CVE-2026-81791: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in EventON = 2.5.7 versions...

PT-2026-85086

Subscriber Cross Site Scripting XSS in Graphene = 2.9.4 versions...

PT-2026-85087

Subscriber Cross Site Scripting XSS in Product Variations Swatches for WooCommerce = 1.1.18 versions...

CVE-2026-81778: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Kalles Addons = 1.0.6 versions...

CVE-2026-78273: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Fluent Boards Pro = 2.0.11 versions...

CVE-2026-66601: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Media LIbrary Assistant = 3.39 versions...

CVE-2026-73359 WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.3.9 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent = 4.3.9 versions...

CVE-2026-73359

The WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin (versions ≤4.3.9) has a Subscriber-level stored XSS vulnerability; a low-privilege authenticated user can inject scripts that execute in other users' browsers, rated MEDIUM (CVSS 6.5). No patch version or exploitation evidence is provi...

CVE-2026-66460 WordPress AfterShip Tracking plugin <= 1.18.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in AfterShip Tracking = 1.18.1 versions...

PT-2026-71573

Subscriber Cross Site Scripting XSS in FluentCommunity = 2.7.5 versions...

CVE-2026-66456: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Profile Extra Fields by BestWebSoft = 1.3.4 versions...

CVE-2026-61959

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.24 versions...

CVE-2026-57328

Subscriber Cross Site Scripting XSS in Business Directory = 6.4.22 versions...

CVE-2026-56046 WordPress ListingPro theme <= 2.9.11 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in ListingPro = 2.9.11 versions...

CVE-2026-57313: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in SureCart = 4.2.2 versions...

CVE-2026-56005 WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...

CVE-2026-42688: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in Modula Image Gallery = 2.14.23 versions...

My Calendar < 3.4.24 - Authenticated Stored XSS

Description The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Subscriber to perform Cross-Site Scripting attacks depending on the permissions set by the admin PoC 1. Use any type of role as long as you permit it the action to Add Events. 2. Add...