1124490 matches found
CVE-2026-66612
Unauthenticated reflected XSS vulnerability in the WordPress Aora theme (versions ≤ 1.3.19), exploitable via a crafted link requiring user interaction. CVSS 7.1 HIGH (network, no privileges). No fix version or exploitation details provided; monitor Patchstack advisory for updates.
EUVD-2026-63296
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66611
Unauthenticated Cross Site Scripting XSS in Paymob for WooCommerce = 4.1.10 versions...
CVE-2026-66612 WordPress Aora theme <= 1.3.19 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
EUVD-2026-63297
Unauthenticated Cross Site Scripting XSS in Aora = 1.3.19 versions...
EUVD-2026-63294
Unauthenticated Cross Site Scripting XSS in Advance Product Search = 1.4.8 versions...
CVE-2026-66605 WordPress Swatchly – WooCommerce Variation Swatches for Products plugin <= 1.4.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
EUVD-2026-63344
Unauthenticated Cross Site Scripting XSS in Swatchly – WooCommerce Variation Swatches for Products = 1.4.13 versions...
EUVD-2026-63293
Unauthenticated Cross Site Scripting XSS in SmartSMTP = 1.2.0 versions...
CVE-2026-66606
An unauthenticated reflected/stored XSS vulnerability exists in the WordPress SmartSMTP plugin through version 1.2.0. An attacker can inject malicious scripts without authentication; a victim triggering the payload could have their session cookies stolen or admin actions hijacked. CVSS 3.1 scores...
CVE-2026-66604 WordPress GeoDirectory plugin <= 2.8.173 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...
EUVD-2026-63343
Unauthenticated Cross Site Scripting XSS in GeoDirectory = 2.8.173 versions...
CVE-2026-66604
An unauthenticated reflected/stored XSS vulnerability exists in the GeoDirectory WordPress plugin (versions ≤ 2.8.173), allowing an attacker to inject malicious scripts into pages viewed by other users without authentication, enabling session hijacking or credential theft. No in-the-wild exploita...
EUVD-2026-63342
Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...
CVE-2026-66601
Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...
CVE-2026-66598
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
EUVD-2026-63340
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...
CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...