CVE-2026-15948

The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...

CVE-2026-15948

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'firstname' parameter in all versions up to, and including, 1.2.2 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-72152

Name of the Vulnerable Software and Affected Versions Hydra Booking — Appointment Scheduling & Booking Calendar versions prior to 1.2.3 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows attackers to inject arbitrary web...

PT-2026-72150

Name of the Vulnerable Software and Affected Versions Cookie Banner for GDPR / CCPA – WPLP Cookie Consent versions prior to 4.3.6 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrar...

CVE-2026-18109

The CVE-2026-18109 entry concerns the W3 Total Cache WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in all versions up to and including 2.10.3 due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts that execute when u...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73572

In Zimbra Collaboration ZCS before 10.1.17, a stored cross-site scripting XSS vulnerability exists in the Zimbra Classic Web Client due to insufficient sanitization of specific attachment content during inline preview. An attacker can send a crafted email containing a malicious attachment that,...

CVE-2026-73572

CVE-2026-73572 affects Zimbra Collaboration (ZCS) prior to 10.1.17. A stored XSS in the Zimbra Classic Web Client arises from insufficient sanitization of attachment content during inline preview. An attacker can send a crafted email with a malicious attachment; when the recipient previews it, ar...

CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-18146

The CVE-2026-18146 entry concerns the Fluent Forms WordPress plugin (versions ≤ 6.2.11). It describes a Stored Cross‑Site Scripting vulnerability caused by insufficient input sanitization and output escaping in Notification Smartcode Values, enabling unauthenticated attackers to inject scripts th...

PT-2026-71678

Name of the Vulnerable Software and Affected Versions Zimbra Collaboration ZCS versions prior to 10.1.17 Description A stored cross-site scripting XSS issue exists in the Zimbra Classic Web Client. This occurs because the system does not sufficiently sanitize specific attachment content during...

EUVD-2026-56184

The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOKEDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files...

CVE-2026-16974

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-55934

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-13731

The WPBot – AI ChatBot WordPress plugin (≤ 8.4.9 ) is vulnerable to unauthenticated Stored XSS via the conversation parameter in the qcld_wb_chatbot_conversation_save AJAX action. The root cause is insufficient input sanitization and output escaping. Critically, the required AJAX nonce (qcsecretb...

Cross-Site Scripting (XSS)

CKAN is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to insufficient sanitization of user-supplied input in the helpers.markdownextract function before it is wrapped in an HTML literal element, which allows an attacker to inject and execute malicious scripts on dataset,...

CVE-2025-8444

The CVE-2025-8444 entry concerns the WordPress plugin Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates. A DOM-Based Stored Cross-Site Scripting vulnerability exists in all versions up to and including 2.6.7 due to insufficient input sanitization and output escapi...

CVE-2026-6824

A stored cross-site scripting XSS vulnerability exists in certain 1xxx series NVR devices due to insufficient sanitization of user-supplied input in specific functional modules. Attackers can inject malicious scripts, which are then persistently stored on the device backend. When administrators o...

CVE-2026-44973 Billy: Path traversal vulnerabilities

Billy is an interface filesystem abstraction for Go. Prior to 5.9.0, multiple path traversal issues exist across different components of go-billy. Insufficient path sanitization and boundary enforcement may allow crafted paths e.g., using .. to escape intended base directories. While go-billy was...