CVE-2026-90981 Newsletter <= 9.3.8 - Reflected Cross-Site Scripting via 'nn' Parameter

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nn' parameter in all versions up to, and including, 9.3.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-92622 Strong Testimonials <= 3.3.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'lightbox_class' Shortcode Attribute

The Strong Testimonials plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'lightboxclass' Shortcode Attribute in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-90981

The Newsletter – Send awesome emails from WordPress plugin (versions up to and including 9.3.8 ) is vulnerable to Reflected Cross-Site Scripting via the nn parameter, caused by insufficient input sanitization and output escaping in the dienow() function. An unauthenticated attacker can inject arb...

CVE-2026-89330

The EmbedPress – PDF Embedder, 3D PDF FlipBook, Google Reviews, YouTube Videos, Upload & Embed PDF documents plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'unique' parameter in all versions up to, and including, 4.6.5 due to insufficient input sanitization and outpu...

CVE-2026-84909 Custom Twitter Feeds <= 2.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute

The Custom Twitter Feeds – A Tweets Widget or X Feed Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'buttoncolor' Shortcode Attribute in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14855

The RT Mega Menu WordPress plugin (all versions up to and including 1.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) through the css[left] parameter, processed via the rtmega_update_menu_options AJAX action. The root cause is insufficient input sanitization and output escaping . Authent...

EUVD-2026-82645

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that wil...

CVE-2026-92991

The Biggopti Library , a JavaScript component embedded in multiple WordPress plugins (including Ultimate Post Kit , Ultimate Store Kit , Smart Admin Assistant , Live Copy Paste , BDThemes Prime Slider Lite , BDThemes Element Pack Lite , and Pixel Gallery ), is vulnerable to Cross-Site Scripting (...

CVE-2026-92991 Biggopti Library (Various Versions) - Cross-Site Scripting via display_id from Sigmative API

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that wil...

CVE-2026-92991: Improper Neutralization of Input During Web Page Generation

The Biggop Library is vulnerable to Cross-Site Scripting via the ‘displayid’ parameter from the Sigmative API in various versions due to insufficient output escaping. This makes it possible for attackers who can compromise the Sigmative API server to inject arbitrary web scripts in pages that wil...

CVE-2025-53837: Improper Neutralization of Directives in Dynamically Evaluated Code

XWiki Rendering is a generic rendering system that converts textual input in a given syntax wiki syntax, HTML, etc into another syntax XHTML, etc. Prior to versions 14.10.2 and 15.0 RC1, any user who can edit their own user profile or any other document can execute arbitrary script macros includi...

EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-3769)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'pri...

EulerOS Virtualization 2.11.1 : samba (EulerOS-SA-2026-3471)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html...

EulerOS 2.0 SP10 : samba (EulerOS-SA-2026-3722)

According to the versions of the samba packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A flaw was found in the Samba printing subsystem. Samba passes the client-controlled job description string to the command configured with the 'pri...

EulerOS Virtualization 2.12.1 : samba (EulerOS-SA-2026-3618)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

EulerOS Virtualization 2.11.0 : samba (EulerOS-SA-2026-3558)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Upstream Security Advisories: https://www.samba.org/samba/security/CVE-2007-2447.html...

EulerOS Virtualization 2.12.0 : samba (EulerOS-SA-2026-3672)

According to the versions of the samba packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers tha...

Linux Distros Unpatched Vulnerability : CVE-2026-92973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 < Security 2026 Update 3 Multiple XSS

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, or 11.5 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - A reflected cross site scripting vulnerability exists in Esri Portal for ArcGIS which may allow a...