CVE-2026-63459 Vendure: Stored XSS in the Admin Dashboard via unsafe HTML-stripping (innerHTML) of entity descriptions

Vendure is an open-source headless commerce platform. Prior to 3.6.5, RichTextDescriptionCell in packages/dashboard/src/lib/components/shared/table-cell/order-table-cell-components.tsx attempts to strip markup by assigning an administrator-controlled description to a live element's innerHTML and...

PT-2026-94343

Name of the Vulnerable Software and Affected Versions Vendure versions prior to 3.6.5 Description Stored cross-site scripting XSS exists in the admin dashboard due to unsafe HTML stripping in the RichTextDescriptionCell component within...

CVE-2026-85589

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

EUVD-2026-71012

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-85589: Missing Authorization

phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only authentication without permission checks. Any authenticated user can access these endpoints to read site-wide search statistics and...

CVE-2026-78364

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

EUVD-2026-68158

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364 MW WP Form < 5.1.6 - Editor+ Stored XSS via Inquiry Data List

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364

The MW WP Form WordPress plugin, in versions prior to 5.1.6 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is a failure to properly sanitise and escape certain form settings before they are rendered on an admin dashboard page. This flaw allows users with permissions as low ...

PT-2026-83526

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

CVE-2026-78364: Improper Neutralization of Input During Web Page Generation

The MW WP Form WordPress plugin before 5.1.6 does not sanitise and escape some of its form settings before outputting them back in an admin dashboard page, which could allow users with a role as low as Editor to perform Stored Cross-Site Scripting attacks against high privilege users such as admi...

Exploit for CVE-2026-31367

💥 CVE-2026-31367: EITS Admin Dashboard v2.4.0 - RCE PoC !P...

CVE-2026-15604

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

EUVD-2026-59893

The Toocheke Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10 via the 'seriesbgcolor' post meta field. This is due to insufficient input sanitization in the toochekeseriesbgcolorsave function which stores the raw $POST value in pos...

CVE-2026-15604

The CVE-2026-15604 entry concerns the Toocheke Companion WordPress plugin. It describes a Stored Cross-Site Scripting (Stored XSS) flaw in versions up to 2.10, caused by insufficient input sanitization in toocheke_series_bg_color_save() (stores raw $_POST in post meta) and inadequate output escap...

PT-2026-73107

Name of the Vulnerable Software and Affected Versions Toocheke Companion versions prior to 2.11 Description The Toocheke Companion plugin for WordPress contains a Stored Cross-Site Scripting issue. This occurs because the toocheke series bg color save function fails to properly sanitize input fro...

CVE-2026-28175

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

EUVD-2026-57736

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...

CVE-2026-18146

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Notification Smartcode Values in all versions up to, and including, 6.2.11 due to insufficient input sanitization and output escaping...