CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.27 . The root cause is insufficient input sanitization and output escaping of the first_name parameter. This allows unauthenticated attackers to inject arbitrary ...

PT-2026-98402

Name of the Vulnerable Software and Affected Versions Zero Spam for WordPress versions prior to 5.7.11 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting XSS. This occurs through the Contact Form 7 integration whe...

CVE-2025-32000

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

EUVD-2025-210999

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

CVE-2025-32000

The HCL Sametime application is vulnerable to insufficient input sanitization due to the improper sanitization of user input. This flaw allows malicious actors to leverage implicitly or explicitly trusted input to target the application. Impacted versions are addressed in HCL Sametime 12.0.4 . It...

CVE-2025-32000 Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

CVE-2025-32000 Insufficient Input Sanitization is addressed in HCL Sametime 12.0.4. It is recommended to upgrade to the latest version.

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

PT-2026-97854

Name of the Vulnerable Software and Affected Versions HCL Sametime affected versions not specified Description The application is subject to insufficient input sanitization, which occurs when user-supplied data is trusted implicitly or explicitly without being properly cleaned. This flaw allows...

CVE-2025-32000: Improper Input Validation

HCL Sametime is vulnerable to insufficient input sanitization. The application did not appropriately sanitize user input. When user input is implicitly or explicitly trusted without sufficient sanitization, malicious actors can leverage this vulnerability...

TOTOLINK A3300R SetVpnPassCfg Command Execution

The vulnerability of the setVpnPassCfg function in TOTOLINK A3300R router microprogramming software is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

CVE-2026-83561: Improper Neutralization of Input During Web Page Generation

The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Elementor Cookie Blocker Regex in all versions up to, and including, 7.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-14855: Improper Neutralization of Input During Web Page Generation

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'icn' parameter in all versions up to, and including, 2.15.22 due to insufficient input sanitization and output escaping. This makes it possib...

CVE-2026-18555

The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) via the icn parameter in all versions up to and including 2.15.22 . The root cause is insufficient input sanitization and output escaping. An unauth...

CVE-2026-11996

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-80100

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-11996 Advanced Popups <= 1.2.3 - Authenticated (Author+) Stored Cross-Site Scripting via 'Notification Button Link' Field

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-18595

WP-Lister Lite for eBay (WordPress plugin) is vulnerable to Stored Cross-Site Scripting via the AJAX Cron Handler Request Parameter in all versions up to and including 3.8.9 , caused by insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts...

PT-2026-93266

The Advanced Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Notification Button Link' Field in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-18595: Improper Neutralization of Input During Web Page Generation

The WP-Lister Lite for eBay plugin for WordPress is vulnerable to Stored Cross-Site Scripting via AJAX Cron Handler Request Parameter in all versions up to, and including, 3.8.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...