CVE-2026-105874

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-107867

The Crocoblock JetProductTables WordPress plugin (versions up to and including 1.2.4 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation within the jet-product-tables component. This vulnerability allows...

CVE-2026-107867 WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

EUVD-2026-101015

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

EUVD-2026-101011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-105874 WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-105874

The SureCart WordPress plugin (versions up to and including 4.9.3 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This flaw allows an attacker to execute malicious scripts in a user's browser. While th...

CVE-2026-107428

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107428 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

EUVD-2026-100938

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107428 WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

CVE-2026-107428

The WordPress Paid Videochat Turnkey Site plugin (ppv-live-webcams) versions up to and including 7.5.12 is vulnerable to Reflected Cross-Site Scripting (XSS) . The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability allows an attacker to exec...

CVE-2026-100193

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-100787

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100193 Tutor LMS <= 4.1.0 - Reflected Cross-Site Scripting via 'tab' Parameter

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100193

The Tutor LMS plugin for WordPress (versions up to and including 4.1.0 ) is vulnerable to Reflected Cross-Site Scripting (XSS) via the 'tab' parameter . The root cause is insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts if they can ...

PT-2026-113613

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-100193: Improper Neutralization of Input During Web Page Generation

The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 4.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-107867: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

CVE-2026-110627: Improper Neutralization of Input During Web Page Generation

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...