CVE-2026-74920: Improper Neutralization of Input During Web Page Generation

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visito...

CVE-2026-18557: Improper Neutralization of Input During Web Page Generation

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 1.8.42 due to insufficient input sanitization and output escaping. This makes it possible for...

VulnCheck KEV: CVE-2026-39781

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1...

CVE-2026-111233: Improper Neutralization of Input During Web Page Generation

Netgate pfSense CE 2.7.1 through 2.9.0 contains a reflected cross-site scripting vulnerability in firewallrules.php that allows remote attackers to inject script via the unencoded if parameter. When the non-default Require Firewall Interface option is enabled, attackers can lure users with firewa...

PT-2026-114795

Name of the Vulnerable Software and Affected Versions Document Gallery versions prior to 5.1.2 Description An unauthenticated AJAX action fails to properly sanitize and escape user input before reflecting it within an HTML attribute. This leads to a Reflected Cross-Site Scripting XSS issue, where...

CVE-2026-105065: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in 8theme.com XStore xstore allows Reflected XSS.This issue affects XStore: from n/a before 9.7.9...

CVE-2026-109685: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Link Whisper INC Link Whisper Free link-whisper allows Reflected XSS.This issue affects Link Whisper Free: from n/a through 0.9.7...

VulnCheck KEV: CVE-2026-74920

The Document Gallery WordPress plugin through 5.1.1 does not properly sanitise and escape user input before reflecting it inside an HTML attribute in the response of an unauthenticated AJAX action, leading to a Reflected Cross-Site Scripting vulnerability which can be exploited against any visito...

CVE-2026-15180: Improper Neutralization of Input During Web Page Generation

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCMErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2026-108483

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0...

CVE-2026-105066

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

EUVD-2026-101526

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0...

CVE-2026-108483 WordPress Hippoo Mobile App for WooCommerce plugin <= 1.12.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hippooo Hippoo Mobile App for WooCommerce hippoo allows Reflected XSS.This issue affects Hippoo Mobile App for WooCommerce: from n/a through 1.12.0...

CVE-2026-108483

The Hippoo Mobile App for WooCommerce WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions up to and including 1.12.0 . Exploitation details and specific remediation steps are not pro...

CVE-2026-105066 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

EUVD-2026-101525

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

CVE-2026-105066 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

CVE-2026-105066

The SimplyRETS Real Estate IDX WordPress plugin (versions

WordPress Tracking Code Manager plugin <= 2.6.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Suredsi Ulpada cyberdesu in WordPress Plugin Tracking Code Manager versions = 2.6.0...

WordPress Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin <= 1.8.42 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Photo Gallery by 10Web versions = 1.8.42...