cve-2026-64638-banner-poc

CVE-2026-64638 — Universal Banner PoC A single-file, dependency-free PoC generator for the WordPress CVE-2026-64638 reflected HTML-injection on wp-login.php striptags vs. KSES parser differential. It produces a self-submitting trigger page: when the victim opens the file, the page silently POSTs...

CVE-2026-64638

CVE-2026-64638 — XSS2Shell: WordPress Login Page Pre-Auth XSS → Server RCE HackSpeak distribution mirror. This repository is a distribution mirror of the educational XSS2Shell PoC CVE-2026-64638 released by WordSec , with code identical to upstream; upstream is MIT License, Copyright c 2026...

PT-2026-115576

Name of the Vulnerable Software and Affected Versions GoSMTP Pro versions prior to 1.2.4 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs because WordPress comment kses does not strip...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243 Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

EUVD-2026-96213

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-6243

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.28.36 . The root cause is the get_dynamic_values function, which performs text-level find-and-replace operations on post content without utilizing HTML-aw...

CVE-2026-6243: Improper Neutralization of Input During Web Page Generation

The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via kses bypass / mutation XSS in all versions up to, and including, 3.28.36. This is due to the 'getdynamicvalues' function performing text-level find-and-replace operations on post content without...

CVE-2026-92977

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

EUVD-2026-91892

The Real Cookie Banner: GDPR & ePrivacy Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment in all versions up to, and including, 5.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-100107 Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-100107 Kubio AI Page Builder <= 2.9.2 - Unauthenticated Stored Cross-Site Scripting via SVG Comment Content (KSES Allowlist Bypass)

The Kubio AI Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.9.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary...

CVE-2026-89412 TranslatePress <= 3.3.5 - Unauthenticated Stored Cross-Site Scripting via Translation Memory Suggestion Panel

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Translation Memory Suggestion Panel v-html on suggestion.original in all versions up to, and including, 3.3.5 due to insufficient input sanitization and outp...

CVE-2026-2422

WP Composer – The Easiest Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 1.0.5 . The flaw resides in the pbwp_raw_shortcode shortcode handler, which decodes Base64-encoded content and outputs it directly without sanitization or e...

PT-2026-95223

Name of the Vulnerable Software and Affected Versions RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg versions prior to 1.5.3 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Si...

PT-2026-95289

Name of the Vulnerable Software and Affected Versions VK All in One Expansion Unit versions prior to 9.118.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs vi...

EUVD-2026-71844

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77263 iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86311

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-75134

SEOWriting plugin for WordPress through 1.12.5 contains a stored cross-site scripting vulnerability that allows authenticated contributors to inject malicious JavaScript by exploiting an overly permissive KSES allowlist that explicitly permits the onload event handler on iframe elements. Attacker...