CVE-2026-107870

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-110627

ClipBucket versions v5 through 5.5.3-#206 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the admin_area/index.php component. The root cause is the improper neutralization of input in the val parameter when mode=add_todo is used. An attacker can leverage this to inje...

EUVD-2026-101255

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-110627 ClipBucket v5 through 5.5.3-#206 Reflected XSS via add_todo val Parameter

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/index.php that allows attackers to inject HTML via the val parameter in mode=addtodo. Attackers can lure a logged-in administrator into submitting a cross-site POST form without CSRF protection,...

CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

CVE-2026-110625

Versions v5 through 5.5.3-#206 of ClipBucket are vulnerable to a reflected cross-site scripting (XSS) vulnerability. The flaw exists in the admin_area/flagged_item.php file due to the lack of encoding on the type GET parameter. An attacker can distribute crafted links to logged-in administrators ...

EUVD-2026-101254

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

EUVD-2026-101253

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

CVE-2026-110625 ClipBucket v5 through 5.5.3-#206 Reflected XSS via type Parameter in flagged_item.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/flaggeditem.php via the unencoded type GET parameter. Attackers can send crafted flaggeditem.php?type= links to logged-in administrators or moderators to execute injected script in the admin panel...

CVE-2026-110626 ClipBucket v5 through 5.5.3-#206 Reflected XSS via edit_language in language_settings.php

ClipBucket v5 through 5.5.3-206 contains a reflected cross-site scripting vulnerability in adminarea/languagesettings.php via the unencoded editlanguage GET parameter. Attackers can send administrators with basicsettings permission a crafted link whose payload is echoed into a hidden input,...

CVE-2026-110626

ClipBucket versions v5 through 5.5.3-#206 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the admin_area/language_settings.php file. The root cause is the failure to encode the edit_language GET parameter. An attacker can trick an administrator with basic_settings permis...

CVE-2026-107870

The Crocoblock JetEngine WordPress plugin is vulnerable to a DOM-Based Cross-Site Scripting (XSS) vulnerability in versions 3.8.16 and below . The flaw is caused by improper neutralization of input during web page generation. While the specific component or file is not specified, the vulnerabilit...

CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

EUVD-2026-101031

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107870 WordPress JetEngine plugin <= 3.8.16 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetEngine jet-engine allows DOM-Based XSS.This issue affects JetEngine: from n/a through 3.8.16...

CVE-2026-107867

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4...

CVE-2026-107422

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0...