CVE-2026-19217

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2026-19217

CVE-2026-19217 affects the Royal Addons for Elementor WordPress plugin (before version 1.7.1065). The vulnerability arises from improper validation of a widget setting used to construct an HTML tag, enabling Stored Cross-Site Scripting (XSS) by users with the Contributor role or higher. Impact is...

EUVD-2026-57108

The Royal Addons for Elementor WordPress plugin before 1.7.1065 does not validate a widget setting used to build an HTML tag before outputting it, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

EUVD-2026-57092

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013 WP Photo Album Plus < 9.2.07.002 - Reflected XSS via lbstart

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013

The WP Photo Album Plus WordPress plugin before 9.2.07.002 does not sanitise and escape a parameter before reflecting it into an inline script block, which could allow unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against anyone who is tricked into opening a crafted...

CVE-2026-17013

The vulnerability affects the WP Photo Album Plus WordPress plugin prior to version 9.2.07.002. The issue is that a parameter is not properly sanitised/escaped before being reflected into an inline script block, enabling unauthenticated attackers to perform Reflected Cross-Site Scripting against ...

CVE-2026-15249 Patterns Kit <= 1.0.3 - Contributor+ Stored XSS via YouTube Popup Link

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-16066 Welcart e-Commerce < 2.11.34 - Author+ Stored XSS via Product Name

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-16066

CVE-2026-16066 affects the Welcart e-Commerce WordPress plugin prior to version 2.11.34. The root cause is failure to sanitize or escape a product field before it is output on product pages, which enables users with the Author role and above to inject arbitrary web scripts that execute in visitor...

CVE-2026-15249

Summary (CVE-2026-15249) : The Patterns Kit WordPress plugin (≤ 1.0.3) is affected by a stored XSS vulnerability: it does not escape a link attribute before a client-side script inserts it into the page, enabling a user with Contributor privileges to store a payload that executes in the browser o...

EUVD-2026-57086

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-15249

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

EUVD-2026-57083

The Patterns Kit WordPress plugin through 1.0.3 does not escape a link attribute before its client-side script inserts it into the page, allowing users with a role as low as Contributor to store a payload that executes in the browser of a user who views the content and clicks the affected element...

CVE-2026-16066

The Welcart e-Commerce WordPress plugin before 2.11.34 does not sanitise or escape a product field before outputting it on the product pages, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any visitor viewing the product page...

CVE-2026-9318

A flaw was found in tablib. This vulnerability, a stored cross-site scripting XSS issue, allows a remote attacker to execute arbitrary JavaScript code. By embedding malicious payloads within dataset titles, which are not properly sanitized during HTML export, an attacker can trigger the execution...

tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

GHSA-GQGW-JGHV-MXWX tablib: Stored XSS in the HTML export via unescaped dataset title

tablib prior to 3.10.0 contains a stored cross-site scripting vulnerability in the HTML export functionality that allows attackers to execute arbitrary JavaScript by embedding malicious payloads in dataset titles, which are interpolated unsanitized into HTML output via the exportbook method in th...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the exportbook function in the HTML format handler. An attacker can execute arbitrary JavaScript in the context of the user's browser by embedding malicious payloads in dataset titles, which are rendered...