CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

CVE-2026-107870

The Crocoblock JetEngine WordPress plugin is vulnerable to a DOM-Based Cross-Site Scripting (XSS) vulnerability in versions 3.8.16 and below . The flaw is caused by improper neutralization of input during web page generation. While the specific component or file is not specified, the vulnerabilit...

CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

EUVD-2026-101031

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107867

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

CVE-2026-107422

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0...

CVE-2026-105874

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

WordPress Forms plugin < 3.0.2 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente and Iñigo Sánchez Enciso in WordPress Plugin Forms versions 3.0.2...

WordPress WP Booking System plugin < 2.1.0.1 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Eric Buntain in WordPress Plugin WP Booking System versions 2.1.0.1...

CVE-2026-107867 WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

CVE-2026-107867

The Crocoblock JetProductTables WordPress plugin (versions up to and including 1.2.4 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) flaw. The root cause is the improper neutralization of input during web page generation within the jet-product-tables component. This vulnerability allows...

EUVD-2026-101015

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

CVE-2026-107867 WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

CVE-2026-107422 WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0...

CVE-2026-105874 WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-107422

The WP w3all phpBB plugin (specifically the wp-w3all-phpbb-integration component) is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.0 . This issue stems from the improper neutralization of input during web page generation . An attacker could potentially execut...

CVE-2026-105874

The SureCart WordPress plugin (versions up to and including 4.9.3 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This flaw allows an attacker to execute malicious scripts in a user's browser. While th...