1126676 matches found
CVE-2025-69140
The CVE is for WordPress SweetDate Core plugin versions before 1.1.5, which are affected by an unauthenticated reflected XSS vulnerability. Root cause details aren’t provided in the documents, but the issue is tied to SweetDate Core
CVE-2025-68524 WordPress Avante theme < 3.0.5 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Avante 3.0.5 versions...
CVE-2025-68524
CVE-2025-68524 affects the WordPress Avante theme in versions prior to 3.0.5, with a Reflected Cross Site Scripting (XSS) vulnerability that is unauthenticated . The issue arises in Avante
CVE-2026-11975 Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface
Stored cross-site scripting XSS in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw...
CVE-2026-11975 Stored Cross-Site Scripting (XSS) in SimplCommerce News Module Admin Interface
Stored cross-site scripting XSS in NewsItemApiController In SimplCommerce prior to commit 6142d3b5 allows an authenticated administrator to execute arbitrary JavaScript via the ShortContent and FullContent fields, which are stored without HTML sanitization and rendered unencoded via @Html.Raw...
CVE-2026-11975
CVE-2026-11975 : In SimplCommerce, stored XSS occurs in the NewsItemApiController before commit 6142d3b5, allowing an authenticated administrator to inject JavaScript via ShortContent and FullContent that are stored without HTML sanitization and rendered with Html.Raw(). Affected: News module adm...
Cross-Site Scripting (XSS)
Vitest is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to the otelCarrier query parameter being inserted directly into an inline module script and treated as JavaScript source rather than data, which allows an attacker to craft a malicious browser-runner URL and execute...
CVE-2026-54195 WordPress JetFormBuilder plugin <= 3.6.0.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.0.1 versions...
CVE-2026-54195
CVE-2026-54195 affects the WordPress JetFormBuilder plugin older than or equal to 3.6.0.1, with an unauthenticated Cross Site Scripting (XSS) vulnerability. The CVSS-3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating a network-exposed issue that requires user interaction and h...
CVE-2026-54192
This entry covers CVE-2026-54192: unauthenticated Reflected XSS in the WordPress Popup box plugin (<= 6.2.9). The descriptor indicates an XSS vulnerability when loading or handling inputs in affected plugin paths, with a CVSS v3.1 base score of 7.1 (HIGH) and user interaction required. The pro...
CVE-2026-54192 WordPress Popup box plugin <= 6.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...
CVE-2026-54189 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...
CVE-2026-54189
JetEngine WordPress plugin
CVE-2026-54188 WordPress JetEngine plugin <= 3.8.10 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...
CVE-2026-54188
CVE-2026-54188 affects the WordPress JetEngine plugin (versions <= 3.8.10). It describes an unauthenticated Cross Site Scripting (XSS) vulnerability in JetEngine
CVE-2026-49778
Summary (CVE-2026-49778) Unauthenticated Cross Site Scripting (XSS) in WordPress WPFunnels Pro plugin ≤ 2.9.4. The CVSSv3.1 base score is 7.1 (HIGH); vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The vulnerability affects the WPFunnels Pro plugin for WordPress (versions ≤ 2.9.4). Details provided ...
CVE-2026-49778 WordPress WPFunnels Pro plugin <= 2.9.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WPFunnels Pro = 2.9.4 versions...
CVE-2026-49074 WordPress JetEngine plugin <= 3.8.9.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.9.1 versions...