CVE-2026-73182 WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...

CVE-2026-73182

Unauthenticated reflected XSS affects BBQ Pro plugin (WordPress) up to version 3.9, rated CVSS 7.1 (HIGH). No exploitation or patch details are provided; CISA SSVC assesses partial technical impact. Upgrade to a version newer than 3.9 once available and monitor Patchstack advisories. Exploitation...

CVE-2026-73182 WordPress BBQ Pro plugin <= 3.9 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in BBQ Pro = 3.9 versions...

CVE-2026-66596 WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

EUVD-2026-62374

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

CVE-2026-66596 WordPress Newsletter plugin <= 9.3.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Newsletter = 9.3.3 versions...

EUVD-2026-62373

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

CVE-2026-61986

CVE-2026-61986 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress Contest Gallery plugin , affecting versions 30.0.5 and earlier . The flaw allows an unauthenticated attacker to inject malicious scripts, with a CVSS 3.1 base score of 7.1 (HIGH) — network vector, low c...

CVE-2026-61986 WordPress Contest Gallery plugin <= 30.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Contest Gallery = 30.0.5 versions...

WordPress DSK theme <= 2.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme DSK versions = 2.1...

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme theme <= 2.4 - Cross Site Scripting (XSS) vulnerability

WordPress Valen - Sport, Fashion WooCommerce WordPress Theme theme = 2.4 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme Valen - Sport, Fashion WooCommerce WordPress Theme versions = 2.4...

WordPress MBStore - Digital WooCommerce WordPress Theme theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

WordPress MBStore - Digital WooCommerce WordPress Theme theme = 2.3 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme MBStore - Digital WooCommerce WordPress Theme versions = 2.3...

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme theme <= 2.3 - Cross Site Scripting (XSS) vulnerability

WordPress BodyCenter - Gym, Fitness WooCommerce WordPress Theme theme = 2.3 - Cross Site Scripting XSS vulnerability discovered by Tran Nguyen Bao Khanh VCI - VNPT Cyber Immunity in WordPress Theme BodyCenter - Gym, Fitness WooCommerce WordPress Theme versions = 2.3...

WordPress SmartSMTP plugin <= 1.2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Jorgson in WordPress Plugin SmartSMTP versions = 1.2.0...

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab 4.5+ allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor.Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instruction...

PYSEC-2026-3671 JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab's image viewer allows for cross-site scripting XSS when a specially-crafted image file is opened through the image viewer and then opened in a new tab. This XSS issue can be used to cause remote code execution RCE on the JupyterLab server. Impact This vulnerability allows for arbitrary...

PYSEC-2026-3672 JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

JupyterLab 4.5+ allows notebook settings to be shared and applied through an overrides.json file using the Import button in the Settings Editor. Certain notebook display settings were not properly validated before being applied. As a result, a crafted settings file could contain hidden instructio...

WordPress Podlove Podcast Publisher plugin <= 4.5.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Podlove Podcast Publisher versions = 4.5.4...

WordPress Paymob for WooCommerce plugin <= 4.1.10 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Paymob for WooCommerce versions = 4.1.10...