PT-2026-67665

Name of the Vulnerable Software and Affected Versions The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin versions prior to 1.8.2 Description An unauthenticated user can upload arbitrary files because the plugin fails to validate th...

CVE-2026-16548: Unrestricted Upload of File with Dangerous Type

The Chat Widget: Floating Customer Support Button for 30+ Channels, Supporting SMS, Calls, and Chat WordPress plugin before 1.8.2 does not validate the type, extension, content, or size of files submitted to its public response endpoint and stores them under the uploads directory, so an...

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49132

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

CVE-2026-49132 OPNsense < 26.1.9 Stored XSS via Certificate Description Field

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

EUVD-2026-52433

OPNsense before 26.1.9 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject arbitrary HTML or JavaScript by embedding payloads in the certificate description field via the trust certificate API. The unsanitized description value is persisted and later...

PT-2026-67506

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.9 Description Authenticated attackers can perform a stored cross-site scripting attack by injecting arbitrary HTML or JavaScript into the certificate description field. This occurs via the trust certificate API,...

CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...

CVE-2026-14841 King Addons for Elementor < 51.1.76 - Reflected XSS via Posts Grid Widget

The King Addons for Elementor WordPress plugin before 51.1.76 does not escape a user-supplied grid setting before reflecting it into an HTML attribute in an unauthenticated AJAX response, allowing attackers to execute arbitrary JavaScript in the browser of a visitor who is tricked into loading a...

CVE-2026-14845

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users...

CVE-2026-13392

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-13392

The ElementsKit Elementor Addons WordPress plugin (versions before 3.10.01 ) is vulnerable to PHP Code Injection because it fails to sanitize custom-widget definitions saved by users with administrative privileges. These definitions are written verbatim into a generated PHP file that the plugin s...

EUVD-2026-51433

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-13392 ElementsKit Lite < 3.10.01 - Subsite Administrator+ PHP Code Injection via Custom Widget Builder (Multisite)

The ElementsKit Elementor Addons WordPress plugin before 3.10.01 does not prevent a custom-widget definition saved by a user with administrative capabilities from being written verbatim into a generated PHP file that the ElementsKit Elementor Addons WordPress plugin before 3.10.01 subsequently...

CVE-2026-14845 NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users...

CVE-2026-14845 NewStatPress < 1.4.5 - Unauthenticated Stored XSS via Top Post Widget

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users...

CVE-2026-14845

The NewStatPress WordPress plugin, specifically versions before 1.4.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape data received from unauthenticated visitor requests before it is stored and subsequently displayed within one of...

CVE-2026-14845: Improper Neutralization of Input During Web Page Generation

The NewStatPress WordPress plugin before 1.4.5 does not sanitise and escape data derived from unauthenticated visitor requests before storing it and later outputting it in one of its widgets, which could allow unauthenticated attackers to perform Stored Cross-Site Scripting attacks against users...

PT-2026-66690

Name of the Vulnerable Software and Affected Versions ElementsKit Elementor Addons versions prior to 3.10.01 Description An issue exists where custom-widget definitions saved by users with administrative privileges are written verbatim into a generated PHP file, which is subsequently executed by...