Sunshine Photo Cart <= 3.2.5 - Reflected Cross-Site Scripting

WP Sunshine Sunshine Photo Cart versions up to 3.2.5 contain a reflected cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in users' browsers, exploit requires attacker to craft malicious input. id: CVE-2024-43971...

CVE-2026-66570

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nickboss WordPress File Upload wp-file-upload allows Stored XSS.This issue affects WordPress File Upload: from n/a through 5.2.1...

CVE-2022-29380

CVE-2022-29380 CVE-2022-29380 Date: 25/05/2022 Author: OpenXP Team Software: Academy LMS Version: Academy LMS = v4.3 Type: Cross-Site Scripting OWASP TOP 10: A03:2021-Injection CWE: CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' References:...

CVE-2026-65444

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60...

CVE-2026-65444 WordPress Blocksy Companion plugin <= 2.1.60 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Creative Themes Blocksy Companion blocksy-companion allows Stored XSS.This issue affects Blocksy Companion: from n/a through 2.1.60...

CVE-2026-107306

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...

EUVD-2026-113566

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Menu Link Attributes allows Stored XSS. This issue affects Menu Link Attributes versions: from 0.0.0 to 1.8.0...

EUVD-2026-113543

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal Sector Distribution allows Stored XSS. This issue affects Sector Distribution versions: from 0.0.0 to 10.3.3, from 10.4.0 to 10.4.2...

EUVD-2026-113538

Improper Neutralization of Input During Web Page Generation "Cross-site Scripting" vulnerability in Drupal USWDS Paragraph Components allows Stored XSS. This issue affects USWDS Paragraph Components versions: from 0.0.0 to 3.1.3...

CVE-2026-118097

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0...

CVE-2026-118097 WordPress Flash & HTML5 Video plugin <= 2.14.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Flash & HTML5 Video html5-video-player allows Stored XSS.This issue affects Flash & HTML5 Video: from n/a through 2.14.0...

CVE-2026-118097

The bPlugins Flash & HTML5 Video WordPress plugin (specifically the html5-video-player component) is vulnerable to Stored Cross-Site Scripting (XSS) . This flaw is caused by improper neutralization of input during web page generation. The vulnerability affects versions up to and including 2.14.0 ...

CVE-2026-114706 WordPress Strong Testimonials plugin <= 3.3.15 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Strong Testimonials strong-testimonials allows Stored XSS.This issue affects Strong Testimonials: from n/a through 3.3.15...

CVE-2026-114706

The WP Chill Strong Testimonials WordPress plugin (versions 3.3.15 and below ) is vulnerable to Stored Cross-Site Scripting (XSS) . This vulnerability arises from the improper neutralization of input during web page generation , which could allow an attacker to execute malicious scripts in the co...

CVE-2026-118095 WordPress Media LIbrary Assistant plugin <= 3.42 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows DOM-Based XSS.This issue affects Media LIbrary Assistant: from n/a through 3.42...

CVE-2026-118095

The David Lingren Media LIbrary Assistant WordPress plugin (versions up to and including 3.42 ) is vulnerable to a DOM-Based Cross-Site Scripting (XSS) flaw. This issue stems from the improper neutralization of input during web page generation. While specific exploit details or a remediation patc...

CVE-2026-116849 WordPress StreamCast plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins StreamCast streamcast allows Stored XSS.This issue affects StreamCast: from n/a through 2.4.6...

CVE-2026-116849

The bPlugins StreamCast WordPress plugin (versions

CVE-2026-39737 WordPress JetElements For Elementor plugin <= 2.9.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.6...

CVE-2026-39737

The Crocoblock JetElements For Elementor WordPress plugin (versions through 2.9.2.6 ) is vulnerable to a Stored Cross-site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. An attacker could potentially execute malicious scripts in the contex...