EUVD-2026-72108

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

CVE-2026-19859

The JetFormBuilder WordPress plugin before 3.6.5.2 does not sanitize a request parameter before rendering it as message content, allowing unauthenticated users to execute arbitrary shortcodes registered on the site on any page displaying a form. Escaping is applied to that content before a later...

PT-2026-86521

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-pars...

CVE-2026-76573

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76573

The Pods – Custom Content Types and Fields WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the 'not_found' shortcode attribute in all versions up to and including 3.3.9.1 . The root cause is insufficient input sanitization and output escaping . Authenticated attackers with...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-71934

The Contact Form by Supsystic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via IP Address Header in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary w...

CVE-2026-83625

The Contact Form by Supsystic WordPress plugin (all versions up to and including 1.10.2 ) is vulnerable to unauthenticated stored XSS via insufficient input sanitization and output escaping. An attacker exploits the updateNonce action—accessible without authentication because it is absent from th...

CVE-2026-85414

Gallery: FooGallery plugin for WordPress (all versions up to, and including, 3.3.2 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability through the custom_settings shortcode attribute, caused by insufficient input sanitization and output escaping . An authenticated attacker with Con...

EUVD-2026-71932

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-78438

The W3 Total Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via LazyLoad Background Mutator in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-15984

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-15984

The QuickCal WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via Custom Field Parameters in all versions up to and including 1.0.20 . The root cause is insufficient input sanitization and output escaping. A critical aggravating factor is that the nonce guarding the unauthentic...

CVE-2026-15984 QuickCal <= 1.0.20 - Unauthenticated Stored Cross-Site Scripting via Custom Field Parameters

The QuickCal plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Custom Field Parameters in all versions up to, and including, 1.0.20 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts ...

CVE-2026-78438

The W3 Total Cache plugin for WordPress (versions ≤ 2.10.5 ) is affected by an unauthenticated Stored Cross-Site Scripting vulnerability in the LazyLoad Background Mutator component. Due to insufficient input sanitization and output escaping , attackers can inject arbitrary scripts via comment co...

CVE-2026-16649 Gravity Forms <= 2.10.5 - Unauthenticated Stored Cross-Site Scripting via Post Body Field Value

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

EUVD-2026-71879

The Gravity Forms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Post Body Field Value in all versions up to, and including, 2.10.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2026-18843

The Beaver Builder Plugin (Starter Version) for WordPress is affected by a Reflected Cross-Site Scripting (XSS) vulnerability in the no_results_message node_preview parameter, present in all versions up to and including 2.11.0.1 . The root cause is insufficient input sanitization and output escap...

EUVD-2026-71877

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'noresultsmessage' nodepreview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2025-14945

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...