CVE-2026-65517

Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...

CVE-2026-61963

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

CVE-2026-66702

Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...

CVE-2026-66686

Unauthenticated Cross Site Request Forgery CSRF in Plugins Garbage Collector Database Cleanup = 0.14 versions...

CVE-2026-59558

Unauthenticated Cross Site Scripting XSS in Booking Calendar = 11.4.2 versions...

CVE-2026-13400

Simply Schedule Appointments is vulnerable to unauthenticated Stored Cross-Site Scripting in all versions up to and including 1.6.12.2. The root cause is a sanitization-ordering defect: the rendered notification content is decoded back into live HTML after it has already passed through the Simply...

PT-2026-64942

Unauthenticated Cross Site Scripting XSS in Dynamic Pricing With Discount Rules for WooCommerce = 4.5.11 versions...

CVE-2026-15401 VikBooking Hotel Booking Engine & PMS <= 1.8.13 - Unauthenticated Stored Cross-Site Scripting via Custom Field 'vbfX' Parameter

The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vbfX' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-57735

Unauthenticated Cross Site Scripting XSS in Breakdance = 2.7.1 versions...

CVE-2026-57767

Unauthenticated Cross Site Scripting XSS in WP Google Maps Pro = 10.1.02 versions...

CVE-2026-65471

Unauthenticated Cross Site Request Forgery CSRF in Avada Core = 5.15.6 versions...

CVE-2026-12421 ARforms <= 7.2.1 - Unauthenticated Stored Cross-Site Scripting via 'password' Field Values

The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'password' Field Values in all versions up to, and including, 7.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2026-63863

Unauthenticated Cross Site Scripting XSS in Form Vibes – Database Manager for Forms = 1.5.2 versions...

CVE-2026-15395

The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin is affected by CVE-2026-15395: Stored XSS via the digitalSignature field in all versions up to and including 2.4.18, caused by insufficient input sanitization and output escaping. The vulnerability allows unauthenticated attac...

CVE-2026-57366

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.1 versions...

CVE-2026-57351

Unauthenticated Cross Site Scripting XSS in HandL UTM Grabber = 2.9.2 versions...

CVE-2026-57344

Unauthenticated Cross Site Scripting XSS in Classified Listing = 5.4.2 versions...

CVE-2026-27408

Unauthenticated Cross Site Scripting XSS in NativeChurch = 4.8.8.2 versions...

CVE-2026-27404

Unauthenticated Cross Site Scripting XSS in LMS = 9.7 versions...

CVE-2025-69155

CVE-2025-69155 affects the Fitness Zone WordPress Theme up to version 5.7. It is described as an unauthenticated Cross Site Scripting (XSS) vulnerability in the theme, with CVSS v3.1 base score 7.1 (HIGH). Attack vector: NETWORK; Attack complexity: LOW; Privileges required: NONE; User interaction...