CVE-2026-111601: Improper Neutralization of Input During Web Page Generation

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tokenid' parameter in all versions up to, and including, 1.12.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-111110: Improper Neutralization of Input During Web Page Generation

The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'mmdwqzpoxadd' parameter in all versions up to, and including, 2.8.61 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-67239

A flaw was found in rabbitmq-server. The stream-management interface fails to properly sanitize peer certificate fields, leading to a stored Cross-Site Scripting XSS vulnerability. A remote attacker with a valid Transport Layer Security TLS certificate containing a crafted Distinguished Name DN c...

CVE-2026-67237

A flaw was found in rabbitmq-server. When Open Authorization OAuth is enabled for the management interface, the application fails to properly sanitize authentication tokens before embedding them into the bootstrap script. A remote attacker could exploit this cross-site scripting XSS vulnerability...

CVE-2026-67421

A flaw was found in rabbitmq-server. When the Open Authorization OAuth management interface is enabled, error messages fail to properly sanitize queue names and render them as raw HTML. An authenticated attacker with queue configuration permissions can create a queue name containing malicious HTM...

WordPress User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin <= 5.2.8 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Kuba in WordPress Plugin User Registration versions = 5.2.8...

WordPress EU VAT Assistant for WooCommerce plugin <= 2.1.30.260413 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Afifudin Maarif in WordPress Plugin WooCommerce EU VAT Assistant versions = 2.1.30.260413...

WordPress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin <= 4.4.10 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by daroo in WordPress Plugin LearnPress versions = 4.4.10...

CVE-2026-111713

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

EUVD-2026-103005

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

CVE-2026-111713

The library tarteaucitron.js before version 1.37.0 is vulnerable to cross-site scripting (XSS) due to an attribute validation mismatch. The getElemAttr function resolves attributes prefixed with data-, whereas the https-only guard only validates unprefixed attributes. This discrepancy allows atta...

CVE-2026-111713 tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-' prefixed attributes while the https-only guard validates the unprefixed attribute. Attackers who can place markup, such as CMS authors, can add data-url with a javascript: URL beside ...

frappe-erpnext-2026-pocs

Frappe and ERPNext security research Proof-of-concept clients...

CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...

CVE-2026-44977

The countly-server product analytics solution is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 24.05.50 and 25.03.44 . The plugins/star-rating/api/api.js component allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled ac...

CVE-2026-44977 countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context

countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type...