CVE-2026-66574 WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-66574 WordPress Element Pack Elementor Addons plugin <= 8.8.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

EUVD-2026-81495

Contributor Cross Site Scripting XSS in Element Pack Elementor Addons = 8.8.3 versions...

CVE-2026-66572

CVE-2026-66572 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress JetBlog plugin (versions

CVE-2026-66572 WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

CVE-2026-66572 WordPress JetBlog plugin <= 2.4.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

CVE-2026-66573 WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

CVE-2026-66573

CVE-2026-66573 is a Contributor-level Cross Site Scripting (XSS) vulnerability in the WordPress JetTabs plugin, affecting versions 2.3.3.1 and earlier . The vulnerability was discovered by nh4tvd and rated CVSS 3.1 6.5 (Medium) with a changed scope, indicating potential impact beyond the vulnerab...

EUVD-2026-81494

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

CVE-2026-66573 WordPress JetTabs plugin <= 2.3.3.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in JetTabs = 2.3.3.1 versions...

EUVD-2026-81493

Contributor Cross Site Scripting XSS in JetBlog = 2.4.10 versions...

WordPress Brizy – Page Builder plugin <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Athiwat Tiprasaharn Jitlada, Itthidej Aramsri Boeing777, Tharadol Suksamran d3kc4rt1 in WordPress Plugin Brizy versions = 2.8.14...

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

CVE-2026-91019 Event Booking Manager for WooCommerce < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

WordPress Event Booking Manager for WooCommerce plugin < 5.6.0 - Contributor+ Payment Gateway Credential Disclosure vulnerability

Contributor+ Payment Gateway Credential Disclosure vulnerability discovered by Artus KG in WordPress Plugin WpEvently versions 5.6.0...

EUVD-2026-81358

The Event Booking Manager for WooCommerce WordPress plugin before 5.6.0 does not restrict who can view its stored payment gateway configuration, allowing users with Contributor-level access and above to read the site's PayPal and Stripe credentials, including their secret keys...

WordPress HT Mega Addons for Elementor plugin 3.2.0-3.2.5 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin HT Mega versions 3.2.0-3.2.5...

CVE-2026-86788 HT Mega 3.2.0 - 3.2.5 - Contributor+ Stored XSS via Section Headline Tag

The HT Mega Addons for Elementor WordPress plugin before 3.2.6 does not restrict the HTML tag name used to render the section headline in several of its widgets and blocks to a safe allowlist, allowing users with contributor-level access and above to store a crafted tag name that executes arbitra...

CVE-2026-86788

The HT Mega Addons for Elementor WordPress plugin, in versions 3.2.0 through 3.2.5 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from a failure to restrict HTML tag names used to render section headlines in several widgets and blocks to a safe allowlist. This allow...