CVE-2026-119162

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output...

EUVD-2026-114603

The User Submitted Posts – Enable Users to Submit Posts from the Front End plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'user-submitted-content' parameter in all versions up to, and including, 20260916 due to insufficient input sanitization and output...

EUVD-2026-114586

The Firelight Lightbox WordPress plugin before 2.3.24 does not properly escape image attribute values before processing them in the browser, which could allow users with contributor-level access and above to inject arbitrary web scripts that execute when another user views or previews the affecte...

CVE-2026-115840: e4jvikwp VikRentCar Car Rental Management System: The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'poplink' parameter in all versions up to, and including, 1.4.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-117182

An authenticated cross-site scripting XSS vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL...

CVE-2026-117182: n/a: An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0…

An authenticated cross-site scripting XSS vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted URL...

CVE-2026-111318

The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and...

CVE-2026-103485

The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-112684

The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description XML element in the imported feed' parameter in all versions up to, and including, 5.2.12 due to...

PT-2026-127882

The VikRentCar Car Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'className' parameter in all versions up to, and including, 1.4.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

PT-2026-127860

The Document Embedder – let visitors read files without downloading plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'content post content containing block JSON documentSource.doc' parameter in all versions up to, and including, 2.4.0 due to insufficient input...

VulnCheck KEV: CVE-2025-14657

The Eventin – Event Manager, Events Calendar, Event Tickets and Registrations plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'postsettings' function in all versions up to, and including, 4.0.51. This makes it possible for...

CVE-2026-110703

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent' parameter in all versions up to, and including, 2.8.191 due to insufficient input sanitization and output escaping. This makes ...

EUVD-2026-102668

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'countryname' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization...

CVE-2026-95809 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'countryname' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization...

EUVD-2026-102610

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-115451

Name of the Vulnerable Software and Affected Versions Salon Booking System – Appointment Booking for Salons, Barbershops & Spas versions prior to 10.32.0 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.191 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'postcontent' parameter, allowing storage-type cross-site scripting attacks. Authentication attackers with...

SiteOrigin CSS Cross-Site Scripting Vulnerabilities

SiteOrigin CSS 1.6.7 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the 'href' parameter, allowing for storage-type DOM-based cross-site scripts. Unverified attackers can inject arbitrary web script...

WordPress WPConsent Cross-Site Script Vulnerability

WordPress WPConsent versions 1.1.9 and earlier have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for comment content. It involves a noise key mechanism in the Simple HTML DOM parser, allowing for stored cross-site scripting...