EUVD-2026-82644

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-92991

The Biggopti Library , a JavaScript component embedded in multiple WordPress plugins (including Ultimate Post Kit , Ultimate Store Kit , Smart Admin Assistant , Live Copy Paste , BDThemes Prime Slider Lite , BDThemes Element Pack Lite , and Pixel Gallery ), is vulnerable to Cross-Site Scripting (...

CVE-2026-14855 RT Mega Menu <= 1.5.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via rtmega_update_menu_options AJAX Action

The RT Mega Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'cssleft' parameter in all versions up to, and including, 1.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access a...

CVE-2026-15650

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg WordPress plugin (versions ≤ 1.5.2) is vulnerable to an authenticated stored cross-site scripting (XSS) via the pointer_menu_item block attribute. The root cause is insufficient input sanitization and output escaping : the payload byp...

CVE-2026-15650 RT Mega Menu <= 1.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'pointer_menu_item' Block Attribute

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-82643

The RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pointermenuitem' Block Attribute in all versions up to, and including, 1.5.2 due to insufficient input sanitization and output escaping. This makes it possible for...

WBCE-CMS-Stored-XSS---Pages-Menu

WBCE CMS Stored XSS v1.6.1 Autor: Sergio Descripción: WBCE CMS 1.6.1 está afectado por una vulnerabilidad de Cross-Site Scripting almacenado XSS que permite a los atacantes ejecutar código arbitrario a través de un payload creado en el parámetro Intro Page del menú Pages. El payload se ejecutará ...

EUVD-2026-82616

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. Signed-in editors visiting a malicious page can be tricked into storing unescaped content that renders to all visitors,...

CVE-2026-93456

django-page-cms through 2.0.13 exempts five admin mutation views from CSRF protection in pages/admin/views.py, allowing attackers to forge requests that modify page content. A signed-in editor visiting a malicious page can be tricked into storing unescaped content that renders to all visitors, en...

CVE-2026-3516

CVE-2026-3516: Cross-Site Scripting XSS Almacenado Autenticado en el Plugin Contact List Aviso: Este repositorio se crea solo con fines educativos y divulgación ética. La vulnerabilidad ha sido reportada de forma responsable al proveedor y ha sido parcheada. No utilice esta información para...

EUVD-2026-82606

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...

EUVD-2026-82607

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-2585

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 / 12.0 / 12.1 < Security 2026 Update 3 Stored XSS (CVE-2026-69236)

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, 11.5, 12.0, or 12.1 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by a vulnerability: - A stored cross site scripting issue exists in Esri Portal for ArcGIS that may allow a remote,...

WP < 7.1.1 - Unauthenticated Stored XSS via Comments

Description WordPress does not properly sanitise and format comment content in some cases, which could allow unauthenticated visitors to perform Stored XSS attacks against anyone viewing the post once the comment is approved...

WP < 7.1.1 - Admin+ Stored XSS via Custom Header

Description WordPress does not sanitise and escape some custom header settings before outputting them back in an admin screen in some cases, which could allow users with a high role, such as site administrators on Multisite, to perform Stored XSS attacks against other users, such as super...

Esri Portal for ArcGIS 11.1 / 11.3 / 11.5 < Security 2026 Update 3 Multiple XSS

The version of Esri Portal for ArcGIS installed on the remote host is 11.1, 11.3, or 11.5 and is missing the Security 2026 Update 3 Patch. It is, therefore, affected by multiple vulnerabilities: - A reflected cross site scripting vulnerability exists in Esri Portal for ArcGIS which may allow a...

CVE-2026-2585 Brizy – Page Builder <= 2.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'rootAttributes' Parameter

The Brizy – Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘rootAttributes’ parameter in all versions up to, and including, 2.8.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-2585

The Brizy – Page Builder WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the rootAttributes parameter in versions up to and including 2.8.14 , caused by insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level or higher access c...

CVE-2026-93454 Aureus ERP through 1.6.0 Stored XSS via Payment Term Note

Aureus ERP through 1.6.0 stores the Payment Term note field unsanitized and renders it as raw HTML in the Accounting plugin. Authenticated users with payment-term create permission can submit arbitrary JavaScript to the payment-terms endpoint, which persists to the database and executes in browse...