Site Reviews < 7.2.5 - Unauthenticated Stored XSS

Site Reviews WordPress plugin before 7.2.5 contains a stored cross-site scripting caused by improper sanitization and escaping of review fields, letting unauthenticated users execute malicious scripts, exploit requires no authentication. id: CVE-2025-1232 info: name: Site Reviews 7.2.5 -...

CVE-2026-56011-Lab

CVE-2026-56011 - MapPress Maps for WordPress Unauthenticated XSS in iframe map rendering Executive Summary This repository contains a local Docker lab for reproducing and validating CVE-2026-56011, an unauthenticated Cross-Site Scripting vulnerability affecting MapPress Maps for WordPress. MapPre...

CVE-2026-87917 MC4WP: Mailchimp for WordPress <= 4.14.0 - Reflected Cross-Site Scripting via 'data' Dynamic Content Tag

The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'data' Dynamic Content Tag in all versions up to, and including, 4.14.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-90887 WordPress WP Inventory Manager plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Inventory Manager = 2.5.4 versions...

EUVD-2026-77084

The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values before printing them, allowing unauthenticated users to overwrite its configuration and inject arbitrary web scripts that execute on every...

EUVD-2026-75535

Unauthenticated Cross Site Scripting XSS in WPAdverts = 2.3.3 versions...

EUVD-2026-75534

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

PT-2026-89440

Unauthenticated Cross Site Scripting XSS in Page Visits Counter Lite = 1.2.3 versions...

CVE-2026-84816: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WPCS = 1.3.2 versions...

CVE-2026-79638

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Alternate XSS Syntax vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to script...

CVE-2026-84817 WordPress JetFormBuilder plugin <= 3.6.5.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in JetFormBuilder = 3.6.5.1 versions...

PT-2026-86993

Unauthenticated Cross Site Scripting XSS in Open User Map = 1.4.50 versions...

CVE-2026-84848

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84765

Unauthenticated Cross Site Scripting XSS in Breadcrumb NavXT = 7.5.1 versions...

CVE-2026-84848 WordPress Quick Event Manager plugin <= 9.17 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Quick Event Manager = 9.17 versions...

CVE-2026-84763 WordPress RTMKit plugin <= 2.1.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in RTMKit = 2.1.5 versions...

EUVD-2026-70564

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...

CVE-2026-81776 WordPress WP QuickLaTeX plugin <= 3.8.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP QuickLaTeX = 3.8.8 versions...

CVE-2026-81773

CVE-2026-81773 affects the WordPress Ninja Forms File Uploads Extension plugin in versions 3.3.26 and below . The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw, meaning no prior authentication is required to exploit it. The CVSS 3.1 base score is 7.1 (HIGH) with a vector of ...

CVE-2026-81773 WordPress Ninja Forms File Uploads Extension plugin <= 3.3.26 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Ninja Forms File Uploads Extension = 3.3.26 versions...