CVE-2026-9239

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text aria-label attribute in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-114217

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text aria-label attribute in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9239

The Meow Gallery plugin for WordPress (versions up to and including 5.5.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the Attachment Alt Text (aria-label attribute). The root cause is insufficient input sanitization and output escaping; specifically, the sanitize_text_field() functio...

CVE-2026-9239 Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text aria-label attribute in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9239 Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text aria-label attribute in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-9239: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label…

The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text aria-label attribute in all versions up to, and including, 5.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-100645

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls...

CVE-2026-100645 SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls...

CVE-2026-100645 SiYuan 3.7.0 before 3.8.4 Stored XSS via Gallery Kanban

SiYuan versions 3.7.0 before 3.8.4 contain a stored cross-site scripting vulnerability in gallery and kanban database renderers where field descriptions are not escaped in aria-label attributes. In the Electron desktop app with nodeIntegration enabled, attackers can inject JavaScript that calls...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16649

Gravity Forms for WordPress (all versions up to and including 2.10.5 ) is vulnerable to unauthenticated Stored Cross-Site Scripting via the Post Body Field Value. The root cause is insufficient input sanitization and output escaping: wp_kses_post permits the required HTML tags and attributes, whi...

CVE-2026-77830 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-71878

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77830

The Spam protection, Honeypot, Anti-Spam by CleanTalk WordPress plugin (versions ≤ 6.86 ) contains a Stored Cross-Site Scripting vulnerability in the Comment Content aria-label Placeholder , caused by insufficient input sanitization and output escaping. Authenticated attackers with custom-level a...

CVE-2026-77830 Spam protection, Honeypot, Anti-Spam by CleanTalk <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77830: Improper Neutralization of Input During Web Page Generation

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86331

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16649: Improper Neutralization of Input During Web Page Generation

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

WordPress Spam protection, Honeypot, Anti-Spam by CleanTalk plugin <= 6.86 - Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder vulnerability

Unauthenticated Stored Cross-Site Scripting via Comment Content aria-label Placeholder vulnerability discovered by theviper17y in WordPress Plugin Spam protection, AntiSpam, FireWall by CleanTalk versions = 6.86...

CVE-2026-75917

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file-tree picker's hover-tooltip generation app/src/util/pathName.ts, getLeaf/movePathTo used by the 'move/link to' path-selection dialogs, where document metadata fields bookmark, alias, memo, and an alternate name field a...