CVE-2026-97642

The Wp Parsidate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calendar Gutenberg block's 'theme' attribute in versions up to, and including, 6.4. This is due to insufficient input sanitization and output escaping on the block attribute value which is concatenated...

CVE-2026-110776

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'vars' parameter in all versions up to, and including, 1.4.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-120550

The WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name REST users endpoint - wpusers.displayname' parameter in all versions up to, and including, 2.10.2 due to insufficient input...

CVE-2026-122222

The Permalink Manager Lite plugin for WordPress (versions ¢= 2.6.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the 'slug' parameter due to insufficient input sanitization and output escaping. An authenticated attacker with Author-level access or higher can submit a p...

CVE-2026-118189

The Posts Table with Search & Sort plugin for WordPress (versions up to and including 1.4.14 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the date_format parameter within the plugin's shortcode attributes. This all...

CVE-2026-110291

The Graphina – Charts and Graphs For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.13 . The flaw exists in the iq_tree_chart_node_font_family parameter and any text control serialized into chart_data['settings'] due to insuff...

CVE-2026-120671

The UsersWP plugin for WordPress (versions up to and including 1.2.80 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw resides in the 'badge' shortcode attribute due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or hig...

CVE-2026-119472

The Redux Framework (redux-framework) WordPress plugin, versions up to and including 4.5.16 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject and execute m...

CVE-2026-39744

The WC Lovers WCFM Membership (wc-multivendor-membership) plugin for WordPress is vulnerable to Stored Cross-site Scripting (XSS) due to improper neutralization of input during web page generation. This issue affects versions up to and including 2.12.0 . Exploitation of this vulnerability can lea...

CVE-2026-119488

The Shamim Rajani Pie Register plugin for WordPress is vulnerable to a Stored Cross-site Scripting (XSS) flaw due to improper neutralization of input during web page generation. This issue affects versions from n/a through 3.8.4.15 . Exploitation details are not provided in the documents.

CVE-2026-121822

A vulnerability has been identified in armeria versions 0.80.0 through 1.42.0, where attackers who control file names can cause stored cross-site scripting XSS when directory listing is enabled and a user views the listing...

CVE-2026-121822

Versions 0.80.0 through 1.42.0 of armeria are vulnerable to stored cross-site scripting (XSS) . The issue occurs when directory listing is enabled and a user views the listing; attackers who can control file names can execute malicious scripts. No specific remediation or exploit details are provi...

WordPress Smart Cookie Kit plugin <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Santh in WordPress Plugin Smart Cookie Kit versions = 2.3.2...

CVE-2026-88801

The MDJM Event Management and Mobile Events Manager WordPress plugins (versions up to and including 1.7.8.7 ) are vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to verify a capability or nonce before creating a WordPress role from a request-supplied name, combined...

WordPress AAA Autoload Optimizer plugin <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin AAA Option Optimizer versions = 1.7.0...

WordPress WP Customer Area plugin <= 8.4.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin WP Customer Area versions = 8.4.0...

CVE-2026-123094

A flaw was found in Huginn. The application improperly handles OAuth service display names, resulting in a stored cross-site scripting XSS vulnerability. An authenticated attacker can exploit this issue by registering an account with crafted display names or email addresses and sharing it globall...

WordPress RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin <= 5.2.13 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by churchill11 in WordPress Plugin Feedzy versions = 5.2.13...

WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.4.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin MDTF versions = 1.4.1...

CVE-2026-103863

A flaw was found in Apache Sling Engine. This vulnerability allows an attacker to conduct stored Cross-Site Scripting XSS attacks by evading security header protections. Included components can bypass header and content-type enforcement mechanisms through manipulated response headers, character s...