16757 matches found
CVE-2026-95809
The Opti-Behavior plugin for WordPress (versions
CVE-2026-95686
The Opti-Behavior WordPress plugin (versions
CVE-2026-95686 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...
CVE-2026-95686 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...
EUVD-2026-102664
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...
EUVD-2026-102511
Memory corruption in DOM in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: High...
PT-2026-115456
Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the href parameter, enabling the injection...
CVE-2026-95686: Improper Neutralization of Input During Web Page Generation
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...
PT-2026-124210
TuxCare rebuilt react-server-dom-webpack to address 1 CVE. Fixed in 19.2.0-tuxcare.6...
PT-2026-115460
Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.9 Description Insufficient input validation in the Topbar component's back button handler allows unauthenticated attackers to perform DOM-Based...
PT-2026-115465
Name of the Vulnerable Software and Affected Versions Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions prior to 1.9.2.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Bas...
CVE-2026-95809: Improper Neutralization of Input During Web Page Generation
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'countryname' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization...
PT-2026-124211
TuxCare rebuilt react-server-dom-webpack to address 4 CVEs. Fixed in 19.2.0-tuxcare.7...
CVE-2026-88963: Improper Neutralization of Input During Web Page Generation
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to DOM-Based Cross-Site Scripting via the 'redirecturl' parameter in versions up to, and including, 4.0.8 This is due to insufficient input validation in the Topbar component's back button handler. This makes ...
CVE-2026-111122: Improper Neutralization of Input During Web Page Generation
The SiteOrigin CSS plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href' parameter in all versions up to, and including, 1.6.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...
PT-2026-124092
TuxCare rebuilt @unhead/dom to address 2 CVEs. Fixed in 1.11.20-tuxcare.1...
PT-2026-124618
TuxCare rebuilt @storybook/react-dom-shim to address 1 CVE. Fixed in 7.0.7-tuxcare.1...
PT-2026-125569
TuxCare rebuilt happy-dom to address 1 CVE. Fixed in 20.8.8-tuxcare.1...