EUVD-2026-102873

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-18516

The Audit Logs component of Crafty Controller is vulnerable to an output escaping flaw (CWE-116 ). A remote, unauthenticated attacker can perform stored cross-site scripting (XSS) by leveraging HTTP header injection . No specific remediation or exploit details are provided in the documents.

CVE-2026-18516

An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated attacker to perform stored cross-site scripting via HTTP header injection...

CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2026-90821

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

EUVD-2026-102872

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2026-90821 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafty Controller

An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote, authenticated attacker to perform stored XSS via malicious form input...

CVE-2026-90821

The Crafty Controller application contains an input neutralization vulnerability (CWE-79) within its Webhook URL form field component. A remote, authenticated attacker can exploit this flaw to perform stored XSS by providing malicious input through the form. No specific patch versions, workaround...

CVE-2026-97470 Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escapin...

CVE-2026-97470 Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escapin...

EUVD-2026-102871

The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via unfilteredhtml Grant to Customer Role in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escapin...

CVE-2026-111405

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows Stored XSS.This issue affects MapSVG: from n/a through 8.16.1...

CVE-2026-111400

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

CVE-2026-110903

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Stored XSS.This issue affects The Events Calendar: from n/a through 6.18.1...

CVE-2026-111400

The PowerPack Addons for Elementor plugin (specifically powerpack-lite-for-elementor ) by IdeaBox Creations is vulnerable to Stored Cross-Site Scripting (XSS) . This issue arises from the Improper Neutralization of Input During Web Page Generation and affects versions from n/a through 3.1.0 . An ...

CVE-2026-111400 WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

EUVD-2026-102867

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

CVE-2026-111400 WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor allows Stored XSS.This issue affects PowerPack Addons for Elementor: from n/a through 3.1.0...

WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin PowerPack Addons for Elementor versions = 3.1.0...