CVE-2026-110375

The WordPress Download Monitor plugin (versions

CVE-2026-106604 WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in YITH YITH WooCommerce Compare yith-woocommerce-compare allows Stored XSS.This issue affects YITH WooCommerce Compare: from n/a through 3.15.0...

CVE-2026-108175 WordPress MDTF plugin <= 1.4.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter allows Stored XSS.This issue affects MDTF: from n/a through 1.4.0...

CVE-2026-108175

The PluginUs.Net MDTF wp-meta-data-filter-and-taxonomy-filter WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.4.0 . The root cause is the improper neutralization of input during web page generation . This vulnerability allows an attacker to ex...

CVE-2026-110890

The Crocoblock JetSmartFilters WordPress plugin (versions n/a through 3.8.6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw due to the Improper Neutralization of Input During Web Page Generation . An attacker can exploit this to execute malicious scripts in the context of a user's bro...

EUVD-2026-102230

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetSmartFilters jet-smart-filters allows Stored XSS.This issue affects JetSmartFilters: from n/a through 3.8.6...

CVE-2026-109702 WordPress Social Share Buttons plugin <= 1.31 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31...

CVE-2026-105882

The ThemeGrill User Registration WordPress plugin (versions n/a through 5.2.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The issue stems from the Improper Neutralization of Input During Web Page Generation , which allows an attacker to inject malicious scripts that are stored on...

CVE-2026-105882 WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ThemeGrill User Registration user-registration allows Stored XSS.This issue affects User Registration: from n/a through 5.2.8...

EUVD-2026-102046

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in maxfoundry Social Share Buttons share-button allows Stored XSS.This issue affects Social Share Buttons: from n/a through 1.31...

CVE-2026-108491

The Everest Forms WordPress plugin (versions

CVE-2026-108491 WordPress Everest Forms plugin <= 3.6.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Everest Forms Everest Forms everest-forms allows Stored XSS.This issue affects Everest Forms: from n/a through 3.6.1...

CVE-2026-108498 WordPress BSK PDF Manager plugin <= 3.8.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bannersky BSK PDF Manager bsk-pdf-manager allows Stored XSS.This issue affects BSK PDF Manager: from n/a through 3.8.1...

CVE-2026-76182: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the...

CVE-2026-104828: Improper Neutralization of Input During Web Page Generation

HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable...

CVE-2026-110375: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Chill Download Monitor download-monitor allows Stored XSS.This issue affects Download Monitor: from n/a through 5.3.3...

GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-96893)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticat...

CVE-2026-105066 WordPress SimplyRETS Real Estate IDX plugin <= 3.2.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in SimplyRETS SimplyRETS Real Estate IDX simply-rets allows Reflected XSS.This issue affects SimplyRETS Real Estate IDX: from n/a through 3.2.9...

CVE-2026-89069

Progress MOVEit Transfer contains a Stored Cross-Site Scripting (XSS) vulnerability within the Ad Hoc module caused by improper neutralization of input during web page generation. This issue affects versions before 2025.1.6 and versions from 2026.0.0 before 2026.0.4 . The vulnerability carries a ...

CVE-2026-89069 MOVEit Transfer Stored XSS Vulnerability in Ad Hoc Packages

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Progress MOVEit Transfer Ad Hoc module. This issue affects MOVEit Transfer: before 2025.1.6 and from 2026.0.0 before 2026.0.4...