PT-2026-109790

Name of the Vulnerable Software and Affected Versions Kids Planet versions prior to 2.2.14.2 Description ThemeREX Group Kids Planet contains an issue where input is not properly neutralized during web page generation, leading to Reflected Cross-site Scripting XSS. This occurs when an application...

CVE-2026-102388: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3...

CVE-2026-93951: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bracketweb Zeinet zeinet allows Reflected XSS.This issue affects Zeinet: from n/a through 1.0.0...

CVE-2026-94066

The WordPress Pond theme (versions

CVE-2026-94063

The ThemeREX Education Center WordPress theme is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw due to the improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 3.6.12 . Exploitation details are not provided in the documents, ...

CVE-2026-94060 WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0...

EUVD-2026-95758

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0...

CVE-2026-62029 WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3...

EUVD-2026-95730

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8...

CVE-2026-94158

The bkninja Gloria Admin Panel WordPress plugin (versions

CVE-2026-94170 WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79...

CVE-2026-94159

The KlbTheme Total Donations WordPress plugin (versions

CVE-2026-94159 WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5...

CVE-2026-94167

The Extend Themes Kubio AI Page Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability affects versions from n/a through 2.9.3 . Exploitation of this flaw could allow an attacker to ...

CVE-2026-96607 WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1...

CVE-2026-94667

The Crocoblock JetReviews WordPress plugin (versions up to and including 3.1.2 ) is vulnerable to Stored Cross-Site Scripting (XSS) . This is caused by the improper neutralization of input during web page generation . The vulnerability allows an attacker to inject malicious scripts that are store...

CVE-2026-94668

The Dimitri Grassi Salon booking system WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in versions 10.31.5 and earlier . The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability allows an attacker to execute arbitrary s...

CVE-2026-94665 WordPress Classified Listing plugin <= 6.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2...

CVE-2026-94667 WordPress JetReviews plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2...

EUVD-2026-95618

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10...