6774 matches found
CVE-2026-125793
The flexmls Flexmls® IDX (flexmls-idx) WordPress plugin, versions 4.1.2 and earlier , is vulnerable to Reflected Cross-Site Scripting (XSS) . This issue stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to execute malicious scripts in a victim's...
CVE-2026-124259
The Franky Events Made Easy WordPress plugin (versions
CVE-2026-124755
The Advanced Custom Fields: Font Awesome Field WordPress plugin, developed by Justin Kruit, is vulnerable to Stored Cross-Site Scripting (XSS) . This issue affects versions up to and including 6.1.4 . The vulnerability is caused by the improper neutralization of input during web page generation ,...
CVE-2026-124254
The EWWW Image Optimizer plugin (ewww-image-optimizer) by Exactly WWW LLC is vulnerable to Stored Cross-Site Scripting (XSS) . This issue stems from the Improper Neutralization of Input During Web Page Generation (CWE-79). The vulnerability affects versions from n/a through 8.9.1 . While the spec...
EUVD-2026-126052
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in iWorks Orphans sierotki allows Stored XSS.This issue affects Orphans: from n/a through 3.4.6...
CVE-2026-125789
The VikBooking Hotel Booking Engine & PMS plugin for WordPress, affecting versions up to and including 1.8.20 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. This issue arises from the Improper Neutralization of Input During Web Page Generation (CWE-79). An attacker could potentially...
CVE-2026-124995
The Michal Jaworski Track, Analyze & Optimize by WP Tao plugin for WordPress is vulnerable to a Stored Cross-site Scripting (XSS) vulnerability (CVE-2026-124995). The root cause is the improper neutralization of input during web page generation . This issue affects versions from n/a through 1.3.1...
CVE-2026-125790
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This issue impacts versions up to and including 1.8.20 . An attacker could potentially execute malicious scripts in...
Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting
WP Sunshine Sunshine Photo Cart versions up to 3.2.5 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-43971...
CVE-2026-125831
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder allows Stored XSS.This issue affects PowerPack Lite for Beaver Builder: from n/a through 1.3.2...
CVE-2026-125824
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10...
CVE-2026-125794
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in hupe13 Extension for Leaflet Map extensions-leaflet-map allows Stored XSS.This issue affects Extension for Leaflet Map: from n/a through 6.1.1...
CVE-2026-124420
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10...
CVE-2026-124418 WordPress WP Job Portal plugin <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ahmad WP Job Portal wp-job-portal allows Stored XSS.This issue affects WP Job Portal: from n/a through 2.7.2...
CVE-2026-124418
The Ahmad WP Job Portal (wp-job-portal) WordPress plugin, in versions 2.7.2 and below , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The vulnerability is caused by Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious scripts that...
CVE-2026-124260 WordPress WP Photo Album Plus plugin <= 9.3.06.001 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Jacob N. Breetvelt WP Photo Album Plus wp-photo-album-plus allows Reflected XSS.This issue affects WP Photo Album Plus: from n/a through 9.3.06.001...
CVE-2026-124420 WordPress Woody ad snippets plugin <= 2.7.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Themeisle Woody ad snippets insert-php allows Reflected XSS.This issue affects Woody ad snippets: from n/a through 2.7.10...
CVE-2026-125837 WordPress Make theme <= 1.10.10 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in thethemefoundry Make make allows Reflected XSS.This issue affects Make: from n/a through 1.10.10...
CVE-2026-125854 WordPress Unbounce Landing Pages plugin <= 1.1.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Unbounce Unbounce Landing Pages unbounce allows Stored XSS.This issue affects Unbounce Landing Pages: from n/a through 1.1.6...