CVE-2026-14433 Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 - Unauthenticated Stored Cross-Site Scripting via REST API 'business_id' Parameter

The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'businessid' parameter in all versions up to, and including, 4.6.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14433

The CVE-2026-14433 entry describes a Stored Cross-Site Scripting (XSS) vulnerability in the Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress. The flaw affects the REST API via the business_id parameter and is present in all versions up to and including 4.6.0, due t...

PT-2026-72158

Name of the Vulnerable Software and Affected Versions Beaver Builder Page Builder versions prior to 2.10.2.3 Description The Beaver Builder Page Builder plugin for WordPress contains a stored cross-site scripting issue. This occurs due to insufficient input sanitization and output escaping within...

PT-2026-72140

Name of the Vulnerable Software and Affected Versions Online Booking & Scheduling Calendar for WordPress by vcita versions prior to 4.6.1 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS, a technique where...

CVE-2026-74241

A flaw was found in Red Hat Quay's external Lightweight Directory Access Protocol LDAP authentication handling. When an LDAP referral is returned during authentication, the system does not properly escape the username input. This allows an attacker to inject LDAP filter metacharacters, enabling...

CVE-2026-56858

A flaw was found in the html/template component of Go golang. Pathological inputs could prematurely close an unescaped forward slash '/', allowing an attacker to inject arbitrary content. This could lead to Cross-Site Scripting XSS, where malicious scripts are executed in a user's browser,...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-19794 WP-Stats <= 2.56 - Unauthenticated Stored Cross-Site Scripting

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-19794

The CVE-2026-19794 entry concerns the WP-Stats plugin for WordPress, affected in all versions up to and including 2.56. Root cause: insufficient input sanitization and output escaping, enabling Stored Cross-Site Scripting. Impact: unauthenticated attackers can inject arbitrary web scripts that ex...

EUVD-2026-58607

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-19794

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-18109 W3 Total Cache <= 2.10.3 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

EUVD-2026-58570

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

PT-2026-71971

The WP-Stats plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.56 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

VulnCheck KEV: CVE-2026-18109

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 2.10.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web script...

CVE-2026-56858

Previously, pathological inputs could close an unescaped '/' early, allowing for attack-controlled data to inject arbitrary content, potentially leading to XSS...

CVE-2026-49096 Uncaught Exception in Kibana Cases Leading to Denial of Service

Uncaught Exception CWE-248 in Kibana Cases can lead to denial of service via Input Data Manipulation CAPEC-153. Malformed link syntax stored in a case comment was not rejected or sanitized when the comment was later formatted for display, and the resulting unhandled error prevented the affected...

CVE-2026-73570

A remote code execution vulnerability exists in Zimbra Collaboration ZCS before 10.1.20 when the optional zimbra-snmp package is installed and SNMP notifications are enabled. Due to improper sanitization of untrusted input during SNMP notification processing, an unauthenticated attacker can send...

CVE-2026-28154

CVE-2026-28154 concerns reflected Cross-Site Scripting (XSS) in two WordPress themes: Samex - Clean, Minimal Shop WooCommerce Theme (affected up to version 2.5) and M.Anh - Fashion WooCommerce Theme (affected up to version 1.7). The issue arises from improper input neutralization during web page ...