PT-2026-77099

Unauthenticated Cross Site Scripting XSS in Recipe Card Blocks for Gutenberg & Elementor = 3.4.18 versions...

CVE-2026-66629: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

CVE-2026-54570: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

AngleSharp is a .NET library for parsing angle bracket based hyper-texts. Prior to 1.5.0, MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing...

PT-2026-77276

Name of the Vulnerable Software and Affected Versions Otalio Ship Property Management System versions prior to 2.22.0 Description Unescaped stored values in the application security page allow authenticated attackers to escalate privileges via persistent cross-site scripting XSS, a technique wher...

PT-2026-77077

Contributor Cross Site Scripting XSS in GeoDirectory = 2.8.172 versions...

PT-2026-78247

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.40 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target server...

CVE-2026-30250

Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...

PT-2026-77443

Name of the Vulnerable Software and Affected Versions Oracle E-Business Suite Oracle Scripting versions 12.2.3 through 12.2.15 Description An issue exists in the Internal Operations component of the Oracle Scripting product. A low privileged attacker with network access via HTTP can exploit this...

PT-2026-78245

Name of the Vulnerable Software and Affected Versions PublishPress Series versions prior to 2.17.1 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a flaw where malicious scripts are permanently stored on the target server and lat...

PT-2026-76885

Name of the Vulnerable Software and Affected Versions Webkul Bagisto versions prior to 2.4.5 Description A flaw in the Customer-Registration Notification Email component allows remote attackers to perform basic cross site scripting XSS, a technique where malicious scripts are injected into truste...

PT-2026-76924

Name of the Vulnerable Software and Affected Versions Grav Form Plugin versions prior to 9.1.19 Description Field-definition properties in form templates, including prepend, append, spacer text, section text, and select option labels, are not properly escaped. This allows attackers with form...

PT-2026-76917

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A cross-site scripting issue exists in the file upload validation flow. The software fails to escape filenames before inserting them into HTML using the insertAdjacentHTML function. This allows...

CVE-2026-73358: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Affiliates Manager = 2.9.53 versions...

PT-2026-77083

Name of the Vulnerable Software and Affected Versions WPDM – Premium Packages versions prior to 7.0.6 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication...

PT-2026-77104

Unauthenticated Cross Site Scripting XSS in Ultimate Maps by Supsystic 1.5.0 versions...

CVE-2026-68567: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Convert Pro = 1.0.1 versions...

VulnCheck KEV: CVE-2026-66629

Unauthenticated Cross Site Scripting XSS in Kirki = 6.2.3 versions...

PT-2026-77996

Name of the Vulnerable Software and Affected Versions Oracle Commerce Guided Search / Oracle Commerce Experience Manager version 11.4.0 Description An unauthenticated attacker with network access via HTTP can compromise the Experience Manager component. This issue requires human interaction from ...

PT-2026-77066

Contributor Cross Site Scripting XSS in Frontend Admin by DynamiApps = 3.29.10 versions...

PT-2026-77060

Name of the Vulnerable Software and Affected Versions Kirki versions prior to 6.2.4 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by injecting code into a web page. Recommendations Update to a...