CVE-2026-109322

The Grav Guestbook plugin before version 0.5.2 is vulnerable to a stored cross-site scripting (XSS) flaw. The issue resides in the AJAX Load more and Admin Load all handlers, which insert stored author and message fields into the DOM as unescaped HTML using jQuery . This allows unauthenticated vi...

EUVD-2026-91942

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-88783: Improper Neutralization of Input During Web Page Generation

The Kubio AI Page Builder WordPress plugin before 2.9.3 does not limit its widening of the allowed HTML elements to the editor context, so the wider set is applied when filtering content submitted by unauthenticated users as well, allowing them to store markup which the Kubio AI Page Builder...

CVE-2026-64795 Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions

Joomla Extension - regularlabs.com - XSS vectors in tag-provided inputs in various Regular Labs extensions - Tag-provided custom HTML, module content/title overrides and decoded modal or tooltip values could execute unsafe markup. A content author could inject JavaScript that ran in visitors’...

PT-2025-7266 · Weeek · Weeek

Name of the Vulnerable Software and Affected Versions: WEEEK affected versions not specified Description: The issue is related to the failure to neutralize HTML tags in the WEEEK task and project management service. This could allow a remote attacker to execute arbitrary HTML code. Recommendation...