CVE-2026-28166

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-66610 WordPress Urna theme <= 2.6.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...

CVE-2026-66610

CVE-2026-66610 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress theme Urna , affecting versions ≤ 2.6.2 . The flaw was discovered by Khuong Hai & Thanh Nam (HPT Vietnam). The CVSS 3.1 score is 7.1 (HIGH) , with a network attack vector, low complexity, no privileges ...

EUVD-2026-64807

Unauthenticated Cross Site Scripting XSS in Urna = 2.6.2 versions...

CVE-2026-32476

An unauthenticated Cross-Site Scripting (XSS) vulnerability affects the Brave Conversion Engine (PRO) WordPress plugin (slug: bravepopup-pro ) in versions ≤ 0.8.6 . The flaw requires user interaction (CVSS 3.1 vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, score 7.1 HIGH with a Changed scope, indic...

EUVD-2026-64800

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

CVE-2026-32476 WordPress Brave Conversion Engine (PRO) plugin <= 0.8.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Brave Conversion Engine PRO = 0.8.6 versions...

CVE-2026-77643

A flaw was found in Xapian xapian-core. This cross-site scripting XSS vulnerability is due to incomplete HTML escaping by the Xapian::MSet::snippet function. A remote attacker could exploit this by injecting malicious script, leading to arbitrary code execution in the user's browser context. This...

EUVD-2026-64795

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

CVE-2026-28166

CVE-2026-28166 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Tourmaster plugin , affecting versions 5.4.9 and earlier . The CVSS 3.1 base score is 7.1 (HIGH) , with a network attack vector, low complexity, no required privileges, and a changed scope. CISA's SSVC ...

CVE-2026-28166 WordPress Tourmaster plugin <= 5.4.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Tourmaster = 5.4.9 versions...

EUVD-2026-64793

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162 WordPress Events Made Easy plugin <= 3.2.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Events Made Easy = 3.2.5 versions...

CVE-2026-28162

CVE-2026-28162 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Events Made Easy (versions ≤ 3.2.5 ). The vulnerability allows a remote unauthenticated attacker to inject and execute arbitrary script in another user's browser, with a CVSS 3.1 base score of 7....

CVE-2026-78290 WordPress Magazine Blocks plugin <= 1.8.6 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-78290

CVE-2026-78290 is a Contributor-level Cross-Site Scripting (XSS) vulnerability in the WordPress Magazine Blocks plugin , affecting versions ≤ 1.8.6 . The vulnerability requires a user with Contributor privileges and user interaction, with a Changed Scope impact (CVSS 3.1 base score 6.5 MEDIUM ). ...

EUVD-2026-64788

Contributor Cross Site Scripting XSS in Magazine Blocks = 1.8.6 versions...

CVE-2026-66623 WordPress Social Media & Share Icons plugin <= 2.9.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

EUVD-2026-64832

Unauthenticated Cross Site Scripting XSS in Social Media & Share Icons = 2.9.9 versions...

CVE-2026-66623

CVE-2026-66623 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Social Media & Share Icons (also known as Ultimate Social Media Icons), affecting versions 2.9.9 and below . The vulnerability was discovered by Bonds and carries a CVSS 3.1 score of 7.1 (HIGH) ,...