CVE-2026-63351

Affected devices fail to properly validate and sanitize visual properties of calculated signals within imported CSV trace files before rendering them on the Trace page. This vulnerability allows an attacker to use social engineering to trick an authorized user with "Read diagnostics" rights into ...

CVE-2026-96535

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

CVE-2026-108487

The Hossni Mubarak Books Gallery (wp-books-gallery) WordPress plugin, versions up to and including 4.8.4 , is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject ...

WordPress Books Gallery plugin <= 4.8.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Books Gallery versions = 4.8.4...

CVE-2026-105881

The ThemeGrill User Registration plugin (user-registration) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions from n/a through 5.2.8 . The root cause is the Improper Neutralization of Input During Web Page Generation (CWE-79). This vulnerability allows an attacker to in...

WordPress User Registration plugin <= 5.2.8 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Pr0f in WordPress Plugin User Registration versions = 5.2.8...

CVE-2026-109697

The SureCart WordPress plugin (versions n/a through 4.9.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored and subsequently executed in the con...

CVE-2026-96535 Cross-Site Scripting in the YouMind web application

Cross-Site Scripting on the YouMind portal, specifically in the avatar update endpoint, when setting a profile picture via an arbitrary URL. This occurs due to a lack of sanitisation and validation of SVG content when setting an SVG image containing embedded JavaScript code as the avatar. The fil...

CVE-2026-96535

The YouMind portal is vulnerable to Cross-Site Scripting (XSS) within its avatar update endpoint . The flaw occurs because the application fails to sanitize or validate SVG content when a user sets a profile picture via an arbitrary URL. An attacker can upload an SVG file containing embedded Java...

WordPress SureCart plugin <= 4.9.4 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin SureCart versions = 4.9.4...

CVE-2026-109691

The BdThemes Prime Slider – Addons For Elementor (bdthemes-prime-slider-lite ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) . This flaw stems from the improper neutralization of input during web page generation. The vulnerability affects versions from n/a through 4.7.1 ...

CVE-2026-108488

The PowerPack Addons for Elementor plugin by IdeaBox Creations (specifically the powerpack-lite-for-elementor component) is vulnerable to a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 3.1.0 . The root cause is the Improper Neutralization of Input During Web Pag...

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin PowerPack Addons for Elementor versions = 3.1.0...

WordPress Prime Slider – Addons For Elementor plugin <= 4.7.1 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Prime Slider – Addons For Elementor versions = 4.7.1...

CVE-2026-108490

The LeapWorx Premium Addons for Elementor WordPress plugin (versions n/a through 4.11.110 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts tha...

WordPress Premium Addons for Elementor plugin <= 4.11.110 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin Premium Addons for Elementor versions = 4.11.110...

CVE-2026-108495

The SureForms WordPress plugin (versions n/a through 2.12.7 ) is vulnerable to Stored Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that are stored on the server and subsequently exe...

WordPress SureForms plugin <= 2.12.7 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dzaku in WordPress Plugin SureForms versions = 2.12.7...

CVE-2026-67165

HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user which leads to executing malicious script code. This may allow the attacker steal cookie-based authentication credential...

CVE-2026-102562

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acymcleanVar sanitizer,...