CVE-2026-89100

The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 4.0.17 . The root cause is insufficient input sanitization and output escaping specifically via the '#response' URL Fragment . This allows unau...

CVE-2026-103912

The JetFormBuilder WordPress plugin (versions 3.6.6 and below ) is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping involving the parameter. Unauthenticated attackers can inject arbitrary web scripts by tricking ...

CVE-2026-103912 JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the '' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-103912: Improper Neutralization of Input During Web Page Generation

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the ' ' parameter in all versions up to, and including, 3.6.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Zenith-sec in WordPress Plugin JetFormBuilder versions = 3.6.6...

WordPress All in One SEO – AI SEO Plugin to Boost SEO Rankings & Traffic (Schema, Local SEO, Sitemap & SEO Insights) plugin <= 5.0.1.1 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by mak3bread in WordPress Plugin All In One SEO Pack versions = 5.0.1.1...

WordPress Ivory Search – WordPress Search Plugin plugin <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by @nacento in WordPress Plugin Ivory Search versions = 5.5.18...

WordPress Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting vulnerability

Reflected DOM-Based Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Calculated Fields Form versions = 5.5.1.5...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url.' parameter in all versions up to, and including, 5.5.1.5 due...

CVE-2026-103909

The Calculated Fields Form – AI Form Builder for WordPress plugin is vulnerable to Reflected DOM-Based Cross-Site Scripting (XSS) in all versions up to and including 5.5.1.5 . The flaw arises from insufficient input sanitization and output escaping within the arbitrary (whichever names the admin ...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538 LearnPress <= 4.4.7 - Reflected DOM-Based Cross-Site Scripting via 'orderby' Parameter

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538

The LearnPress – WordPress LMS Plugin for WordPress (versions up to and including 4.4.7 ) is vulnerable to Reflected DOM-Based Cross-Site Scripting . The flaw exists in the 'orderby' parameter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbit...

EUVD-2026-91895

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92243 Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-104489

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-92538: Improper Neutralization of Input During Web Page Generation

The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'orderby' parameter in all versions up to, and including, 4.4.7 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-103909: Improper Neutralization of Input During Web Page Generation

The Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More plugin for WordPress is vulnerable to Reflected DOM-Based Cross-Site Scripting via the 'arbitrary whichever names the admin bound via url. ' parameter in all versions up to, and including, 5.5.1.5 du...

PT-2026-104503

Name of the Vulnerable Software and Affected Versions Calculated Fields Form – AI Form Builder for WordPress – Contact, Payment, Quote, Quiz & More versions prior to 5.5.1.6 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected...