CVE-2026-13400

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

PT-2026-64942

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-12421 ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-63863

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

CVE-2026-15395

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin is affected by CVE-2026-15395: Stored XSS via the digitalSignature field in all versions up to and including 2.4.18, caused by insufficient input sanitization and output escaping. The vulnerability allows unauthenticated attac...

CVE-2026-57366

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.1 versions...

CVE-2026-57351

Unauthenticated Cross Site Scripting XSS in HandL UTM Grabber = 2.9.2 versions...

PT-2026-54992

Unauthenticated Cross Site Scripting XSS in WPeMatico RSS Feed Fetcher = 2.8.17 versions...

CVE-2026-56040 WordPress Gutenverse Form plugin <= 2.4.7 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Gutenverse Form = 2.4.7 versions...

CVE-2024-49269 WordPress my flatonica theme <= 0.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in my flatonica = 0.0.8 versions...

CVE-2026-42649

Unauthenticated Cross Site Scripting XSS in Favicon Rotator = 1.2.11 versions...

CVE-2026-39514

Unauthenticated Cross Site Scripting XSS in Paid Member Subscriptions = 2.17.3 versions...

CVE-2026-52702 WordPress SEO Redirection plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in SEO Redirection = 9.17 versions...

PT-2026-49354

Unauthenticated Cross Site Scripting XSS in Redirection for Contact Form 7 = 3.2.8 versions...

CVE-2026-9109 GPTranslate <= 2.31 - Unauthenticated Stored Cross-Site Scripting via REST API Translation Storage

The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping...

WordPress LiteSpeed Cache plugin <= 7.7 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin LiteSpeed Cache versions = 7.7...

CVE-2026-45622

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.3, there is an unauthenticated reflected cross-site scripting XSS issue in the public product return form in Vvveb CMS. The customerorderid POST parameter is inserted into the...

EUVD-2026-26744

The Gravity Forms plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to and including 2.10.0. This is due to insufficient input validation and output escaping of Calculation Product field product names when rendered inside Repeater fields. The validat...

WordPress EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder plugin <= 2.5.7 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin EazyDocs versions = 2.5.7...

WordPress Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce plugin <= 1.10.6 - Unauthenticated Reflected Cross-Site Scripting vulnerability

Unauthenticated Reflected Cross-Site Scripting vulnerability discovered by Asaf Mozes in WordPress Plugin Location Picker at Checkout for WooCommerce versions = 1.10.6...