CVE-2026-108487

The Hossni Mubarak Books Gallery (wp-books-gallery) WordPress plugin, versions up to and including 4.8.4 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject ...

WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Books Gallery versions = 4.8.4...

CVE-2026-105881

The ThemeGrill User Registration plugin (user-registration) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions from n/a through 5.2.8 . The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability allows an attacker to in...

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pr0f in WordPress Plugin User Registration versions = 5.2.8...

CVE-2026-109697

The SureCart WordPress plugin (versions n/a through 4.9.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored and subsequently executed in the con...

CVE-2026-96535

The YouMind portal is vulnerable to Cross-Site Scripting (XSS) within its avatar update endpoint . The flaw occurs because the application fails to sanitize or validate SVG content when a user sets a profile picture via an arbitrary URL. An attacker can upload an SVG file containing embedded Java...

CVE-2026-96535 Cross-Site Scripting in the YouMind web application

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin SureCart versions = 4.9.4...

CVE-2026-109691

The BdThemes Prime Slider – Addons For Elementor (bdthemes-prime-slider-lite ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) . This flaw stems from the improper neutralization of input during web page generation. The vulnerability affects versions from n/a through 4.7.1 ...

CVE-2026-108488

The PowerPack Addons for Elementor plugin by IdeaBox Creations (specifically the powerpack-lite-for-elementor component) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.1.0 . The root cause is the Improper Neutralization of Input During Web Pag...

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin PowerPack Addons for Elementor versions = 3.1.0...

WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.7.1...

CVE-2026-108490

The LeapWorx Premium Addons for Elementor WordPress plugin (versions n/a through 4.11.110 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts tha...

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Premium Addons for Elementor versions = 4.11.110...

CVE-2024-42009

CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...

CVE-2026-108495

The SureForms WordPress plugin (versions n/a through 2.12.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored on the server and subsequently exe...

WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin SureForms versions = 2.12.7...

CVE-2025-55580

CVE-2025-55580 - SolidInvoice Stored Cross-Site Scripting XSS in Clients Summary SolidInvoice is vulnerable to a Stored Cross-Site Scripting XSS issue in the Client Module. An authenticated attacker can inject arbitrary JavaScript into the application, which will then execute in users' browsers...

CVE-2018-7747

CVE-2018-7747 CalderaForms 1.5.9.1 XSS WordPress plugin - tutorial CalderaForm is a WordPress plugin that makes it easy to create forms via drag and drop. During a recent engagement I happened to test some portals, one of which hosted a contact form created with this plugin. The custom...

CVE-2026-67165

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...