1163601 matches found
EUVD-2026-53702
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...
CVE-2026-16636 FluentSMTP <= 2.2.95 - Unauthenticated Stored Cross-Site Scripting via Recipient Display Name (to.name) in Email Logs
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...
CVE-2026-16636
The CVE concerns FluentSMTP
SUSE CVE-2026-15920
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. django.contrib.admin.utils.displayforfield renders URLField values as clickable links in the admin without validating the URL. A value stored with an unsafe scheme is displayed as a link on changelist and read-only admin...
EUVD-2026-53683
A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...
CVE-2026-18968
A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...
CVE-2026-65517: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Easy PayPal Buy Now Button = 2.0.4 versions...
VulnCheck KEV: CVE-2018-14013
Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...
Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations
Overview A cross-site scripting XSS vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG Scalable Vector Graphics objects in ICS iCalendar invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTota...
CVE-2026-66711: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WooCommerce Multilingual & Multicurrency = 5.5.6 versions...
CVE-2026-61961: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in EmbedPress = 4.5.6 versions...
CVE-2026-66439: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Advanced AJAX Product Filters = 3.2.0.3 versions...
CVE-2026-28141: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...
PT-2026-68624
Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Inclusion of Functionality from Untrusted Control Sphere issue exists in the HTML5 scrubber. A remote attacker can load an arbitrary document into a trusted page by utilizing the dat...
CVE-2026-65545: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in AI Engine = 3.6.8 versions...
PT-2026-68882
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.0.3 Description WordPress contains a pre-authentication reflected cross-site scripting XSS issue on the login screen. The root cause is a discrepancy between two sanitizers regarding HTML tag identification, where...
CVE-2026-61964: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...
CVE-2026-65560: Improper Neutralization of Input During Web Page Generation
Unauthenticated Cross Site Scripting XSS in Houzez Property Feed = 2.5.48 versions...
PT-2026-68504
Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.13.2 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...