CVE-2026-17090

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' Button Code Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-17090

The Beaver Builder Page Builder (WordPress) is affected by a Stored Cross-Site Scripting flaw in the Button Module settings, up to version 2.10.2.2, caused by insufficient input sanitization and output escaping. Authenticated users with author-level access or higher can exploit this to inject arb...

EUVD-2026-58856

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' Button Code Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-14433

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14433 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14433 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-58833

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14433

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14433

The CVE-2026-14433 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress. The flaw affects the REST API via the business_id parameter and is present in all versions up to and including 4.6.0, due t...

PT-2026-72152

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first name' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-72155

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 5.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73055

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape the color field in attribute-view select options across eight unescaped render sites. An attacker can inject event-handle...

PT-2026-73049

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Improper escaping of database menu metadata during HTML interpolation allows stored values to execute scripts when users open group, view, or field-edit menus. Attackers can inject markup through fiel...

PT-2026-73050

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description A remote code execution issue exists in the Template calculation operator. The software renders user-authored Go templates and stores the output without sanitization. This allows attackers to inject...

PT-2026-73056

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored Cross-Site Scripting XSS occurs because attribute-view field names are stored without HTML escaping and interpolated directly into option elements using innerHTML within the sort menu. An...

PT-2026-72150

The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-72158

The Beaver Builder Page Builder – Drag and Drop Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Button Module 'button' Button Code Setting in all versions up to, and including, 2.10.2.2 due to insufficient input sanitization and output escaping. This makes it...

PT-2026-73051

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Stored cross-site scripting is possible due to a failure to validate or escape table column width values, which allows injection into style attributes. An attacker can use the 'setAttrViewColWidth' AP...

PT-2026-73048

Name of the Vulnerable Software and Affected Versions SiYuan versions prior to 3.7.4 Description Insufficient validation or escaping of annotation fields written to disk via the 'setFileAnnotation' endpoint allows attackers to inject malicious markup. This markup executes as a script within the P...

PT-2026-72140

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'business id' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...