EUVD-2026-71877

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18843

The Beaver Builder Plugin (Starter Version) for WordPress is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the no_results_message node_preview parameter, present in all versions up to and including 2.11.0.1 . The root cause is insufficient input sanitization and output escap...

CVE-2025-14945

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-81404

The IPGP Visitors Origin WordPress plugin in versions before 1.6 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape user input before it is reflected back in the HTTP response. This allows unauthenticated attackers to execu...

EUVD-2026-71843

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-14945 Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

CVE-2025-14945

The Events Manager plugin for WordPress (versions ≤ 7.3.3) is vulnerable to Stored Cross-Site Scripting via event attribute values. The root cause is insufficient input sanitization—attribute values are processed with only wp_unslash() without further sanitization—and a lack of output escaping wh...

SUSE CVE-2026-53474

A flaw was found in migration-planner. A remote authenticated attacker could exploit this vulnerability by uploading a specially crafted RVTools .xlsx file. Due to improper input sanitization, malicious SQL embedded within a spreadsheet cell is executed when cluster names are processed. This SQL...

PT-2026-86331

The Spam protection, Honeypot, Anti-Spam by CleanTalk plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content aria-label Placeholder in all versions up to, and including, 6.86 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86323

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no results message' node preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-86324

The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Repeater Child 'type' Confusion via Unmatched Array Key in all versions up to, and including, 3.15.1 due to insufficient input sanitization and output escaping. Thi...

PT-2026-86367

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'not found' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-86307

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wp unslash...

PT-2026-86365

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'custom settings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

GHSA-QX2G-XRX7-VFH8 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2026-19727

CVE-2026-19727 is an XSS (targeting HTML attributes) vulnerability in the Yordam Information Technology Consulting Library Information and Document Automation Program , caused by improper neutralization of input during web page generation. The issue affects versions before v22.2 and is rated CVSS...

CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...

CVE-2026-19727 HTML Injection via Improper Input Sanitization in Yordam Informatics's Library Automation System

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Yordam Information Technology Consulting, Training and Electronic Systems Industry and Trade Inc. Library Information and Document Automation Program allows XSS Targeting HTML Attributes. This issu...