EUVD-2026-65579

The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2026-79663

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...

CVE-2026-77996

Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector...

CVE-2026-79663 Ech0 before 4.7.3 Stored XSS via RSS feed tag names

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...

EUVD-2026-65451

Ech0 before 4.7.3 contains a stored cross-site scripting vulnerability in the public RSS feed where tag names and markdown content are rendered without HTML escaping. Attackers with admin privileges can inject malicious tag names or raw HTML in echo content that executes as JavaScript in RSS...

CVE-2026-79663

Ech0 before 4.7.3 is affected by a stored cross-site scripting vulnerability in its public RSS feed . Tag names and Markdown content are rendered without HTML escaping, allowing an attacker with admin privileges to inject malicious tag names or raw HTML into echo content. The injected script exec...

EUVD-2026-65459

The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

CVE-2026-77824

Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...

CVE-2026-16231

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

EUVD-2026-65392

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-16231

hbs , an Express view engine wrapping Handlebars, has a cross-site scripting vulnerability in its registerAsyncHelper API. An async helper returns an opaque placeholder during the first render pass, so Handlebars' double-brace escaping applies only to the placeholder. After rendering, hbs substit...

CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-78576

...

EUVD-2026-65357

The eCommerce Product Catalog plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.5.10 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78568

...

CVE-2026-78568

CVE-2026-78568 covers a SQL Injection vulnerability in the Total Donations plugin for WordPress , affecting all versions up to and including 2.0.5 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of proper preparation of the existing SQL query, allowing ...

EUVD-2026-65317

The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Approved Comment Body Rendered in Translation Editor Strings Dropdown in all versions up to, and including, 3.2.6 due to insufficient input sanitization and...

CVE-2026-78470 WP Project Manager Pro <= 4.0.1 - Authenticated (Subscriber+) SQL Injection

The WP Project Manager Pro plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers,...

CVE-2026-78470

WP Project Manager Pro is a WordPress plugin vulnerable to SQL Injection in all versions up to and including 4.0.1 . The root cause is insufficient escaping on a user-supplied parameter combined with a lack of prepared statements in the existing SQL query. An authenticated attacker with Subscribe...