Meta Box – A Framework for Dynamic Websites WordPress plugin versions up to 5.15.2 is vulnerable to stored cross-site scripting (XSS) via the 'profile_background' parameter. Authenticated users with subscriber-level privileges or higher can inject malicious scripts that execute when other users view affected pages. Exploitation depends on how consuming plugins or themes expose and render this field, with the minimum effective privilege being that allowed by the consumer, demonstrated at subscriber level.
The NEX-Forms – Ultimate Forms Plugin for WordPress is affected by a stored Cross-Site Scripting (XSS) vulnerability in the 'type' parameter. This vulnerability exists in all versions up to and including 9.3.2. It allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages.
CVE-2026-5700 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It affects the 'observaciones' parameter in the /mis-gastos endpoint, allowing an attacker to inject JavaScript code that executes in the browser of users viewing the affected page. The vulnerability has a medium severity rating with a CVSS score of 4.8.
CVE-2026-5699 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It allows an attacker to inject JavaScript code via the 'companyName' parameter in the /empresa endpoint, which executes in the browser of users viewing the affected page. The vulnerability has a medium severity with a CVSS 4.8 score. No affected versions or patches are explicitly stated in the available data.
CVE-2026-5698 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It allows attackers to inject JavaScript code via the 'titulo_es' and 'add_etiquetas[]' parameters on the '/categorías' endpoint. When a user views the affected page, the malicious script executes in their browser. The vulnerability has a medium severity score of 4.8 and requires low privileges with user interaction to exploit.
CVE-2026-5697 is a stored Cross-Site Scripting (XSS) vulnerability in the SABBATIC application. It allows an attacker to inject and store malicious JavaScript code via the 'nombre' parameter in the '/usuario' endpoint. When a user views the affected page, the stored script executes in their browser. The vulnerability has a medium severity rating with a CVSS score of 4.8.
The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'href attribute of <a> inside .htmega-tab-nav' parameter in all versions up to, and including, 3.2.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires a co-installed plugin such as wpDiscuz with its rich editor enabled whose markup allowlist permits span[class] and a[href] storage, an HT Mega Tabs widget present on the same page as the comment section, and a victim user click on the injected anchor link.
The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission_callback that unconditionally returns true (no capability check, no nonce), together with the mapster_write_config_to_acf() helper only sanitizing string config values with sanitize_text_field() — which strips HTML tags but leaves quote characters intact — and the mapster_wp_map shortcode renderer in mapster_wordpress_maps_shortcode_display() concatenating the stored loading_background_color value into a single-quoted inline style attribute without esc_attr(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the HTML Minify option (O_OPTM_HTML_MIN) is enabled and a companion plugin renders stored comment content into a raw-text context such as a JSON-LD script block on the same page.
The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'condition' Post Meta Array Keys in all versions up to, and including, 3.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content' parameter in all versions up to, and including, 7.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has enabled Viewport Images (VPI) and configured a VPI filename that matches an image the attacker can embed in user-generated content — such as a bbPress topic where Subscriber-level Participants are permitted to post replies containing raw img tags.
The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'evf_toast_type' parameter in all versions up to, and including, 3.6.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the sibling evf_toast parameter to decode successfully via atob(), but this is a trivially attacker-controlled prerequisite.
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have published a page containing a Text Animated block with Content set to Blocks, a Latest Comments block with excerpts enabled nested inside it, and at least one Animated Texts value configured — conditions that cause the gs-textanimate script to be enqueued and process the comment excerpts.
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 13.2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the affected post page to include an Advanced HTML Element block with Split Text animation enabled wrapping a Latest Comments block that displays comment excerpts, as this configuration causes splittext.js to be enqueued and to process the comment content container.
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'media:group/media:description (XML element in the imported feed)' parameter in all versions up to, and including, 5.2.12 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to configure a Feed-to-Post import pointing at an attacker-controlled feed URL and trigger the import via the Run Now action or setup wizard, which is the plugin's standard configuration flow.
The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires the targeted site to have a publicly accessible page containing an [mla_gallery] shortcode configured with a pagination output mode and an mla_link_href template that reflects a {+request:...+} token, along with enough attachments to trigger pagination.
The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'feature.properties[<template-token>]' parameter in all versions up to, and including, 5.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that a site administrator has previously configured a public map using the [leaflet-map]+[leaflet-geojson]+[choropleth] shortcode combination whose GeoJSON src URL is one the attacker controls — for example, through compromise of an external data host, a subdomain takeover, or a site intentionally pointing at an attacker-hosted feed.
CVE-2026-7190 is a cross-site scripting (XSS) vulnerability in the ICTBroadcast software by ICT Innovations, specifically affecting the demo environment. The flaw exists in the 'login.php' endpoint where the 'editForm[extension_username]' parameter is reflected in the HTTP response without proper input filtering. This allows an attacker to execute arbitrary JavaScript code in the browser of any user who accesses a crafted malicious URL. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.1. A fix was released in March 2026.
CVE-2026-86794 is a high-severity cross-site scripting (XSS) vulnerability in the Community Events WordPress plugin versions 1.4.9 up to but not including 1.6.0. The plugin lacks authorization and nonce checks when processing public event submissions and fails to properly escape several submitted values. This allows unauthenticated users to inject arbitrary scripts that execute in the browsers of administrators reviewing submissions. The issue is fixed in version 1.6.0.
A stored cross-site scripting (XSS) vulnerability exists in the Enable SVG, WebP, and ICO Upload WordPress plugin versions before 1.1.6. The flaw allows users with author role or higher to upload SVG files containing animation elements that can change a link's target to a javascript: URI, bypassing the plugin's SVG sanitization. This vulnerability affects WebKit-based browsers such as Safari.