PT-2026-67078

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

WordPress Exclusive Addons for Elementor plugin <= 2.7.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Exclusive Addons Elementor versions = 2.7.9.8...

PT-2026-67122

Name of the Vulnerable Software and Affected Versions Download Manager versions prior to 3.3.67 Description The Download Manager plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into...

PT-2026-66895

Name of the Vulnerable Software and Affected Versions SureForms versions prior to 2.8.2 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts throu...

PT-2026-67076

Name of the Vulnerable Software and Affected Versions Powerkit – Supercharge your WordPress Site versions prior to 3.1.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. Th...

PT-2026-67097

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipress rank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

PT-2026-67085

Name of the Vulnerable Software and Affected Versions Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates versions prior to 2.2.12 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level acces...

CVE-2026-15649: Improper Neutralization of Input During Web Page Generation

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

PT-2026-66891

Name of the Vulnerable Software and Affected Versions SendPulse Email Marketing Newsletter versions prior to 2.2.6 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to perform Stored Cross-Site Scripting XSS. An...

FreeBSD : py-mkdocs-material -- DOM XSS vulnerability (1976b049-8ccc-11f1-b333-901b0edee044)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 1976b049-8ccc-11f1-b333-901b0edee044 advisory. Martin Donath reports: Material for MkDocs 7.2.0 through 9.7.6 contains a DOM-based cross-site scriptin...

PT-2026-67079

Name of the Vulnerable Software and Affected Versions Advanced Woo Labels – Product Labels & Badges for WooCommerce versions prior to 2.49 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored...

PT-2026-67096

Name of the Vulnerable Software and Affected Versions GamiPress versions prior to 7.9.9.2 Description The GamiPress plugin for WordPress contains a Stored Cross-Site Scripting issue. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. This...

PT-2026-67308

Name of the Vulnerable Software and Affected Versions @better-auth/sso versions prior to 1.6.21 Description Multiple authentication bypass issues exist in the handling of SSO providers, allowing attackers to sign in as arbitrary users. This can be achieved through domain verification parsing...

PT-2026-67121

The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to, and including, 3.5.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-67130

Name of the Vulnerable Software and Affected Versions Wp Responsive Thumbnail Slider versions prior to 1.1.53 Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking a specially crafted link. The issue stems from insufficient input sanitization a...

PT-2026-67129

The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Identity Block Inner Image Content in all versions up to, and including, 3.7.8.1 due to insufficient input sanitization and output escaping. This makes it possible...

PT-2026-67040

Name of the Vulnerable Software and Affected Versions Download Manager WordPress plugin versions prior to 3.3.66 Description Insufficient escaping of a package title before it is rendered in front-end package templates allows users with the Author role or higher to perform a Stored Cross-Site...

PT-2026-67070

The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress admin list-table columns, allowing users with contributor-level access or above to store a payload that executes as JavaScript in the session of...

PT-2026-67124

Name of the Vulnerable Software and Affected Versions Fluent Forms versions prior to 6.2.9 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link...

PT-2026-67058

The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form Field Values in all versions up to, and including, 4.3.3 due to insufficient input sanitization and output escaping. This makes it possible for...