CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639

CVE-2026-3639 : The PPWP – Password Protect Pages plugin for WordPress is vulnerable toStored Cross-Site Scripting via the plugin’s ppwp shortcode attributes in all versions up to and including 1.9.21, due to insufficient input sanitization and output escaping on user-supplied attributes. Authent...

PT-2026-71593

Unauthenticated Cross Site Scripting XSS in Smart Online Order for Clover = 1.6.1 versions...

PT-2026-71517

Unauthenticated Cross Site Scripting XSS in Do Lasso = 358 versions...

PT-2026-71545

Unauthenticated Cross Site Scripting XSS in Agrion = 1.0.0 versions...

PT-2026-71563

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

PT-2026-71576

Subscriber Cross Site Scripting XSS in Accordion = 3.0.6 versions...

PT-2026-76573

Name of the Vulnerable Software and Affected Versions Etherpad versions 2.1.0 through 3.0.0 Description Etherpad fails to properly sanitize the x-proxy-path request header, leading to two distinct issues when client-supplied headers reach the server. First, in src/node/hooks/express/admin.ts, the...

PT-2026-71527

Subscriber Cross Site Scripting XSS in AcyMailing SMTP Newsletter = 10.11.1 versions...

PT-2026-71508

Unauthenticated Cross Site Scripting XSS in Maspik – Spam blacklist = 2.9.1 versions...

PT-2026-71600

Author Cross Site Scripting XSS in WP Data Access = 5.5.79 versions...

PT-2026-71502

Unauthenticated Cross Site Scripting XSS in Welcart e-Commerce = 2.11.31 versions...

PT-2026-71604

Donor Cross Site Scripting XSS in GiveWP 4.16.6 versions...

PT-2026-71521

Unauthenticated Cross Site Scripting XSS in Blog Floating Button = 1.4.20 versions...

PT-2026-71509

Unauthenticated Cross Site Scripting XSS in Business Directory = 6.4.25 versions...

PT-2026-71524

Unauthenticated Cross Site Scripting XSS in Visitors Traffic Real Time Statistics = 8.11 versions...

PT-2026-71574

Unauthenticated Cross Site Scripting XSS in Local Delivery Drivers for WooCommerce = 3.0.0 versions...

PT-2026-71592

Unauthenticated Cross Site Scripting XSS in SureDash = 1.10.1 versions...

PT-2026-71684

Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's href attribute because the renderer's sanitization...

DEBIAN-CVE-2026-73490

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Prior to 2.25.2, Loofah's HTML5 sanitizer applies its local-reference restriction only to the xlink:href attribute on SVG use and feImage elements, while browsers also accept...