WordPress JetFormBuilder — Dynamic Blocks Form Builder plugin <= 3.6.5.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Tarcísio Luchesi De Almeida Silva Poystick in WordPress Plugin JetFormBuilder versions = 3.6.5.3...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

WordPress WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin <= 2.0.2 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by UKO in WordPress Plugin Contact Form by WPForms versions = 2.0.2...

EUVD-2026-86593

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-17577

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 4.7.42 . The flaw exists in the ssl_zen_messages::getMessages() function, which processes the uri and host parameters. Because the application uses base64_decode() on the output ...

CVE-2026-17577 SSL Zen <= 4.7.42 - Reflected Cross-Site Scripting via 'uri' Parameter

The SSL Zen plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'uri' and 'host' parameters in versions up to, and including, 4.7.42. The sslzenmessages::getMessages function builds the 'tokenmissmatch' message using base64decodesanitizetextfield$REQUEST'uri' and optional...

CVE-2026-88996

The WPForms – AI Form Builder for WordPress plugin is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 2.0.2 . The root cause is insufficient input sanitization and output escaping of the page_title POST parameter when processed via the {page_title} Smart Tag...

EUVD-2026-86590

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-88996 WPForms <= 2.0.2 - Reflected Cross-Site Scripting via 'page_title' POST Parameter

The WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'pagetitle' POST Parameter via pagetitle Smart Tag in all versions up to, and including, 2.0.2 due to insufficient input...

CVE-2026-92212

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-78393

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in...

CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

EUVD-2026-86534

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212 JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'jfbxss' URL Query Variable Parameter via Calculated Field in all versions up to, and including, 3.6.5.3 due to insufficient input sanitization and output escaping. This makes...

CVE-2026-92212

The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in all versions up to and including 3.6.5.3 . The root cause is insufficient input sanitization and output escaping involving the 'jfb_xss' (URL Query Variable) Parameter vi...

EUVD-2026-86527

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in...

CVE-2026-78393 Link Library < 7.9.6 - Reflected XSS via 'link_tags' and 'link_price' Sort and Breadcrumb Links

The Link Library WordPress plugin before 7.9.6 does not properly escape some parameters before outputting them in the addresses of links it generates on its front-end directory pages, leading to Reflected Cross-Site Scripting which could be used against any visitor, including logged-in...