CVE-2026-94378 SupportCandy <= 3.5.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'name' Parameter

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-91878

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-94378

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 3.5.3 . The root cause is insufficient input sanitization and output escaping of the 'name' parameter . This allows...

EUVD-2026-91880

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-92243

The Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 5.5.18 . The root cause is insufficient input sanitization and output escaping associated with the 's' parameter . This allows unauthenticated attacke...

CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104492

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-104484

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-104501

Name of the Vulnerable Software and Affected Versions Magic Tooltips For Contact Form 7 versions prior to 1.0.35 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that...

CVE-2026-92243: Improper Neutralization of Input During Web Page Generation

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-85494

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value,...

PT-2026-104482

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

Linux Distros Unpatched Vulnerability : CVE-2026-94635

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issu...

Linux Distros Unpatched Vulnerability : CVE-2026-94633

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affect...

CVE-2026-103909: Improper Neutralization of Input During Web Page Generation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url. ' parameter in all versions up to, and including, 5.5.1.5 du...

CVE-2026-94378: Improper Neutralization of Input During Web Page Generation

The SupportCandy – AI Customer Support Ticket System & Live Chatbot Agent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-104539

Name of the Vulnerable Software and Affected Versions WPC Estimated Delivery Date for WooCommerce versions prior to 4.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks ...

PT-2026-104506

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin for WordPress versions prior to 2.12.3 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting. An attacker can inject arbitrary web scrip...

PT-2026-104505

Name of the Vulnerable Software and Affected Versions Helpdesk Support Ticket System for WooCommerce versions prior to 2.1.7 Description An Insecure Direct Object Reference IDOR exists due to missing validation on a user-controlled key. Authenticated attackers with subscriber-level access or high...