CVE-2026-110384

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21...

CVE-2026-110384 WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21...

CVE-2026-110384 WordPress Fancy Comments WordPress plugin <= 1.2.21 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21...

CVE-2026-110384

The Heateor Support Fancy Comments WordPress plugin (fancy-facebook-comments ) is vulnerable to Reflected Cross-Site Scripting (XSS) due to the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability affects versions from n/a through 1.2.21 . An attacker could pot...

EUVD-2026-103273

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21...

CVE-2026-111601

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-103215

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-111601

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 1.12.0 . The root cause is insufficient input sanitization and output escaping of the 'token_id' parameter. Specifically, while the URL path regex c...

CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-111601 Hippoo Mobile App for WooCommerce <= 1.12.0 - Reflected Cross-Site Scripting via 'token_id' Parameter

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-111601: Improper Neutralization of Input During Web Page Generation

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-116379

Name of the Vulnerable Software and Affected Versions Fancy Comments WordPress versions prior to 1.2.22 Description Improper neutralization of input during web page generation allows Reflected Cross-site Scripting XSS in the Heateor Support Fancy Comments WordPress fancy-facebook-comments...

CVE-2026-110384: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Heateor Support Fancy Comments WordPress fancy-facebook-comments allows Reflected XSS.This issue affects Fancy Comments WordPress: from n/a through 1.2.21...

PT-2026-116435

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

PT-2026-116201

Name of the Vulnerable Software and Affected Versions Hippoo Mobile App for WooCommerce versions prior to 1.13.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user in...

CVE-2026-109701: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PAYCOMET PAYCOMET for WooCommerce paytpv-for-woocommerce allows Reflected XSS.This issue affects PAYCOMET for WooCommerce: from n/a through 5.45...

CVE-2026-96339

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0...

CVE-2026-96339 WordPress Houzez theme <= 4.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0...

CVE-2026-96339

The Houzez WordPress theme, specifically versions up to and including 4.4.0 , is vulnerable to a Reflected Cross-Site Scripting (XSS) issue. This vulnerability is caused by the improper neutralization of input during web page generation (CWE-79). An attacker could potentially execute malicious sc...

EUVD-2026-102809

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Houzez.co Houzez houzez allows Reflected XSS.This issue affects Houzez: from n/a through 4.4.0...