CVE-2026-76128

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-76128 eCommerce Product Catalog <= 3.5.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'style' Shortcode Attribute

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-65357

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-76128

The eCommerce Product Catalog WordPress plugin (all versions up to 3.5.10 ) is vulnerable to Stored Cross-Site Scripting via the 'style' Shortcode Attribute due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or above can inject arbitr...

ROOT-OS-DEBIAN-12-CVE-2026-54371 CVE-2026-54371 in attr - Patched by Root

Root has patched CVE-2026-54371 in the attr package for Root:Debian:12. Multiple fixed versions available...

CVE-2026-19943

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-19943 Gutenverse <= 4.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'titleTag' Block Attribute

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-19943

The Gutenverse WordPress plugin (a page builder and site editor) is vulnerable to Stored Cross-Site Scripting via the titleTag block attribute in all versions up to and including 4.0.2 . The root cause is insufficient input sanitization and output escaping : the malicious titleTag value survives ...

EUVD-2026-65279

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-65273

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cozyHoverEffect Block Attribute in all versions up to, and including, 2.2.16 due to insufficient input sanitization and output...

CVE-2026-75019

The Cozy Blocks – Page Builder for Gutenberg Editor & FSE WordPress plugin is vulnerable to Stored XSS via the cozyHoverEffect Block Attribute in all versions up to and including 2.2.16 . The root cause is insufficient input sanitization and output escaping : an authenticated attacker with contri...

SUSE CVE-2026-10618

Hugo's default fenced-code-block renderer writes attribute values taken from the code-fence info string into the rendered HTML without escaping them. New in markup/internal/attributes/attributes.go converts every attribute value from a byte slice to a string as it is stored, deliberately dropping...

CVE-2026-18547: Improper Neutralization of Input During Web Page Generation

The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Textarea Profile Field with HTML Support DOM Gadget via id Attribute in all versions up to, and including, 2.12....

CVE-2026-38472

A Stored XSS vulnerability exists in the GazellePW (GazellePosterWall) forum reward comments (commit 86c4bedf727691b5a97af42a4864869d18446449 ). Remote attackers can inject arbitrary JavaScript via the c parameter in /forums.php?action=ajax_get_jf. This input is subsequently rendered in the data-...

CVE-2026-76128: Improper Neutralization of Input During Web Page Generation

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EulerOS Virtualization 2.13.1 : expat (EulerOS-SA-2026-3171)

According to the versions of the expat packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : In libexpat before 2.8.1, the computational complexity of attribute name collision checks allows a denial of service via moderately...

PT-2026-81167

The Gutenverse – WordPress Blocks, Page Builder & Site Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'titleTag' Block Attribute in all versions up to, and including, 4.0.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-38472

A Stored XSS vulnerability in forum reward comments in GazellePW GazellePosterWall commit 86c4bedf727691b5a97af42a4864869d18446449 allows remote attackers to inject arbitrary JavaScript via the c parameter in /forums.php?action=ajaxgetjf which is later rendered in the data-tooltip attribute in...