CVE-2026-95809

The Opti-Behavior plugin for WordPress (versions

CVE-2026-95686 Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...

EUVD-2026-102664

The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and...

CVE-2026-95686

The Opti-Behavior WordPress plugin (versions

PT-2026-115460

Name of the Vulnerable Software and Affected Versions Tutor LMS – eLearning and online course solution plugin for WordPress versions prior to 4.0.9 Description Insufficient input validation in the Topbar component's back button handler allows unauthenticated attackers to perform DOM-Based...

PT-2026-115456

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored DOM-Based Cross-Site Scripting. This occurs via the href parameter, enabling the injection...

PT-2026-115450

Name of the Vulnerable Software and Affected Versions SiteOrigin CSS versions prior to 1.6.8 Description Stored DOM-Based Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via the comment...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by poiri3r in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

WordPress SiteOrigin CSS plugin <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability discovered by Jakub Herman in WordPress Plugin SiteOrigin CSS versions = 1.6.7...

WordPress Tutor LMS – eLearning and online course solution plugin <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting vulnerability

Authenticated Subscriber+ Reflected DOM-Based Cross-Site Scripting vulnerability discovered by Sevada797 in WordPress Plugin Tutor LMS versions = 4.0.8...

WordPress Opti-Behavior plugin <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter vulnerability discovered by Décio Brandão in WordPress Plugin Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions = 1.9.2.1...

WordPress Opti-Behavior plugin <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter vulnerability

Unauthenticated Stored DOM-Based Cross-Site Scripting via 'countryname' Location Parameter vulnerability discovered by CHOIGYEONGMIN in WordPress Plugin Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights versions = 1.9.2.1...

CVE-2026-107870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107870

The Crocoblock JetEngine WordPress plugin is vulnerable to a DOM-Based Cross-Site Scripting (XSS) vulnerability in versions 3.8.16 and below . The flaw is caused by improper neutralization of input during web page generation. While the specific component or file is not specified, the vulnerabilit...

EUVD-2026-101031

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-83958

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-83960

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-48398

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...

CVE-2026-110074

Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting XSS vulnerability. An attacker could exploit this issue by manipulating the DOM environment to execute malicious JavaScript within the context of the victim's browser. Exploitation of this issue requires user interaction in...