PT-2026-68504

Name of the Vulnerable Software and Affected Versions JetEngine versions prior to 3.8.13.2 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user without requiring prior authentication. Recommendations...

PT-2026-68604

Name of the Vulnerable Software and Affected Versions WooCommerce Multilingual & Multicurrency versions prior to 5.5.7 Description Cross Site Scripting XSS allows users with Subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer...

PT-2026-71536

Name of the Vulnerable Software and Affected Versions GeekyBot versions prior to 1.2.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a...

PT-2026-68882

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 7.0.3 Description WordPress contains a pre-authentication reflected cross-site scripting XSS issue on the login screen. The root cause is a discrepancy between two sanitizers regarding HTML tag identification, where...

CVE-2026-66702: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Rank Math SEO = 1.0.274.1 versions...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2926)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

PT-2026-71545

Name of the Vulnerable Software and Affected Versions Agrion versions prior to 1.0.1 Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages, which execute when a...

PT-2026-68624

Name of the Vulnerable Software and Affected Versions html sanitize ex versions 0.3.1 through 1.5.2 Description An Inclusion of Functionality from Untrusted Control Sphere issue exists in the HTML5 scrubber. A remote attacker can load an arbitrary document into a trusted page by utilizing the dat...

EulerOS 2.0 SP15 : golang (EulerOS-SA-2026-2885)

According to the versions of the golang packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : CVE-2026-27142 fixed a vulnerability in which URLs were not correctly escaped inside of a meta tag's content attribute. If the URL content were to...

WP < 7.0.3 - Reflected XSS

Description WordPress does not escape login error message in some cases, which could lead to Reflected XSS...

WP < 7.0.3 - Contributor+ Stored XSS in Quick Edits

Description WordPress does not properly escape user display names in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against higher privileged users viewing the affected admin screens...

CVE-2026-61964: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Ninja Tables = 5.2.9 versions...

PT-2026-71534

Name of the Vulnerable Software and Affected Versions Stripe Payment Forms by WP Full Pay versions prior to 8.5.1 Description Stored Cross-Site Scripting XSS occurs due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts in...

CVE-2026-61963: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...

Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

Overview A cross-site scripting XSS vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG Scalable Vector Graphics objects in ICS iCalendar invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTota...

WP < 7.0.3 - Contributor+ Stored XSS via Emoji Settings Element

Description WordPress does not properly restrict the content of submitted posts in some cases, which could allow users with a role of Contributor and above to perform Stored Cross-Site Scripting attacks against users previewing the post...

VulnCheck KEV: CVE-2018-14013

Synacor Zimbra Collaboration Suite Collaboration before 8.8.11 has XSS in the AJAX and html web clients...

CVE-2026-18968: Improper Neutralization of Input During Web Page Generation

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...

CVE-2026-18968

CVE-2026-18968 affects ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. The vulnerability is in processing of the file /tags.php where manipulation of the day argument enables cross site scripting. The attack could be performed remotely, and the exploit has been publicly disclosed....

CVE-2026-18968 ttttonyhe OBlog tags.php cross site scripting

A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknown processing of the file /tags.php. Such manipulation of the argument day leads to cross site scripting. The attack may be performed from remote. The exploit...