WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Video Conferencing with Zoom versions = 4.6.8...

WordPress WP Multilang plugin <= 2.4.31 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Multilang versions = 2.4.31...

WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by timomangcut in WordPress Plugin Convert Pro versions = 1.0.1...

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Wufoo Shortcode versions = 1.55...

WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Typing Effect versions = 1.3.7...

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP Tab Widget versions = 1.2.11...

Exploit for Cross-site Scripting in Palletsprojects Jinja

No d...

Exploit for Cross-site Scripting in Palletsprojects Jinja

No d...

Exploit for Cross-site Scripting in Mozilla Bleach

No d...

WordPress GeoDirectory plugin <= 2.8.177 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin GeoDirectory versions = 2.8.177...

WordPress Loco Translate plugin <= 2.8.7 - Authenticated (Translator+) Stored Cross-Site Scripting via PO File Extracted Comments vulnerability

Authenticated Translator+ Stored Cross-Site Scripting via PO File Extracted Comments vulnerability discovered by MatilJ in WordPress Plugin Loco Translate versions = 2.8.7...

WordPress Gravity Booster plugin <= 5.26 - Authenticated (Editor+) Stored Cross-Site Scripting via 'stylerSettings' Parameter vulnerability

Authenticated Editor+ Stored Cross-Site Scripting via 'stylerSettings' Parameter vulnerability discovered by wandoo in WordPress Plugin Gravity Booster Styles & Layouts for Gravity Forms versions = 5.26...

WordPress Autopay plugin <= 5.0.0 - Unauthenticated Stored Cross-Site Scripting via 'bm_woocommerce_css_editor_content' Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'bmwoocommercecsseditorcontent' Parameter vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Autopay versions = 5.0.0...

WordPress Advanced File Manager plugin <= 5.4.12 - Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability

Reflected Cross-Site Scripting via postMessage 'soundFile' Parameter vulnerability discovered by skyv3il in WordPress Plugin Advanced File Manager versions = 5.4.12...

WordPress Admin Custom Login plugin <= 3.6.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via 'Message Above Login Form' Setting vulnerability discovered by Ryoma Nishioka in WordPress Plugin Admin Custom Login versions = 3.6.4...

CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-60555

A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This affects an unknown part of the file /BSHRM1.php. Performing a manipulation of the argument course results in cross site scripting. Remote exploitation of the attack is possible. The exploit has been...

EUVD-2026-60472

A vulnerability was identified in SourceCodester Class and Exam Timetabling System 1.0. Affected by this issue is some unknown functionality of the file /BSCE2.php. Such manipulation of the argument course leads to cross site scripting. The attack may be launched remotely. The exploit is publicly...

CVE-2026-75082

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...

EUVD-2026-60559

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to...