CVE-2026-15205

The CVE concerns the Paymob for WooCommerce WordPress plugin (versions

EUVD-2026-58596

The Paymob for WooCommerce WordPress plugin before 4.1.9 does not properly sanitise a client-supplied identifier before using it in a SQL query within its public, unauthenticated payment callback, and performs this query before verifying the payment provider's HMAC signature. This allows...

CVE-2026-73037

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

EUVD-2026-58196

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-73037 Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized mcp query parameter

Next AI Draw.io 0.2.1 through 0.4.16 contains a reflected cross-site scripting vulnerability in the mcp query parameter that is interpolated without escaping into HTML and JavaScript. Attackers can craft malicious URLs to execute arbitrary JavaScript in the localhost origin, enabling exfiltration...

CVE-2026-73037

Summary: CVE-2026-73037 affects Next AI Draw.io versions 0.2.1–0.4.16. The issue is a reflected XSS vulnerability in the mcp query parameter, which is interpolated into HTML/JavaScript without proper escaping. Impact (as stated): Attackers can craft malicious URLs to execute arbitrary JavaScript ...

CVE-2026-28154

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...

CVE-2026-28154 WordPress Samex and M.Anh WordPress themes affected by Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...

EUVD-2026-58084

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS. This issue affects Samex - Clean, Minimal Shop...

CVE-2026-28154

CVE-2026-28154 concerns reflected Cross-Site Scripting (XSS) in two WordPress themes: Samex - Clean, Minimal Shop WooCommerce Theme (affected up to version 2.5) and M.Anh - Fashion WooCommerce Theme (affected up to version 1.7). The issue arises from improper input neutralization during web page ...

CVE-2026-73344 WordPress WP Data Access plugin <= 5.5.79 - Cross Site Scripting (XSS) vulnerability

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

CVE-2026-66655 WordPress MultiParcels Shipping For WooCommerce plugin <= 1.30.36 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in MultiParcels Shipping For WooCommerce = 1.30.36 versions...

CVE-2026-66655

CVE-2026-66655 refers to an unauthenticated, reflected Cross Site Scripting (XSS) vulnerability in the WordPress plugin MultiParcels Shipping For WooCommerce , affecting versions

CVE-2026-65580

CVE-2026-65580 describes an unauthenticated Reflected Cross Site Scripting (XSS) vulnerability in the WordPress Agrion theme , affecting versions

CVE-2026-65580 WordPress Agrion theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...

EUVD-2026-57943

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...

CVE-2026-73628

Serendipity versions = 2.3.5 and . In include/functionsrouting.inc.php serveSearch, the sanitisation pipeline runs urldecode after HTML-encoding, so a single URL-encoded HTML payload survives striptags and htmlspecialchars and is then decoded back into live HTML in the page. A crafted search link...