CWE-79: Cross-site Scripting vulnerabilities

CVE-2026-118438 is a cross-site scripting (XSS) vulnerability in the Firelight Lightbox WordPress plugin versions before 2.3.24. It occurs because the plugin does not properly escape image attribute values before rendering them in the browser. This flaw allows users with contributor-level access or higher to inject arbitrary scripts that execute when other users view or preview the affected content.

The PPWP – Password Protect Pages WordPress plugin up to version 1.9.26 is vulnerable to a stored Cross-Site Scripting (XSS) flaw via the 'desc_below_form' shortcode attribute and comment parameters. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The issue arises from insufficient input sanitization and output escaping, combined with WordPress's comment_content filter behavior and auto-approval of comments from previously approved users.

Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder plugin for WordPress versions up to 3.15.5 is vulnerable to stored Cross-Site Scripting (XSS) via the 'formData.extra' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The nonce check intended to prevent such attacks is bypassed due to the nf_ajax_submit endpoint issuing a valid nonce on failure, making exploitation straightforward.

The Meow Lightbox WordPress plugin up to version 5.6.4 contains a stored cross-site scripting (XSS) vulnerability via the 'post_content' parameter used in bbPress replies. This vulnerability allows unauthenticated attackers to inject malicious JavaScript that executes in the context of any user viewing the affected page, given specific preconditions involving output buffering, HtmlDomParser engine, and aggressive resolve settings. The flaw is due to insufficient input sanitization and output escaping.

The NextGEN Gallery WordPress plugin (Photo Gallery, Sliders, Proofing and Themes) versions up to 4.5.4 contain a stored DOM-based cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view affected pages, but exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress moderation.

The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape several customer-supplied order fields — including the billing and shipping address values and the customer order note — before they are output in generated invoice and packing-slip documents, allowing unauthenticated users placing guest orders to store a malicious script that executes when a shop administrator views the document, leading to Stored Cross-Site Scripting.

CVE-2026-62990 is a high-severity cross-site scripting (XSS) vulnerability in shopperlabs shopper, a headless e-commerce admin panel. Versions 2.0.0 up to but not including 2.10.1, and prerelease versions 3.0.0-beta.1 and beta.2, allow authenticated back-office staff with content-upload permissions to upload executable media such as SVG or HTML files. These files are served inline without proper content security headers, enabling script execution in the administrator's session. Exploitation can lead to creation of attacker-controlled administrator accounts and unauthorized access to sensitive data. The issue is fixed in versions 2.10.1 and 3.0.0-beta.3.

CVE-2026-117645 is a Cross-site Scripting (XSS) vulnerability in the phoenix_html library of the phoenixframework. It arises from improper neutralization of attribute names during HTML generation, allowing attackers controlling attribute names to inject malicious attributes and scripts. The flaw affects phoenix_html versions from 1.0.0 up to but not including 3.3.5, and from 4.0.0 up to but not including 4.4.0. The vulnerability is fixed in versions 3.3.5 and 4.4.0.

Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.

Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.

Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.

Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.

Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.

Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.

CVE-2026-28160 is a stored cross-site scripting (XSS) vulnerability in VikRentCar versions prior to 1.4.11. It arises from improper neutralization of input during web page generation, allowing malicious scripts to be stored and executed in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1. A fix is available in version 1.4.11.

Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.