PT-2026-49372

Unauthenticated Cross Site Scripting XSS in Simply Schedule Appointments = 1.6.10.6 versions...

PT-2026-49222

WordPress appointment-booking-calendar 1.1.24 contains multiple privilege escalation vulnerabilities that allow unauthenticated attackers to modify calendar settings and inject persistent cross-site scripting payloads through the admin.php page parameters. Attackers can inject malicious JavaScrip...

CVE-2026-50876

A cross-site scripting XSS vulnerability in Deck9 Input v2.0.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload...

PT-2026-49465

Unauthenticated Cross Site Scripting XSS in AutomatorWP = 5.7.2 versions...

PT-2026-49354

Unauthenticated Cross Site Scripting XSS in Redirection for Contact Form 7 = 3.2.8 versions...

PT-2026-49462

Subscriber Cross Site Scripting XSS in Modula Image Gallery = 2.14.23 versions...

PT-2026-49483

Unauthenticated Cross Site Scripting XSS in Stop Spammers = 2026.3 versions...

PT-2026-49414

Unauthenticated Cross Site Scripting XSS in Coupon Affiliates = 7.5.3 versions...

PT-2026-49489

Unauthenticated Cross Site Scripting XSS in HollerBox = 2.3.10.1 versions...

PT-2026-49366

Unauthenticated Cross Site Scripting XSS in GiveWP = 4.14.2 versions...

PT-2026-49447

Subscriber Cross Site Scripting XSS in Contest Gallery = 28.1.6 versions...

PT-2026-49559

Name of the Vulnerable Software and Affected Versions DOMPurify affected versions not specified Description An issue exists where the sanitizer skips the contents of a shadow DOM attached to an element inside a element. This allows malicious payloads, such as images with onerror handlers, links...

GeoVision LPC2011/LPC2211 Web Interface / ssi.cgi reflected cross-site scripting (XSS) vulnerabilities

Summary Multiple exploitable reflected cross-site scripting XSS vulnerabilities exist in the Web Interface / ssi.cgi functionality of LPC2011/LPC2211 versions: 1.10. A specially crafted malicious url can lead to an arbitrary javascript code execution. An attacker can provide a crafted URL to...

PT-2026-49290

Name of the Vulnerable Software and Affected Versions Ruoyi version 4.8.2 Description Cross Site Scripting XSS occurs at the '/system/notice/add' endpoint. XSS is a type of security flaw that allows an attacker to inject malicious scripts into web pages viewed by other users. Recommendations At t...

PT-2026-49204

WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary...

PT-2026-49475

Unauthenticated Cross Site Scripting XSS in Post SMTP = 3.6.2 versions...

PT-2026-49240

Contributor Cross Site Scripting XSS in Elizaibots = 1.0.2 versions...

PT-2026-49479

Unauthenticated Cross Site Scripting XSS in MW WP Form = 5.1.3 versions...

CVE-2026-36521

Technical details are not publicly available in the provided documents. Monitor for updates on PublicCMS V5.202506.d XSS in the site configuration management module.

PT-2026-49286

Name of the Vulnerable Software and Affected Versions PublicCMS version 5.202506.d Description A Cross Site Scripting XSS issue exists within the site configuration management module. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed by other users...