CVE-2026-57358

Unauthenticated Cross Site Scripting XSS in Customize My Account for WooCommerce = 4.3.9 versions...

CVE-2026-57349

CVE-2026-57349 affects the WordPress plugin WPeMatico RSS Feed Fetcher (versions

CVE-2026-57358: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Customize My Account for WooCommerce = 4.3.9 versions...

CVE-2026-27402: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Kids Life | Children School WordPress = 5.2 versions...

CVE-2026-57333

CVE-2026-57333 describes an unauthenticated reflected Cross Site Scripting (XSS) vulnerability in the WordPress plugin Link Whisper Free , affecting versions up to and including 0.9.4 . The connected sources consistently identify it as a reflected XSS issue in the Free plugin; no root-cause detai...

CVE-2026-56044 WordPress Blog2Social plugin <= 8.9.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

EUVD-2026-39704

Unauthenticated Cross Site Scripting XSS in Customer Reviews for WooCommerce = 5.110.1 versions...

PT-2026-52758

Unauthenticated Cross Site Scripting XSS in Blog2Social = 8.9.2 versions...

CVE-2026-9643

WP Meta SEO for WordPress insert(). This allows injection of arbitrary scripts that execute when an administrator visits the 404 & Redirects admin page (/wp-admin/admin.php?page=metaseo_broken_link). Exploitation details are not provided beyond the generic flow; no fixes, mitigations, or exploita...

CVE-2025-69140

Unauthenticated Cross Site Scripting XSS in SweetDate Core 1.1.5 versions...

CVE-2026-22328

CVE-2026-22328 corresponds to a reflected XSS in WordPress Theme Auto Repair &lt;= 22.6, described as unauthenticated in the Initial description and reflected XSS in the product detail. CVSS shows Network attack vector, no privileges required, low impact to confidentiality/integrity/availability,...

CVE-2026-39437 WordPress Min Max Step Quantity Limits Manager for WooCommerce plugin <= 5.2.2 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Min Max Step Quantity Limits Manager for WooCommerce = 5.2.2 versions...

CVE-2026-54198: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.35 versions...

CVE-2026-48966

Unauthenticated Cross Site Scripting XSS in Funnel Builder by FunnelKit = 3.15.0.2 versions...

CVE-2025-68840 WordPress iRobots.txt SEO plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in iRobots.txt SEO = 1.1.2 versions...

PT-2026-49444

Unauthenticated Cross Site Scripting XSS in AutomatorWP = 5.6.7 versions...

CVE-2026-48867: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Quiz And Survey Master = 11.1.2 versions...

CVE-2026-40732: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Notification for Telegram = 3.5 versions...

CVE-2026-50231 Lyrion Music Server 9.2.0 Unauthenticated Stored XSS via server.log

Lyrion Music Server 9.2.0 contains an unauthenticated stored cross-site scripting vulnerability in the log viewer that allows attackers to inject malicious scripts by exploiting unescaped template variables. Attackers can inject XSS payloads through search, lines, and path query parameters or by...

CVE-2026-5324

The Brizy – Page Builder plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in all versions up to, and including, 2.8.11 This is due to a combination of missing nonce verification for unauthenticated form submissions, insufficient handling of FileUpload fields when ...