CVE-2026-75933

Jet Admin is vulnerable to a stored cross-site scripting (XSS) flaw in the sign-in page's scripts and styles option. An authenticated attacker can inject arbitrary JavaScript that executes in the context of any visiting user's domain, enabling session hijacking, data exfiltration, or further comp...

CVE-2026-75933 Jet Admin Stored XSS

Jet Admin allows an authenticated attacker to inject JavaScript via the sign-in page's scripts and styles option. Injected script is executed in the context of any visiting user's domain...

CVE-2026-76612

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

CVE-2026-76612

Zoo is a Joomla extension by yootheme.com . Versions prior to 4.1.66 are vulnerable to an unauthenticated stored XSS caused by user-supplied input in comments and user-supplied field elements not being properly escaped. An attacker can inject malicious scripts that execute in the context of other...

CVE-2026-76612 Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo < 4.1.66

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

EUVD-2026-63940

Joomla Extension - yootheme.com - Unauthenticated stored XSS via user-controlled fields in Zoo 4.1.66 - User supplied input in comments and user supplied field elements weren't escaped, leading to a stored XSS vector...

EUVD-2026-63913

The ProfilePress WordPress plugin before 4.17.1 does not strip shortcodes from two of its profile fields before rendering them on public pages, allowing unauthenticated attackers to store shortcodes that are then executed when the page is viewed, disclosing a chosen user's email address, login an...

WordPress WPForms Pro plugin <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability

Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values vulnerability discovered by daroo in WordPress Plugin WPForms Pro versions = 2.0.0.2...

WordPress Simple File List plugin <= 6.3.11 - Unauthenticated Stored XSS via File Description vulnerability

Unauthenticated Stored XSS via File Description vulnerability discovered by Ruwantha Harshamal in WordPress Plugin Simple File List versions = 6.3.11...

WordPress Easy Media Replace plugin <= 0.2.0 - Author+ Stored XSS via Attachment Title vulnerability

Author+ Stored XSS via Attachment Title vulnerability discovered by testoun in WordPress Plugin Easy Media Replace versions = 0.2.0...

WordPress Booking calendar, Appointment Booking System plugin <= 3.2.36 - Unauthenticated Stored XSS via SVG File Upload vulnerability

Unauthenticated Stored XSS via SVG File Upload vulnerability discovered by Samdup Choephel in WordPress Plugin Booking calendar, Appointment Booking System versions = 3.2.36...

CVE-2026-14325

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

CVE-2026-14325

CVE-2026-14325 is a stored XSS vulnerability in the Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin, affecting versions prior to 1.3.9.9 . The root cause is a failure to escape the drag_n_drop_heading_tag setting before using it as an HTML tag name in front-end output. An a...

CVE-2026-14325 Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.9.9 - Admin+ Stored XSS via drag_n_drop_heading_tag Setting

The Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin before 1.3.9.9 does not escape one of its settings before using it as an HTML tag name in front-end output, allowing users with administrator access to inject arbitrary web scripts that execute on any front-end page...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-18409 WPForms Pro <= 2.0.0.2 - Unauthenticated Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-63812

The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Single Line Text and Paragraph Text Field Values in all versions up to, and including, 2.0.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-65644

CVE-2026-65644 is a stored XSS in Rocket.Chat's Omnichannel livechat visitor name field, rendered via dangerouslySetInnerHTML in InquireSidePanelItem.tsx, allowing unauthenticated attackers to inject clickable links into agent views. Patch PR #41595 fixes it in versions 7.10.15 and 8.1.8+. Exploi...

PT-2026-79291

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...