CVE-2026-78087

The VK Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Group Block 'linkToPost' Feature in all versions up to, and including, 1.126.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-88043 Mang Board WP <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via 'data_type' Parameter

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-88043

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.0 . The root cause is insufficient input sanitization and output escaping associated with the 'data_type' parameter. This allows unauthenticated attackers to inject arbitr...

EUVD-2026-101845

The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'datatype' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-107751

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-107751 Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'username' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-100185

The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'phone' Listing Field in all versions up to, and including, 8.10.2.1 due to insufficient input sanitization and output escaping. This makes it possible f...

CVE-2026-100193

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100153

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERYSTRING / REQUESTURI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-100153 NewStatPress <= 1.4.5 - Unauthenticated Stored Cross-Site Scripting via URL Request Tracking (urlrequested field)

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERYSTRING / REQUESTURI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-77114 Document Gallery <= 5.1.1 - Unauthenticated Stored Cross-Site Scripting

The Document Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dgthumberwebhook' Action Request Body in all versions up to, and including, 5.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

EUVD-2026-100763

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-113611

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERY STRING / REQUEST URI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-113622

The Verified Reviews Avis Vérifiés plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'moderation' parameter in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...

PT-2026-113717

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-107657

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-96301

The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-103478 Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter

The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkoutbillingphone and state / taxid / email' parameter in all versions up to, and including, 7.2.6 due to insufficient input sanitization and output escaping. This...

CVE-2026-100178

The WPAdverts – Classifieds Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.3.4 . The root cause is insufficient input sanitization and output escaping specifically involving the 'adverts_location' parameter. This flaw allows unauthent...

CVE-2026-100178 WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'advertslocation' parameter in all versions up to, and including, 2.3.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...