CVE-2026-15253

The Easy Media Replace WordPress plugin (≤0.2.0) fails to sanitise attachment titles before rendering them in HTML attributes in the media library list view, enabling Author+ role users to inject stored XSS executed in the browser of higher-privileged admins. No patch version or exploit code is d...

CVE-2026-14334 Booking calendar, Appointment Booking System <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload

The Booking calendar, Appointment Booking System WordPress plugin through 3.2.36 does not properly sanitize uploaded SVG files, allowing unauthenticated attackers to upload a file that bypasses the Booking calendar, Appointment Booking System WordPress plugin through 3.2.36's script-stripping and...

CVE-2026-14287

The 10Web Booster WordPress plugin (versions before 2.33.5 ) is vulnerable to unauthenticated Stored XSS via Critical CSS Token Bypass . The root cause is a combination of insufficient access token validation on an unauthenticated request handler and failure to escape attacker-supplied stylesheet...

CVE-2026-14287 TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-14334

The Booking calendar, Appointment Booking System WordPress plugin (versions up to 3.2.36) fails to sanitize uploaded SVG files, allowing unauthenticated attackers to inject JavaScript that executes in an administrator's session when reviewing a submitted booking. CVSS 3.1 base score is 8.8 (HIGH)...

EUVD-2026-62263

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as...

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15421 Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-62219

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-15421

The Speed Optimizer WordPress plugin (versions ≤ 7.8.0 ) is vulnerable to Stored Cross-Site Scripting (XSS) via image tag attributes in its Lazy Load Media feature. The root cause is insufficient input sanitization and output escaping in the lazy-load image processing code. An authenticated attac...

EUVD-2026-62208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

EUVD-2026-62210

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

EUVD-2026-62212

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PublishPress PublishPress Series allows Stored XSS. This issue affects PublishPress Series: from n/a through 2.17.0...

EUVD-2026-62205

This Critical severity Stored XSS, PrivEsc Privilege Escalation, and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1, 9.1.0, 9.2.0, 9.3.1, 9.4.0, 9.5.1, 10.0.2, 10.1.0 and 10.2.0 of Confluence Data Center and...

PT-2026-78256

Name of the Vulnerable Software and Affected Versions Speed Optimizer versions prior to 7.8.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This occurs via image tag...

PT-2026-78493

A vulnerability in the web-based management interface of Cisco Industrial Ethernet IE 1000 Series Switches could allow an authenticated, remote attacker to conduct a stored cross-site scripting XSS attack against a user of the interface. This vulnerability is due to insufficient validation of...

PT-2026-78766

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Insufficient input validation in the geostats command allow...

PT-2026-78732

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.2 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description A user with a role possessing the rest properties get...

PT-2026-78755

Name of the Vulnerable Software and Affected Versions Splunk Enterprise versions prior to 10.4.1 Splunk Enterprise versions prior to 10.2.6 Splunk Enterprise versions prior to 10.0.9 Splunk Enterprise versions prior to 9.4.14 Description Splunk Web fails to sufficiently validate dashboard content...

PT-2026-78678

Name of the Vulnerable Software and Affected Versions lemmy-ui versions prior to 0.19.19-beta.1 Description lemmy-ui renders Markdown for post bodies, comment bodies, private messages, and community and site sidebars through the mdToHtml function in src/shared/markdown.ts. This function returns a...