40263 matches found
CVE-2026-18361
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the datastore upload function...
CVE-2026-18360
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the custom attributes function...
CVE-2026-16969
The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...
CVE-2026-14318
The CVE concerns the GiveWP WordPress plugin prior to version 4.16.3. A donation-form template setting is not escaped before being output into an HTML attribute, enabling users with the GiveWP Worker role and above to inject arbitrary scripts that execute on the public donation form viewed by vis...
CVE-2026-14592
The CVE-2026-14592 entry concerns the WP Real IP-based Access Control WordPress plugin up to version 1.3.1. The underlying issue is that the plugin does not perform any capability or nonce checks before storing an option value, and does not escape that value on output on its settings page. This e...
CVE-2026-66490 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...
CVE-2026-66490 Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox < 2.20.2
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...
EUVD-2026-50333
Joomla Extension - balbooa.com - Stored cross-site scripting via a comment avatar in Gridbox 2.20.2...
CVE-2026-66490
The vulnerability CVE-2026-66490 affects the Joomla Extension balbooa Gridbox prior to version 2.20.2. The issue is a stored cross-site scripting (XSS) vulnerability that can be triggered via a comment avatar, as described in multiple sources. The root cause is an input/output handling weakness i...
CVE-2026-7436
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2026-16655
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...
CVE-2026-8791 Booking System Trafft <= 1.0.17 - Authenticated (Subscriber+) Stored Cross-Site Scripting
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...
EUVD-2026-50273
The Booking System Trafft plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bookingWebsiteUrl setting in all versions up to, and including, 1.0.17 due to a missing capability check on the setoptions AJAX action when the plugin is operating in agency mode. The...
CVE-2026-16655 Fluent Forms <= 6.2.7 - Unauthenticated Stored Cross-Site Scripting via Name Field Nested `password` Member
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...
CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2026-7436
CVE-2026-7436 affects the WordPress plugin “WPC Badge Management for WooCommerce” (WordPress plugin). The vulnerability is a Stored Cross-Site Scripting (XSS) via the text attribute in the wpcbm_best_seller shortcode, exploitable in all versions up to and including 3.1.6 . The issue arises from i...
EUVD-2026-50269
The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...
CVE-2026-16597
Summary: CVE-2026-16597 affects the GTM4WP WordPress plugin (versions ≤ 1.22.3) and allows unauthenticated stored XSS via WooCommerce Billing Fields when the GTM4WP_OPTION_INTEGRATE_WCORDERDATA option is enabled. The root cause is insufficient input sanitization and output escaping in the plugin’...
CVE-2026-13425
The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...
CVE-2026-13605
The PhotoSwipe WordPress plugin through 4.1.1.1 uses the title attribute of author-supplied link markup as a lightbox caption that is written into the page DOM without escaping. Because the title attribute survives the post-content sanitization applied to users who lack the unfilteredhtml...