CVE-2026-123860

The Crocoblock JetFormBuilder WordPress plugin (versions n/a through 3.6.8 ) is vulnerable to a Basic XSS (Improper Neutralization of Script-Related HTML Tags in a Web Page) vulnerability. This flaw allows for Code Injection within the web page. No specific remediation or exploit details are prov...

WordPress JetFormBuilder plugin <= 3.6.8 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin JetFormBuilder versions = 3.6.8...

WordPress Cool Formkit Lite plugin <= 2.7.10 - Content Injection vulnerability

Content Injection vulnerability discovered by braintx in WordPress Plugin Cool Formkit Lite versions = 2.7.10...

CVE-2026-123483

The Crocoblock JetFormBuilder WordPress plugin (versions up to and including 3.6.8 ) is vulnerable to a Content Injection vulnerability. The root cause is the Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80), which allows for Basic XSS (Cross-Site Scripting). This flaw e...

CVE-2026-123183

The Active Products Tables for WooCommerce plugin by PluginUs.Net (versions n/a through 2.1.6 ) is vulnerable to a Content Injection vulnerability. This issue stems from Improper Neutralization of Script-Related HTML Tags in a Web Page , leading to Basic XSS . The vulnerability allows for Code In...

CVE-2026-119496

The David Lingren Media LIbrary Assistant WordPress plugin (versions

WordPress Media LIbrary Assistant plugin <= 3.43 - Content Injection vulnerability

Content Injection vulnerability discovered by dzaku in WordPress Plugin Media LIbrary Assistant versions = 3.43...

CVE-2026-119478

The MasterStudy LMS plugin for WordPress (versions through 3.7.56 ) is vulnerable to a Content Injection (Basic XSS) vulnerability. This issue is caused by Improper Neutralization of Script-Related HTML Tags in a web page, allowing for Code Injection . While the vulnerability is documented, speci...

CVE-2026-119490

The Better Notifications for WP plugin (bnfw) by Made with Fuel Ltd. is vulnerable to a Content Injection (Basic XSS) flaw due to the Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80). This vulnerability affects versions from n/a through 1.10.1 . It allows for Code Inject...

CVE-2026-119507

The NotificationX plugin for WordPress (versions up to and including 3.3.6 ) is vulnerable to an Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80), leading to a Basic XSS content injection. This vulnerability allows for Code Injection within the web page. No specific reme...

CVE-2026-119473

The ProfilePress WordPress plugin (versions n/a through 4.17.7 ) is vulnerable to a Content Injection vulnerability (specifically Basic XSS ) due to Improper Neutralization of Script-Related HTML Tags in a web page. This flaw exists within the wp-user-avatar component and allows for Code Injectio...

CVE-2026-120852

The CartFlows plugin for WordPress, versions n/a through 3.3.0 , is susceptible to a Content Injection vulnerability (specifically Basic XSS ). The root cause is the Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80), which allows for code injection. No specific exploit de...

CVE-2026-123469

The Liquid Web / StellarWP The Events Calendar plugin (versions up to and including 6.18.3 ) is vulnerable to a Content Injection flaw. The root cause is the Improper Neutralization of Script-Related HTML Tags in a Web Page (CWE-80) , which allows for Basic XSS . This vulnerability enables Code I...

CVE-2026-39733

The ProfilePress wp-user-avatar WordPress plugin (versions 4.17.7 and below ) is vulnerable to a Basic XSS vulnerability due to the Improper Neutralization of Script-Related HTML Tags in a Web Page . This flaw allows for Code Injection , specifically content injection, which could impact the conf...

WordPress ProfilePress plugin <= 4.17.7 - Content Injection vulnerability

Content Injection vulnerability discovered by Filip Kowalski in WordPress Plugin ProfilePress versions = 4.17.7...

ids_bypass

Disclaimer These programs is for Educational purpose ONLY. Do not use it without permission. injectserver: Proof-Of-Concept for CVE-2018-6794. If as a server side you break a normal TCP 3 way handshake packets order and inject some response data before 3whs is complete then data still will be...

WordPress Ultimate FAQs <= 1.8.24 – Unauthenticated HTML Content Injection

Functions/EWDUFAQImport.php in the ultimate-faqs plugin through 1.8.24 for WordPress allows HTML content injection. id: CVE-2019-17233 info: name: WordPress Ultimate FAQs = 1.8.24 – Unauthenticated HTML Content Injection author: daffainfo severity: medium description: | Functions/EWDUFAQImport.ph...

WordPress myCred plugin <= 4.0.2 - Content Injection vulnerability

Content Injection vulnerability discovered by mroccon in WordPress Plugin myCred versions = 4.0.2...

CVE-2026-21834

HCL AION is affected by a vulnerability where the Content-Security-Policy CSP security response header was missing from application responses. Without this header, the browser does not restrict the sources of scripts and other content, increasing exposure to cross-site scripting and...

CVE-2026-21834

HCL AION is affected by a security vulnerability where application responses lack the Content-Security-Policy (CSP) security response header. The absence of this header prevents the browser from restricting the sources of scripts and other content, which increases exposure to cross-site scripting...