CVE-2026-3844

CVE-2026-3844 Breeze Cache ≤ 2.4.4 - Unauthenticated Arbitrary File Upload ⚠️ Disclaimer THIS TOOL IS PROVIDED FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. Unauthorized access to computer systems is illegal. Use this tool only on systems you own or have explicit permission to test. The...

CVE-2026-120537

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment storage; originals / language / originallanguage exfiltration from endpoint' parameter in all versions up to, and including, 3.3.8 due to...

EUVD-2026-118974

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment storage; originals / language / originallanguage exfiltration from endpoint' parameter in all versions up to, and including, 3.3.8 due to...

CVE-2026-119167

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119167 TranslatePress <= 3.3.8 - Unauthenticated Stored Cross-Site Scripting via Comment Content via trp-gettext Marker Smuggling and PCRE Backtrack Bypass

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119167

The TranslatePress WordPress plugin (versions

EUVD-2026-118907

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.3.8 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-120677

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

CVE-2026-120677

The Optimole WordPress plugin (versions up to and including 4.2.18 ) is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the comment parameter. This allows an unauthenticated attacker to inject arbitrary web...

EUVD-2026-118603

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This...

CVE-2026-121515

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-119175

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119070

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output escaping. This...

CVE-2026-119175 Flying Images: Optimize and Lazy Load Images for Faster Page Speed <= 2.4.15 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-119175

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.4.15 . The root cause is insufficient input sanitization and output escaping within the 'comment' parameter. This al...

EUVD-2026-118568

The Flying Images: Optimize and Lazy Load Images for Faster Page Speed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.4.15 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-118567

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-121515 FV Flowplayer Video Player <= 7.5.56.7212 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.5.56.7212 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

CVE-2026-121515

The FV Flowplayer Video Player plugin for WordPress (versions

CVE-2026-119070

The Optimole WordPress plugin (versions ≤ 4.2.17 ) is vulnerable to Stored Cross-Site Scripting (XSS) via the comment parameter. The root cause is insufficient input sanitization and output escaping in the URL Replacer component. Attackers can inject arbitrary web scripts that execute when users ...