CVE-2026-63755 SurrealDB before 3.1.0 Permission Bypass via WHERE Clause

SurrealDB before 3.1.0 evaluates user-supplied WHERE clauses in SELECT statements and SET/MERGE/CONTENT/PATCH clauses in UPDATE, UPSERT, INSERT ON DUPLICATE KEY UPDATE, and RELATE update-variant statements against full record data before enforcing PERMISSIONS FOR SELECT WHERE restrictions. An...

react-router: React Router: Denial of Service via client-side Cross-Site Scripting in RSC redirect handling

A flaw was found in React Router versions 7.7.0 through 7.13.1. When using the unstable React Server Components RSC APIs, insufficient sanitization of redirect targets allows client-side cross-site scripting if redirects originate from untrusted sources. An attacker could inject script that...

react-router: React Router: Cross-Site Scripting vulnerability via untrusted React Server Component redirects

A flaw was found in React Router. This vulnerability, a type of Cross-Site Scripting XSS, affects applications utilizing React Router's unstable React Server Components RSC APIs. A remote attacker could exploit this by sending untrusted redirects, leading to the execution of malicious scripts in...

WordPress Smart Manager plugin <= 8.90.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin Smart Manager versions = 8.90.0...

WordPress Spectra Legacy – Gutenberg Blocks plugin <= 2.19.28 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by ? in WordPress Plugin Spectra versions = 2.19.28...

CVE-2026-2445

CVE-2026-2445 involves a reflected cross-site scripting (XSS) flaw in multiple WSO2 products where user-supplied input in a URL parameter is rendered without proper sanitization/encoding. The underlying issue is unsafe handling of URL parameters that can inject malicious JavaScript, enabling brow...

CVE-2026-2445 Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Redirection and Modification

The affected product accepts user-supplied input within a URL parameter without enforcing expected sanitization or encoding before rendering it within the response. This condition allows for the injection of malicious JavaScript payloads. An attacker can leverage this vulnerability to cause the...

WordPress Real Estate Manager Pro plugin <= 12.8.5 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Real Estate Manager Pro versions = 12.8.5...

WordPress Slider Pro plugin <= 4.8.13 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by manop55555 in WordPress Plugin Slider Pro versions = 4.8.13...

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-12592

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the...

EUVD-2026-45893

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833

The Tag Groups is the Advanced Way to Display Your Taxonomy Terms WordPress plugin before 2.2.0 does not properly escape one of its AJAX parameters before reflecting it in the response body served with an HTML content type, allowing unauthenticated attackers to execute arbitrary JavaScript in the...

CVE-2026-9833

CVE-2026-9833 affects the WordPress plugin Tag Groups prior to 2.2.0. The issue is a reflected XSS: an AJAX parameter is not properly escaped before being reflected in an HTML response, enabling an attacker to run arbitrary JavaScript in the browser of a logged-in user (Editor or higher) who is e...

CVE-2026-12592

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the...

CVE-2026-12970 LearnPress < 4.4.1 - Reflected XSS via c_search

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

CVE-2026-12970

The LearnPress WordPress plugin before 4.4.1 does not escape a search parameter before reflecting it into an HTML attribute, leading to Reflected Cross-Site Scripting that executes in the browser of a logged-in instructor or administrator who is tricked into opening a crafted link...

CVE-2026-12592

CVE-2026-12592 affects the SlimStat Analytics WordPress plugin prior to v5.5.0. The vulnerability stems from not escaping a visitor-controlled geolocation value before rendering in admin analytics reports, enabling unauthenticated visitors to inject a stored XSS payload that executes in an admini...

CVE-2026-12970

The CVE-2026-12970 entry concerns LearnPress for WordPress (before 4.4.1). The vulnerability is a Reflected Cross-Site Scripting flaw where a search parameter is not escaped before being echoed into an HTML attribute (parameter: c_search). This can affect a logged-in instructor or administrator w...

EUVD-2026-45881

The SlimStat Analytics WordPress plugin before 5.5.0 does not escape a visitor-controlled geolocation value before outputting it in its admin analytics reports, allowing unauthenticated visitors to store a cross-site scripting payload that executes in the browser of an administrator who views the...