CVE-2026-88963: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...

CVE-2026-107764: Improper Neutralization of Input During Web Page Generation

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'url commentauthorurl' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-111122: Improper Neutralization of Input During Web Page Generation

The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

PT-2026-115456

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the href parameter, enabling the injection...

PT-2026-115465

Name of the Vulnerable Software and Affected Versions Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions prior to 1.9.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Bas...

PT-2026-115450

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Stored DOM-Based Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via the comment...

PT-2026-115464

Name of the Vulnerable Software and Affected Versions Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress versions prior to 1.9.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting vulnerability

Authenticated Subscriber+ Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Sevada797 in WordPress Plugin Tutor LMS versions = 4.0.8...

WordPress Opti-Behavior plugin <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter vulnerability discovered by Décio Brandão in WordPress Plugin Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions = 1.9.2.1...

WordPress Opti-Behavior plugin <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting via 'countryname' Location Parameter vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions = 1.9.2.1...

CVE-2026-107870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107870

The Crocoblock JetEngine WordPress plugin is vulnerable to a DOM-Based Cross-Site Scripting (XSS) vulnerability in versions 3.8.16 and below . The flaw is caused by improper neutralization of input during web page generation. While the specific component or file is not specified, the vulnerabilit...

CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

EUVD-2026-101031

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107870: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-83958

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-83960

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-48398

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...