CVE-2026-107422

The WP w3all phpBB plugin (specifically the wp-w3all-phpbb-integration component) is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.1.0 . This issue stems from the improper neutralization of input during web page generation . An attacker could potentially execut...

CVE-2026-105874

The SureCart WordPress plugin (versions up to and including 4.9.3 ) is vulnerable to a Reflected Cross-Site Scripting (XSS) vulnerability due to the improper neutralization of input during web page generation. This flaw allows an attacker to execute malicious scripts in a user's browser. While th...

EUVD-2026-101012

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0...

EUVD-2026-101011

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-105874 WordPress SureCart plugin <= 4.9.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Brainstorm Force SureCart surecart allows Reflected XSS.This issue affects SureCart: from n/a through 4.9.3...

CVE-2026-107422 WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0...

CVE-2026-107422 WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0...

CVE-2026-103904

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...

WordPress Meow Lightbox plugin <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by crow in WordPress Plugin Meow Lightbox versions = 5.6.2...

CVE-2026-103904 Stored XSS Vulnerability in JTL-Shop

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...

EUVD-2026-100973

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...

CVE-2026-103904 Stored XSS Vulnerability in JTL-Shop

The public consent endpoint of JTL-Shop accepts arbitrary consent names from unauthenticated visitors without validating them against the configured consent items. These names are stored in the consent statistics and rendered without output encoding in the administration backend. An unauthenticat...

CVE-2026-103904

JTL-Shop is vulnerable to a Stored XSS vulnerability because its public consent endpoint accepts arbitrary consent names from unauthenticated visitors without proper validation. These names are stored in consent statistics and rendered in the administration backend without output encoding. An una...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Sawyer in WordPress Plugin GeoDirectory versions = 2.8.190...

Security Bulletin: Multiple Vulnerabilities in IBM Library Support for Struts

Summary Multiple vulnerabilities were addressed in IBM Library Support for Struts 1.0 Vulnerability Details CVEID:CVE-2005-3745 DESCRIPTION: Cross-site scripting XSS vulnerability in Apache Struts 1.2.7, and possibly other versions allows remote attackers to inject arbitrary web script or HTML vi...

CVE-2026-107428

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Reflected XSS.This issue affects Paid Videochat Turnkey Site: from n/a through 7.5.12...

BIT-JUPYTERLAB-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

BIT-GITEA-2026-96594 Gitea repository media API stored XSS

The Gitea API endpoint GET /api/v1/repos/owner/repo/media/filepath wrote files of up to 1 KiB that are stored directly in Git, not in LFS, to the response without the content type and disposition headers Gitea uses for user content. An HTML file committed to a repository was therefore rendered by...

WordPress Record of Consent Extension for Complianz plugin <= 2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by OKISO in WordPress Plugin Record of Consent Extension for Complianz versions = 2.5...

WordPress GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin GeoDirectory versions = 2.8.190...