CVE-2026-12477

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-11780

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-59867

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15726

The Serious Slider WordPress plugin is vulnerable to Stored Cross‑Site Scripting via the theme shortcode attribute in all versions up to and including 1.4.0, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject a...

CVE-2026-15726 Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15726

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15726 Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15963

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

EUVD-2026-59866

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to generic SQL Injection via 'randoncategory' Quiz Option in all versions up to, and including, 11.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on t...

CVE-2026-15066

The CVE-2026-15066 entry concerns the WordPress plugin Loco Translate. All versions up to 2.8.7 are reported vulnerable to Stored Cross-Site Scripting via PO file extracted comments caused by insufficient input sanitization and output escaping. Authenticated users with translator-level access or ...

EUVD-2026-59864

The Loco Translate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via PO File Extracted Comments in all versions up to, and including, 2.8.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with translator-level...

EUVD-2026-59860

The Quiz and Survey Master QSM – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'questiontitle' parameter in all versions up to, and including, 11.2.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-11780

Product/Component: Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker WordPress plugin. Flaw: Stored Cross-Site Scripting via the parameter 'question_title' (also referred to as 'question title' in some sources) due to insufficient input sanitization and output escaping. Versions affected:...

EUVD-2026-59857

The Fullscreen Galleria plugin for WordPress is vulnerable to generic SQL Injection via 'href' Attribute in Post Content in all versions up to, and including, 1.6.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This make...

CVE-2026-16079

The CVE concerns the WordPress Fullscreen Galleria plugin (

CVE-2026-12477

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-12477 Gravity Booster <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-12477

The CVE-2026-12477 entry concerns the Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress. A Stored Cross‑Site Scripting (XSS) flaw exists in admin settings across all versions up to and including 5.26, caused by insufficient input sanitization and output escaping. The vulne...

EUVD-2026-59856

The Gravity Booster – Styles & Layouts for Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.26 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

CVE-2026-2487

CVE-2026-2487 concerns the WordPress plugin “Admin Custom Login.” The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in admin settings, affecting all versions up to and including 3.6.4. The root cause is insufficient input sanitization and output escaping, allowing an authenticated att...