. Impact, as described in the sources, is Cross Site ...

EUVD-2026-53940

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-28082

CVE-2026-28082 affects the WordPress JetEngine plugin up to version 3.8.13.1, describing an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected sources confirm the vulnerability existence and affected product/version but do not provide concrete technical details such as the ex...

WebExploitation-Notes

BookSheetCTF - Web Security CheatSheet & Concept Guide Selama...

CVE-2026-18501

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

EUVD-2026-53926

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501

The CVE concerns the UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress. It is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to and including 1.2.69, caused by insufficient input sanitizati...

WordPress WP Full Stripe Free plugin <= 8.5.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Full Stripe Free versions = 8.5.0...

CVE-2026-8166

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Logo Software Industry and Trade Inc. E-Logo Purchasing Portal allows Stored XSS. This issue affects e-Logo Purchasing Portal: before 1.52...

CVE-2026-5158

The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'inputPlaceHolder' parameter in all versions up to, and including, 5.0.13 due to insufficient input sanitization and output escaping. This makes it...

CVE-2025-15028

The FormGent – Next-Gen AI Form Builder for WordPress with Multi-Step, Quizzes, Payments & More plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission fields in all versions up to, and including, 1.9.2 due to insufficient input sanitization and output escaping. This...

WordPress Houzez Property Feed plugin <= 2.5.48 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Houzez Property Feed versions = 2.5.48...

WordPress King Addons for Elementor plugin < 51.1.76 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by V1T in WordPress Plugin King Addons for Elementor versions 51.1.76...

CVE-2026-8166

CVE-2026-8166 describes a Stored XSS vulnerability in Logo Software Industry and Trade Inc.’s e-Logo Purchasing Portal , exploitable by inserting malicious input that is not properly neutralized during web page generation. The issue affects the portal before version 1.52. The underlying cause is ...