EUVD-2025-210260

Unauthenticated Cross Site Scripting XSS in SweetDate Core 1.1.5 versions...

EUVD-2026-37635

Unauthenticated Cross Site Scripting XSS in Popup box = 6.2.9 versions...

EUVD-2026-37636

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.0.1 versions...

EUVD-2026-37633

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...

EUVD-2026-37634

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.10 versions...

EUVD-2026-37624

Unauthenticated Cross Site Scripting XSS in WPFunnels Pro = 2.9.4 versions...

EUVD-2026-37616

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.9.1 versions...

EUVD-2026-37606

Unauthenticated Cross Site Scripting XSS in Kapee 1.7.1 versions...

EUVD-2026-37608

Unauthenticated Cross Site Scripting XSS in Profile Builder Pro = 3.15.0 versions...

EUVD-2026-37603

Unauthenticated Cross Site Scripting XSS in collectchat = 2.4.9 versions...

EUVD-2026-37590

Unauthenticated Cross Site Scripting XSS in WPZOOM Addons for Elementor = 1.3.4 versions...

EUVD-2026-37577

An attacker with access via network to the Regesta Smart HD-PLC of the provider Teldat in this case, registration action IS required who has the vulnerable software could, introduce arbitrary JavaScript by injecting a Cross-site Scripting XSS payload into the 'Hostname' field of the configuration...

EUVD-2026-37651

Unauthenticated Cross Site Scripting XSS in Auto Repair = 22.6 versions...

EUVD-2026-37652

Unauthenticated Cross Site Scripting XSS in Skillate = 1.2.10 versions...

EUVD-2026-37659

Unauthenticated Cross Site Scripting XSS in WPJobster = 6.3.5 versions...

EUVD-2024-55627

Unauthenticated Cross Site Scripting XSS in my flatonica = 0.0.8 versions...

EUVD-2025-210221

Unauthenticated Cross Site Scripting XSS in Sonaar = 4.27.4 versions...

CVE-2026-48591

Improper Neutralization of Script in Attributes in a Web Page vulnerability in pragdave earmark allows stored cross-site scripting via unescaped HTML attribute values. 'Elixir.Earmark.Transform':makeatt1/2 in lib/earmark/transform.ex splices attribute values verbatim between two literal " bytes: ...

WordPress PowerPress Podcasting plugin by Blubrry plugin <= 11.16.8 - Authenticated (Author+) Stored Cross-Site Scripting vulnerability

Authenticated Author+ Stored Cross-Site Scripting vulnerability discovered by Mukhlis Amien in WordPress Plugin PowerPress Podcasting versions = 11.16.8...

Gitea: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

Summary Me again. Gitea's built-in 3D file viewer powered by Online3DViewer is vulnerable to stored cross-site scripting XSS through crafted .gltf files. When a glTF file declares an unsupported required extension, Online3DViewer generates an error message containing the extension name and Gitea...