CVE-2026-28178 WordPress Powerkit plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting XSS in Powerkit = 3.1.0 versions...

CVE-2026-28179 WordPress FiboSearch plugin <= 1.33.0 - Cross Site Scripting (XSS) vulnerability

Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...

EUVD-2026-53951

Shop manager Cross Site Scripting XSS in FiboSearch = 1.33.0 versions...

EUVD-2026-53949

Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...

CVE-2026-28177 WordPress Popup Maker plugin <= 1.23.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Popup Maker = 1.23.0 versions...

CVE-2026-28177

Popup Maker WordPress plugin

CVE-2026-28172 WordPress Tracking Code Manager plugin <= 2.6.0 - CSRF to Stored XSS vulnerability

Unauthenticated Cross Site Request Forgery CSRF in Tracking Code Manager = 2.6.0 versions...

EUVD-2026-53944

Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...

CVE-2026-28143 WordPress Forminator plugin <= 1.56.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...

CVE-2026-28143

Forminator plugin for WordPress is affected by CVE-2026-28143: unauthenticated XSS in versions up to and including 1.56.0. The vulnerability arises in the plugin code path handling input that can be crafted by an attacker without authentication. Impact, as described in the sources, is Cross Site ...

CVE-2026-28141

Summary: CVE-2026-28141 is an Unauthenticated Cross Site Scripting (XSS) vulnerability affecting the WordPress NextGEN Gallery plugin, version

CVE-2026-28141 WordPress NextGEN Gallery plugin <= 4.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in NextGEN Gallery = 4.2.3 versions...

EUVD-2026-53945

Unauthenticated Cross Site Scripting XSS in Forminator = 1.56.0 versions...

EUVD-2026-53940

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-28082

CVE-2026-28082 affects the WordPress JetEngine plugin up to version 3.8.13.1, describing an unauthenticated Cross Site Scripting (XSS) vulnerability. The connected sources confirm the vulnerability existence and affected product/version but do not provide concrete technical details such as the ex...

CVE-2026-28082 WordPress JetEngine plugin <= 3.8.13.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetEngine = 3.8.13.1 versions...

CVE-2026-18501

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

WordPress GeekyBot plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin GeekyBot versions = 1.2.6...

EUVD-2026-53926

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...

CVE-2026-18501 UsersWP <= 1.2.69 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Badge Widget Variable Substitution

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Badge Widget Variable Substitution in all versions up to, and including, 1.2.69 due to insufficient input sanitization and...