CVE-2026-104003

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...

EUVD-2026-102825

The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.17.5. This is due to the getuserprofilestructure function assembling the front-end profile buffer — which includes raw comment excerpts inlined by...

CVE-2026-107757 Gallery Custom Links <= 2.3.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Author Display Name + Comment HTML Comment Body

The Gallery Custom Links plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname profile.php + comment wp-comments-post.php' parameter in all versions up to, and including, 2.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-107756 Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'displayname + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-95112 Gitea issue reference parsing CPU exhaustion

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

CVE-2026-95112

An authenticated user can cause CPU exhaustion in Gitea by submitting a crafted issue or comment body of approximately 1 MB. The vulnerability occurs because the software scans the entire preceding text for action keywords (like "closes" or "fixes") once for every Markdown link, resulting in quad...

EUVD-2026-93920

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

CVE-2026-95112

When processing issue and comment bodies, Gitea scanned the entire preceding text for action keywords such as "closes" or "fixes" once per Markdown link, giving processing time quadratic in the input size. An authenticated user able to submit issue or comment content could send a crafted body of...

PT-2026-107222

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description An authenticated user can cause a denial of service by submitting a crafted issue or comment body of approximately 1 MB. The system scans the preceding text for action keywords like "closes" or...

CVE-2026-90943

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

EUVD-2026-77580

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-90943 parallax filament-comments through 3.0.0 Stored XSS via Comment Body

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

CVE-2026-90943

parallax/filament-comments (through 3.0.0 ) contains a stored cross-site scripting vulnerability in comment body rendering. The root cause is unescaped output in the comment display views (comments.blade.php) and policy layer, allowing authenticated panel users to inject malicious scripts into co...

CVE-2026-90943: Improper Neutralization of Input During Web Page Generation

parallax filament-comments through 3.0.0 contains a stored cross-site scripting vulnerability in comment body rendering that allows authenticated panel users to inject malicious scripts. Attackers can store XSS payloads in comment bodies that execute in the browsers of other users viewing those...

WordPress TranslatePress plugin <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via Approved Comment Body in Translation Editor vulnerability discovered by momopon1415 in WordPress Plugin TranslatePress versions = 3.2.6...

CVE-2026-18512

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-18512

The TranslatePress WordPress plugin (multilingual/AI translation) is vulnerable to Stored XSS in all versions up to and including 3.2.6 . The root cause is insufficient input sanitization and output escaping of approved comment body content rendered in the Translation Editor Strings Dropdown comp...

CVE-2026-18512 TranslatePress <= 3.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Approved Comment Body in Translation Editor

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...