CVE-2026-105882 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8...

CVE-2026-105066 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

CVE-2026-89069

Progress MOVEit Transfer contains a Stored Cross-Site Scripting (XSS) vulnerability within the Ad Hoc module caused by improper neutralization of input during web page generation. This issue affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . The vulnerability carries a ...

CVE-2026-107870

The Crocoblock JetEngine WordPress plugin is vulnerable to a DOM-Based Cross-Site Scripting (XSS) vulnerability in versions 3.8.16 and below . The flaw is caused by improper neutralization of input during web page generation. While the specific component or file is not specified, the vulnerabilit...

EUVD-2026-101015

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

EUVD-2026-98298

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Griden Responsive Slider responsive-slider allows Stored XSS.This issue affects Responsive Slider: from n/a through 0.1.9...

CVE-2026-54867

The Griden Responsive Slider WordPress plugin (versions 0.1.9 and below ) is vulnerable to Stored Cross-Site Scripting (XSS) . This is caused by the Improper Neutralization of Input During Web Page Generation , allowing an attacker to inject malicious scripts. Exploitation details are not provide...

CVE-2026-54869

The Impress for IDX Broker WordPress plugin (specifically the idx-broker-platinum component) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability. This issue is caused by the improper neutralization of input during web page generation . The vulnerability impacts versions from n/a th...

EUVD-2026-98295

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in wpweaver Weaver Xtreme Theme Support weaverx-theme-support allows Stored XSS.This issue affects Weaver Xtreme Theme Support: from n/a through 7.0.1...

EUVD-2026-97305

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Igor Funa Ad Inserter ad-inserter allows Stored XSS.This issue affects Ad Inserter: from n/a through 2.8.18...

CVE-2026-107865 WordPress JetMenu plugin <= 3.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetMenu jet-menu allows Stored XSS.This issue affects JetMenu: from n/a through 3.0.5...

CVE-2026-107865

The Crocoblock JetMenu plugin (versions through 3.0.5 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to the Improper Neutralization of Input During Web Page Generation . This vulnerability allows an attacker to store and execute malicious scripts in the context of the application...

CVE-2026-107866

The Crocoblock JetElements For Elementor plugin (jet-elements) is vulnerable to Stored Cross-Site Scripting (XSS) due to the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability affects versions from n/a through 2.9.2.3 . Exploitation of this flaw can allow an ...

CVE-2026-107866 WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3...

CVE-2026-107866 WordPress JetElements For Elementor plugin <= 2.9.2.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3...

CVE-2026-94160 WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in themeStek ThemeStek Extras for LabtechCO Theme themestek-labtechco-extras allows Reflected XSS.This issue affects ThemeStek Extras for LabtechCO Theme: from n/a through 8.4...

CVE-2026-102388 WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-93951 WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0...

CVE-2026-94063

The ThemeREX Education Center WordPress theme is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 3.6.12 . Exploitation details are not provided in the documents, ...

EUVD-2026-95730

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8...