1135427 matches found
EUVD-2026-49713
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...
CVE-2026-15730
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...
CVE-2026-15730 GamiPress <= 7.9.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'heading_size' Shortcode Attribute
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headingsize' Shortcode Attribute in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...
CVE-2026-17528
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...
CVE-2026-14870 Database for Contact Form 7, WPforms, Elementor forms < 1.5.3 - Reflected XSS via form_id
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2026-14870
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
EUVD-2026-49701
The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before reflecting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2026-14870
The CVE pertains to the Database for Contact Form 7, WPforms, and Elementor forms WordPress plugin before 1.5.3. The issue is a Reflected Cross‑Site Scripting vulnerability caused by improper sanitisation and escaping of an input parameter before it is reflected on an admin page, which could impa...
CVE-2026-14819 Event Tickets < 5.28.4 - Editor+ Stored XSS via Ticket Move
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...
CVE-2026-14819
The Event Tickets and Registration WordPress plugin before 5.28.4 does not properly escape event titles before outputting them in a ticket history log, allowing users with the Editor role and above to perform Stored Cross-Site Scripting attacks that execute against higher-privileged users on...
Beautiful Cookie Consent Banner < 2.10.2 - Cross-Site Scripting
The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nscbarcontenthref' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
Apache OFBiz <=16.11.07 - Cross-Site Scripting
Apache OFBiz 16.11.01 to 16.11.07 is vulnerable to cross-site scripting because data sent with contentId to /control/stream is not sanitized. id: CVE-2020-1943 info: name: Apache OFBiz =16.11.07 - Cross-Site Scripting author: pdteam severity: medium description: Apache OFBiz 16.11.01 to 16.11.07 ...
CVE-2026-17528
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...
EUVD-2026-49688
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...
CVE-2026-17528
CVE-2026-17528 affects the nice-select2 JavaScript plugin. Versions before 2.4.1 are vulnerable to XSS via the element, where a malicious payload is rendered into the DOM and can execute arbitrary scripts in a user’s browser when interacting with affected pages. The issue is tied to insufficient...
CVE-2026-17528
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...
CVE-2026-17528
Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting XSS via the element. An attacker can supply a malicious payload that is rendered directly into the DOM without proper sanitization, causing arbitrary script execution in a victim’s browser when they view or...
EUVD-2026-49657
Unauthenticated Cross Site Scripting XSS in Kali Forms = 2.4.18 versions...