CVE-2026-15780 WP Statistics <= 14.16.8 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter

The WP Statistics – Simple, privacy-friendly Google Analytics alternative plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utmcampaign' parameter in all versions up to, and including, 14.16.8 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-15421

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-62208

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

EUVD-2026-62210

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-66591

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-27365

The WordPress PublishPress Series plugin (versions through 2.17.0) has a stored XSS flaw from improper input neutralization during page generation. Patchstack rates it MEDIUM (CVSS 5.9) requiring high privileges and user interaction. No exploitation data is provided. Upgrade to a patched version ...

CVE-2026-66603

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Artiss Draft List simple-draft-list allows Stored XSS. This issue affects Draft List: from n/a through 2.6.4...

CVE-2026-66591 WordPress Media LIbrary Assistant plugin <= 3.39 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant allows Stored XSS. This issue affects Media LIbrary Assistant: from n/a through 3.39...

CVE-2026-41921 Koha Stored XSS via Purchase Suggestion Handler

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

EUVD-2026-62183

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-66633

Unauthenticated Cross Site Scripting XSS in Fluent Forms Pro Add On Pack 6.2.12 versions...

CVE-2026-19447

FileOrbis (by Fileorbis Informatics Services Trade Inc.) is vulnerable to stored XSS due to improper input neutralization during web page generation. Affects versions before 16.5; CVSS 5.4 (MEDIUM), network exploitable with low privileges. No in-the-wild exploitation reported. Upgrade to 16.5 to ...

CVE-2026-75091

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-75091

The Quill Forms WordPress plugin (versions ≤ 5.7.1) has a stored XSS flaw from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when users view affected pages. CVSS 7.2 HIGH; no confirmed in-the-wild exploitation reported. Patc...

CVE-2026-75091 Quill Forms <= 5.7.1 - Unauthenticated Stored Cross-Site Scripting

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-60570

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

PT-2026-78247

Name of the Vulnerable Software and Affected Versions Media Library Assistant versions prior to 3.40 Description Improper neutralization of input during web page generation allows for Stored Cross-site Scripting XSS, a condition where malicious scripts are permanently stored on the target server...

PT-2026-78249

Name of the Vulnerable Software and Affected Versions Draft List versions prior to 2.6.5 Description Improper neutralization of input during web page generation in the David Artiss Draft List simple-draft-list plugin allows for Stored Cross-site Scripting XSS. Stored XSS occurs when an applicatio...

UBUNTU-CVE-2026-75003

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation...

BIT-GITLAB-2026-3093 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 14.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an attacker to execute arbitrary JavaScript in another user's browser via a crafted URL, due to improper...