198 matches found
Site Reviews < 7.2.5 - Unauthenticated Stored XSS
Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...
CVE-2026-56011-Lab
CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...
CVE-2026-93526
Unauthenticated Cross Site Scripting XSS in Event Tickets = 5.29.4 versions...
CVE-2026-95529 WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Calculated Fields Form = 5.5.1.1 versions...
CVE-2026-94176 WordPress Mang Board WP plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Mang Board WP = 2.4.1 versions...
CVE-2026-95528: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Core Web Vitals & PageSpeed Booster = 1.0.31 versions...
CVE-2026-87917 MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...
EUVD-2026-77084
The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...
EUVD-2026-75534
Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...
EUVD-2026-75535
Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...
CVE-2026-84816: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...
PT-2026-89440
Unauthenticated Cross Site Scripting XSS in Page Visits Counter Lite = 1.2.3 versions...
CVE-2026-79638
Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script...
CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...
PT-2026-86993
Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...
CVE-2026-84848
Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...
CVE-2026-84765
Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...