CVE-2026-16570

The NextScripts: Social Networks Auto-Poster WordPress plugin, in versions before 4.4.8 , is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the failure to properly escape certain query-string parameters reflected on one of its admin pages. Attackers can exploit this ...

EUVD-2026-62270

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

CVE-2026-16570 NextScripts: Social Networks Auto-Poster < 4.4.8 - Reflected XSS via Facebook OAuth Callback

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

PT-2026-78300

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

PT-2026-78301

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape a parameter before reflecting it into an HTML attribute on one of its administrative pages, leading to reflected Cross-Site Scripting that runs in the session of an administrator induced to submit a crafted...

PT-2026-78284

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

PT-2026-78454

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

PT-2026-78435

Name of the Vulnerable Software and Affected Versions OpenEMR versions prior to 8.3.0 Description A reflected cross-site scripting issue exists in the patient portal template import handler. The templateHtml GET parameter is reflected in the page response without proper sanitization. This allows ...

PT-2026-78432

Name of the Vulnerable Software and Affected Versions HumHub Community Edition version 1.18.4 Description A reflected cross-site scripting issue exists in the Space membership-request workflow. An attacker can inject malicious button configuration into the options query-string parameter of the...

CVE-2026-75955: Improper Neutralization of Input During Web Page Generation

Joomla Extension - cmsjunkie.com - Reflected XSS / XML injection in J-BusinessDirectory 6.2.3 - companyName from the request was written unescaped into an XML attribute...

CVE-2026-40507: Improper Neutralization of Input During Web Page Generation

OpenEMR before 8.3.0 contains a reflected cross-site scripting vulnerability in the patient portal template import handler. The templateHtml GET parameter is reflected into the page response without sanitization. An attacker can craft a URL that executes arbitrary JavaScript in the browser of any...

CVE-2026-18756: Improper Neutralization of Input During Web Page Generation

HumHub Community Edition 1.18.4 contains a reflected cross-site scripting vulnerability in the Space membership-request workflow. An attacker can place attacker-controlled button configuration in the options query-string parameter of space/membership/request-membership-form, lure an authenticated...

CVE-2026-19055: Improper Neutralization of Input During Web Page Generation

The ProSolution WP Client WordPress plugin before 2.0.11 does not sanitise and escape several parameters before reflecting them into HTML attributes on its public pages, leading to reflected Cross-Site Scripting that can be triggered against any visitor, including a logged-in administrator...

CVE-2026-16570: Improper Neutralization of Input During Web Page Generation

The NextScripts: Social Networks Auto-Poster WordPress plugin before 4.4.8 does not escape some of the query-string parameters it reflects back on one of its admin pages, allowing attackers to perform Reflected Cross-Site Scripting attacks against logged-in users such as administrators who are...

Exploit for CVE-2026-64638

CVE-2026-64638 // XSS2Shell Análisis técnico y matriz de mi...

CVE-2026-52609

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the reporticocriteria parameter in conjunction with the executemode=CRITERIA parameter of run.php...

CVE-2026-52606

A reflected cross-site scripting XSS vulnerability in reportico-web = 8.1.0 allows remote attackers to execute arbitrary JavaScript in the web browser of a user by including a malicious payload in the loadTemplate parameter in conjunction with the executemode=PREPARE parameter of run.php...

WordPress WP Photo Album Plus plugin < 9.2.07.002 - Reflected XSS via lbstart vulnerability

Reflected XSS via lbstart vulnerability discovered by Muni Nitish Kumar Yaddala in WordPress Plugin WP Photo Album Plus versions 9.2.07.002...

CVE-2026-45118 MyBB: Contact page reflected XSS

MyBB is free and open source forum software. Prior to 1.8.40, the Contact module does not validate a redirect URL or protocol correctly, resulting in an open redirect and reflected JavaScript code injection. contact.php accepts the redirect target from the from HTTP parameter in $mybb-input'from'...

CVE-2026-45118

MyBB's contact.php passes unvalidated from parameter or Referer header to redirect() without protocol checks, allowing a javascript: URI to become a clickable link that executes script when a victim clicks it. No public exploitation evidence is available. Upgrade to MyBB 1.8.40 to fix.