CVE-2026-116545 All-in-One Video Gallery <= 5.0.0 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via 'track' Post Meta 'label' Field

The All-in-One Video Gallery – Video Player & Galleries for YouTube, Vimeo & Self-Hosted Videos plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'customfields.value.label for key='track'' parameter in all versions up to, and including, 5.0.0 due to insufficient...

CVE-2026-118500 Cool FormKit Lite <= 2.7.9 - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via Form Field custom_id Parameter

The Cool FormKit Lite – Advanced Form Builder for Elementor plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'elementordata.formfields.customid' parameter in all versions up to, and including, 2.7.9 due to insufficient input sanitization and output escaping. Thi...

WordPress Media Library Assistant cross-site scripting vulnerability

WordPress Media Library Assistant versions 3.42 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation and may lead to DOM-based cross-site scripting attacks...

Pocket 8.33.0.0 DOM-Based Cross Site Scripting

Pocket versions through version 8.33.0.0 contain a DOM-based cross site scripting vulnerability in articleview-mobile.js that allows crafted saved HTML to execute JavaScript in the application WebView. https://packetstorm.news/download/238178...

PT-2026-130682

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

CVE-2026-111318: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder: The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored…

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

WordPress Royal Addons for Elementor cross-site scripting vulnerability

WordPress Royal Addons for Elementor versions 1.7.1069 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input handling during web page generation and may lead to DOM-based cross-site scripting attacks...

AivahThemes Hostme v2 cross-site scripting vulnerability

AivahThemes Hostme v2 versions 7.0 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from improper input sanitization during web page generation, potentially leading to DOM-based cross-site scripting attacks...

Secret Intelligence Service; UK Intelligence Community UI Kit; Cross-site Script Vulnerability

The Secret Intelligence Service; the UK Intelligence Community UI Kit versions 3.0.0-canary.12 to 3.0.0-canary.48 contain a cross-site scripting vulnerability. This vulnerability arises from the ic-tree-item component, which re-encodes the text in the router-item slot as HTML when tree item...

WordPress Booktics Cross-Site Script Vulnerabilities

WordPress Booktics versions 1.0.29 and earlier have a cross-site scripting vulnerability. This vulnerability stems from improper input during web page generation, and may lead to DOM-based cross-site scripting attacks...

CVE-2026-107764

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.6.7 . The root cause is insufficient input sanitization and output escaping of the url (comment_author_url) parameter. Because WordPress core's esc_url() func...

CVE-2026-95686 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...

EUVD-2026-96285

The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content in all versions up to, and including, 1.12.1 due to insufficient input sanitization and output escaping. This makes ...

CVE-2026-96558

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-100161

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-96216

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcprimageuploadid' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100161

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 1.2.30 . The root cause is insufficient input sanitization and output escaping of the wcpr_image_upload_id parameter. Because the wcpr_image_uplo...

EUVD-2026-96227

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-96558: Improper Neutralization of Input During Web Page Generation

The Quiz and Survey Master QSM – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsmhiddenquestions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-109546

The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr image upload id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticate...