1148910 matches found
WordPress GeoDirectory plugin <= 2.8.177 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GeoDirectory versions = 2.8.177...
WordPress Loco Translate plugin <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments vulnerability
Authenticated Translator+ Stored Cross-Site Scripting via PO File Extracted Comments vulnerability discovered by MatilJ in WordPress Plugin Loco Translate versions = 2.8.7...
WordPress Gravity Booster plugin <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter vulnerability
Authenticated Editor+ Stored Cross-Site Scripting via 'stylerSettings' Parameter vulnerability discovered by wandoo in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 5.26...
WordPress Autopay plugin <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter vulnerability
Unauthenticated Stored Cross-Site Scripting via 'bmwoocommercecsseditorcontent' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Autopay versions = 5.0.0...
WordPress Advanced File Manager plugin <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability
Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability discovered by skyv3il in WordPress Plugin Advanced File Manager versions = 5.4.12...
WordPress Admin Custom Login plugin <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability
Authenticated Administrator+ Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability discovered by Ryoma Nishioka in WordPress Plugin Admin Custom Login versions = 3.6.4...
CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting
The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
EUVD-2026-60555
A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...
EUVD-2026-60472
A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...
CVE-2026-75082
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...
EUVD-2026-60559
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...
CVE-2026-75082 Webkul Bagisto Customer-Registration Notification Email register cross site scripting
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...
CVE-2026-75082
Bagisto up to 2.4.4 is vulnerable to reflected XSS via the first_name/last_name arguments in the Customer-Registration Notification Email component. The exploit has been published; the vendor confirms some items are fixed and remaining ones are planned for upcoming releases.
CVE-2026-75082
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...
CVE-2026-66643: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in Wufoo Shortcode = 1.55 versions...
PT-2026-76924
Grav Form Plugin before 9.1.19 fails to escape field-definition properties including prepend, append, spacer text, section text, and select option labels in form templates. Attackers with form authoring privileges can inject arbitrary HTML and JavaScript that executes for all form visitors throug...
PT-2026-77035
Unauthenticated Cross Site Scripting XSS in Quill Forms = 5.7.1 versions...
EUVD-2026-61094
Cross-site scripting vulnerability in the user documentation field in Beta Systems Software AG ANOW! Automate v.3.3.1.90 allows a remote attacker to execute arbitrary code...
PT-2026-77065
Name of the Vulnerable Software and Affected Versions Featured Video Plus versions prior to 2.3.4 Description Cross Site Scripting XSS allows an attacker with contributor privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 2.3.3...