EUVD-2026-71932

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-85414

Gallery: FooGallery plugin for WordPress (all versions up to, and including, 3.3.2 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability through the custom_settings shortcode attribute, caused by insufficient input sanitization and output escaping . An authenticated attacker with Con...

CVE-2026-82304

The Music Store WordPress plugin before 1.4.5 does not sanitise and escape user input before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2026-78438

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-81404

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-15984

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984 QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984

The QuickCal WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via Custom Field Parameters in all versions up to and including 1.0.20 . The root cause is insufficient input sanitization and output escaping. A critical aggravating factor is that the nonce guarding the unauthentic...

CVE-2026-78438

The W3 Total Cache plugin for WordPress (versions ≤ 2.10.5 ) is affected by an unauthenticated Stored Cross-Site Scripting vulnerability in the LazyLoad Background Mutator component. Due to insufficient input sanitization and output escaping , attackers can inject arbitrary scripts via comment co...

EUVD-2026-71879

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

EUVD-2026-71877

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18843

The Beaver Builder Plugin (Starter Version) for WordPress is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the no_results_message node_preview parameter, present in all versions up to and including 2.11.0.1 . The root cause is insufficient input sanitization and output escap...

CVE-2025-14945

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-81404 IPGP Visitors Origin < 1.6 - Reflected XSS

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

EUVD-2026-71853

The IPGP Visitors Origin WordPress plugin before 1.6 does not sanitise or escape user input before reflecting it back in the HTTP response, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting attacks against users who are tricked into submitting a crafted request...

CVE-2026-81404

The IPGP Visitors Origin WordPress plugin in versions before 1.6 is vulnerable to a Reflected Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitise or escape user input before it is reflected back in the HTTP response. This allows unauthenticated attackers to execu...

EUVD-2026-71843

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-14945 Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...