EUVD-2026-49657

Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...

EUVD-2026-49662

Unauthenticated Cross Site Scripting XSS in GetGenie = 4.4.3 versions...

EUVD-2026-49659

Unauthenticated Cross Site Scripting XSS in BackWPup = 5.7.4 versions...

EUVD-2026-49655

Unauthenticated Cross Site Scripting XSS in Anti Spam and list cleaner AcyChecker = 1.8.1 versions...

EUVD-2026-49663

Unauthenticated Cross Site Scripting XSS in Ultimate Addons for Contact Form 7 =3.5.45 versions...

EUVD-2026-49666

Unauthenticated Cross Site Scripting XSS in miniorange otp verification = 5.5.1 versions...

EUVD-2026-49669

Cross-site scripting XSS vulnerability in Modules/Docs/DocsController.php in Milk admin =0.9.8 allows remote attackers to inject arbitrary web script or HTML via the action parameter in a crafted request...

EUVD-2026-49665

Unauthenticated Cross Site Scripting XSS in Spam protection, AntiSpam, FireWall by CleanTalk = 6.82 versions...

WordPress Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin <= 2.2.11 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cozy Blocks versions = 2.2.11...

CVE-2026-48060: Improper Neutralization of Input During Web Page Generation

Litestar is an Asynchronous Server Gateway Interface ASGI framework. Prior to version 2.20.0, Litestar instances which use a template engine in conjunction with CSRF protection are vulnerable to HTML Injection which can be escalated to Cross Site Scripting due to the contents of the CSRF cookie...

PT-2026-65387

Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...

CVE-2026-14515: Improper Neutralization of Input During Web Page Generation

IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack...

CVE-2026-7775: Improper Neutralization of Input During Web Page Generation

IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 and IBM Sterling File Gateway 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.12, and 6.2.2.0 through 6.2.2.01 is vulnerable to stored cross-site scripting. This vulnerability allows a...

CVE-2026-13440: Improper Neutralization of Input During Web Page Generation

The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'messagepopup' parameter in all versions up to, and including, 2.1.0 due to insufficient input sanitization and...

CVE-2026-44387: Improper Neutralization of Input During Web Page Generation

ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user's web browser...

PT-2026-65482

Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data were interpolated directly into HTML used to construct the modal headers. An attacker able to supply or modify graph data could insert a malicious...

PT-2026-65423

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in THEWP Digital Solutions News Theme V8 allows Reflected XSS. This issue affects News Theme V8: through 16.06.2026...

PT-2026-65456

The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Readonly User Field via pmpro member profile edit Shortcode in all versions up to, and including, 3.8.1 due to insufficient input...

PT-2026-65407

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'heading size' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

PT-2026-65457

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'postMeta.font.size' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and...