EUVD-2026-63342

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-66601

Subscriber-level authenticated users can inject arbitrary JavaScript into the Media Library Assistant plugin (≤3.39) admin interface, enabling session hijacking or data theft. CVSS 6.5 (MEDIUM). Update to version 3.40 or later; no in-the-wild exploitation reported. See: https://patchstack.com/dat...

CVE-2026-66598 WordPress B2BKing Premium plugin <= 5.6.07 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

EUVD-2026-63340

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

CVE-2026-66598

Unauthenticated Cross Site Scripting XSS in B2BKing Premium = 5.6.07 versions...

EUVD-2026-63339

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66597

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66597 WordPress wpDataTables plugin <= 6.5.1.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in wpDataTables = 6.5.1.4 versions...

CVE-2026-66590 WordPress Tagembed plugin <= 7.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

EUVD-2026-63334

Unauthenticated Cross Site Scripting XSS in Tagembed = 7.4 versions...

CVE-2026-66590

Unauthenticated reflected XSS affects the Tagembed WordPress plugin (≤7.4), reachable over the network with no authentication. CVSS 7.1 (HIGH) reflects changed scope and low confidentiality/integrity/availability impact. A Patchstack advisory provides details; no exploitation evidence is reported...

CVE-2026-66582 WordPress TranslatePress plugin <= 3.3.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

EUVD-2026-63331

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

CVE-2026-66582

Unauthenticated Cross Site Scripting XSS in TranslatePress = 3.3.2 versions...

CVE-2026-66581

JetEngine plugin (Crocoblock) version 3.8.14.1 and earlier is vulnerable to unauthenticated reflected/stored XSS due to insufficient input sanitization. CVSS 7.1 HIGH. Upgrade to a patched version beyond 3.8.14.1; Patchstack advisory referenced. No exploitation evidence reported. Monitor for upda...

EUVD-2026-63330

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...

CVE-2026-66581 WordPress JetEngine plugin <= 3.8.14.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.14.1 versions...

CVE-2026-77072

n8n before 1.123.69, 2.33.4, and 2.34.1 contains a stored cross-site scripting vulnerability in the Form node's completion page. The completion page applied its sandboxing Content-Security-Policy only when respondWith was not set to 'redirect', but responseText was always rendered as raw HTML. An...

WordPress Divi theme 5.0-5.8.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ,.$n.,Sico.eX in WordPress Theme Divi versions 5.0-5.8.1...

WordPress YMC Filter plugin < 3.12.9 - Author+ Stored XSS via SVG Icon Upload vulnerability

Author+ Stored XSS via SVG Icon Upload vulnerability discovered by Artus KG in WordPress Plugin Filter & Grids versions 3.12.9...