CVE-2026-89427

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 2.8.18 . The root cause is insufficient input sanitization and output escaping of the 's' Search Parameter . An unauthenticated attacker can inject...

CVE-2026-89427 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via 's' Search Parameter

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 's' Search Parameter in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-89047

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-19902

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

CVE-2026-19902

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress (versions up to and including 2.8.18 ) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping on the {search-query} dynamic tag. The replace_ai_tags() function in...

CVE-2026-19902 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

CVE-2026-19902 Ad Inserter <= 2.8.18 - Reflected Cross-Site Scripting via {search-query} Dynamic Tag (Referer Header)

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

EUVD-2026-90545

The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the Referer header in all versions up to, and including, 2.8.18 due to insufficient input sanitization and output escaping on the 'search-query' dynamic tag. When an ad block's code...

EUVD-2026-90543

The Social Media Share Buttons & Social Sharing Icons plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-92412 Five Star Restaurant Reviews < 2.3.14 - Reflected XSS

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request,...

CVE-2026-92412 Five Star Restaurant Reviews < 2.3.14 - Reflected XSS

The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request,...

CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

CVE-2026-87970 If-So Dynamic Content 1.8 - 1.10.1 - Reflected XSS via render_ifso_shortcodes

The If-So Dynamic Content WordPress plugin before 1.10.2 does not escape a request-supplied value before reflecting it in an unauthenticated AJAX response that is served as HTML, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who opens a crafted link...

EUVD-2026-90435

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office Hotel Reservation System Book Now search, where dateto and idroomtype parameters are copied into template variables without validation. Attackers can craft a malicious link containing JavaScript paylo...

EUVD-2026-90436

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the exceptions field of the back-office Transplant a module form. Attackers can craft a malicious link containing JavaScript payload in the exceptions parameter that executes in an authenticated administrator's sessi...

EUVD-2026-90437

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor that fails to escape roomnum, floor, and comment field values in input attributes. Attackers can induce authenticated back-office users to submit crafted POST requests with malicious...

EUVD-2026-90438

QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the back-office room type editor's length of stay fields. Attackers can induce authenticated administrators to submit crafted POST requests with malicious payloads in restrictionminlos and restrictionmaxlos parameter...

PT-2026-103718

Name of the Vulnerable Software and Affected Versions Social Media Share Buttons & Social Sharing Icons versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where maliciou...

PT-2026-103740

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when a site administrator...

PT-2026-103716

Name of the Vulnerable Software and Affected Versions Ad Inserter – Ad Manager & AdSense Ads versions prior to 2.8.19 Description Reflected Cross-Site Scripting is possible via the Referer header due to insufficient input sanitization and output escaping on the search-query dynamic tag. The repla...