WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Ogency versions = 1.0.0...

WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Treck versions = 1.0.0...

WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme KuteShop versions = 4.2.9...

WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Biolife versions = 3.2.3...

WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme TechOne versions = 3.0.3...

WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Theme Armania versions = 1.4.8...

WordPress Magee Shortcodes plugin <= 2.1.1 - Reflected XSS vulnerability

Reflected XSS vulnerability discovered by Enrico Marcolini, Claudio Marchesini, Dottor Marc in WordPress Plugin Magee Shortcodes versions = 2.1.1...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-105316

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971 If-So Dynamic Content 1.4.4 - 1.10.1 - Reflected XSS via 'message' Parameter

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

EUVD-2026-94188

The If-So Dynamic Content WordPress plugin before 1.10.2 does not validate the URL scheme of a request-supplied value before reflecting it into a link on an admin page, allowing attackers to execute arbitrary JavaScript in the browser of a logged-in user who opens a crafted link...

CVE-2026-87971

The If-So Dynamic Content WordPress plugin versions before 1.10.2 (specifically versions 1.4.4 through 1.10.1) is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is a failure to validate the URL scheme of a request-supplied value, which is then reflected into a link on an admi...

CVE-2026-105316

The Magee Shortcodes WordPress plugin (versions

CVE-2026-105316 Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

EUVD-2026-94185

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

CVE-2026-105316 Magee Shortcodes <= 2.1.1 - Reflected XSS via live_preview and magee_create_shortcode Actions

The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available to unauthenticated users, before reflecting it back in the response, leading to Reflected Cross-Site Scripting...

PT-2026-107408

Name of the Vulnerable Software and Affected Versions Magee Shortcodes WordPress plugin versions prior to 2.1.2 Description Reflected Cross-Site Scripting occurs because the plugin fails to sanitize and escape user input in certain AJAX actions available to unauthenticated users before reflecting...

CVE-2026-94670: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms allows Reflected XSS. This issue affects Everest Forms: from n/a through 3.6.1...

CVE-2025-70519: Improper Neutralization of Input During Web Page Generation

The device log component of Fanvil x7a firmware version 2.6.0.1182 does not properly sanitize or encode reflected user supplied data. The lack of sanitization allows for the injection of HTML which can be used to execute malicious JavaScript code on any target browser which renders the device log...