CVE-2026-111021 is a reflected Cross-Site Scripting (XSS) vulnerability in the Persian WooCommerce SMS WordPress plugin versions 7.2.0 up to but not including 7.3.2. The flaw arises because the plugin fails to properly sanitize and escape a parameter before reflecting it into an HTML attribute. This allows an attacker to execute malicious scripts in the browser session of a logged-in privileged user who is tricked into submitting a crafted request. The vulnerability has a high severity score of 7.1 and was fixed in version 7.3.2.
A stored cross-site scripting (XSS) vulnerability exists in the Copy Anything to Clipboard for WordPress plugin before version 5.5.5. The flaw arises because the plugin does not properly sanitize and escape a shortcode attribute before storing it and rendering it back into the page via client-side script. This allows users with contributor role or higher to inject malicious scripts that execute when higher-privileged users view the affected content.
CVE-2026-110506 is a stored cross-site scripting (XSS) vulnerability in the Page Builder by SiteOrigin WordPress plugin versions before 2.38.0. The flaw arises because the plugin does not properly sanitize or escape a widget property before storing and displaying it in the page builder interface. This allows users with contributor roles or higher to inject malicious scripts that execute when higher-privileged users open the affected post in the editor.
CVE-2026-107098 is a cross-site scripting (XSS) vulnerability in the Royal Addons for Elementor WordPress plugin versions from 1.7.1037 up to but not including 1.7.1070. The flaw arises because the plugin does not properly sanitize and escape a map widget's size setting before inserting it into an HTML attribute. This allows users with Contributor role or higher to inject JavaScript that executes in the browsers of users viewing the affected page, including administrators reviewing submissions. The vulnerability is fixed in version 1.7.1070.
CVE-2026-105972 is a Cross-Site Scripting (XSS) vulnerability in the Menu Cart for WooCommerce WordPress plugin versions before 3.2.1. The flaw arises because the plugin does not properly sanitize and escape cart item variation data before displaying it in the cart slide-out. This allows unauthenticated attackers to inject malicious scripts that execute in the context of other users' sessions, including administrators. The vulnerability has a high severity with a CVSS score of 7.5 and was fixed in version 3.2.1.
The Appointment Booking Calendar WordPress plugin up to version 1.4.05 contains a stored cross-site scripting (XSS) vulnerability via the 'vs_text_submitbtn' parameter. Authenticated users with subscriber-level access or higher can exploit this if assigned as a calendar owner by an administrator. This allows injection of arbitrary scripts that execute when users view the affected pages. By default, exploitation requires editor-level access or higher if no calendar ownership is assigned to lower roles.
The All-in-One Video Gallery plugin for WordPress versions up to 4.9.7 contains a stored cross-site scripting (XSS) vulnerability via the 'custom_fields[embedcode]' parameter. This flaw allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, combined with a logic flaw in the save_meta_data() handler that bypasses sanitization during XML-RPC requests. The plugin also grants subscribers the capability to publish videos, enabling exploitation through a single XML-RPC call.
The affiliate-toolkit – Multi-Network Affiliate & Amazon Product Display WordPress plugin up to version 3.9.2 is vulnerable to stored Cross-Site Scripting (XSS) via the 'atkp_product_producturl' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. Exploitation requires the plugin's AJAX loading or AJAX handler option to be enabled, or contributor-level access if these options are not configured.
The AMP for WP – Accelerated Mobile Pages WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 1.1.17. This vulnerability arises from insufficient input sanitization and output escaping of the 'headline-*' shortcode attribute. An unauthenticated attacker can inject malicious scripts that execute when users access the affected pages. The issue is exacerbated by WordPress core's wp_filter_kses() function, which does not remove shortcode syntax, and the AMP content sanitizers running before shortcode processing, leaving the injected markup unsanitized.
The AI Marketing Expert WordPress plugin (versions up to and including 1.2.8) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'name' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute in the context of administrators accessing the injected pages. Exploitation requires the chatbot module to be active with at least one configured bot. The attacker can store the payload through unauthenticated REST calls, which the JavaScript widget then delivers to administrators automatically.
The All-in-One Video Gallery plugin for WordPress is vulnerable to stored cross-site scripting (XSS) via the 'more_link' parameter in versions up to and including 4.9.7. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. This vulnerability arises from insufficient input sanitization and output escaping.
A stored cross-site scripting (XSS) vulnerability exists in the Ultimate Member WordPress plugin versions up to and including 2.14.0. The flaw arises from insufficient sanitization and escaping of the 'user_url' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when other users view the affected profile pages, triggered by clicking the attacker's Website URL link on public profiles. The vulnerability has a medium severity rating with a CVSS score of 6.4.
CVE-2026-50571 is a cross-site scripting (XSS) vulnerability in the W3C WebSub recommendation related to the intent-verification protocol. The vulnerability arises because the protocol requires subscribers to echo back a challenge value without enforcing safe response media types or disabling MIME sniffing. This can allow an attacker to craft a verification request that executes malicious HTML or JavaScript in the subscriber's origin, potentially exposing private data and browser permissions. The advisory notes that safe media typing and the use of the X-Content-Type-Options: nosniff header are necessary to mitigate these issues. No practical impact has been established on demonstration sites, and no known exploits are reported in the wild.
JeromeDevome GRR versions prior to 4.5.0 contain a reflected cross-site scripting (XSS) vulnerability in the maj.php script related to improper escaping of the forcemaj parameter when installation files remain accessible. This vulnerability allows attackers to execute arbitrary JavaScript in the context of a victim's browser, potentially enabling phishing, redirection to malicious sites, cookie theft, and session hijacking due to the authentication cookie not being HttpOnly. The issue is resolved in version 4.5.0.
CVE-2026-97045 is a medium severity cross-site scripting (XSS) vulnerability in the golang.org/x/net/html package. It arises from improper handling of namespace transitions in the HTML parser, where the ancestor chain was not fully walked, potentially allowing literal text emission in unexpected foreign namespaces. This flaw was fixed in version 0.62.0 of the package.
CKEditor 5 versions from 45.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability due to prototype pollution in a vulnerable es-toolkit version used by the editor's engine. This flaw allows crafted editor content with malicious style attribute values to execute unauthorized JavaScript in the browser. The issue is resolved in versions 47.7.4 and 48.5.1.
CKEditor 5 versions from 29.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability when General HTML Support is enabled and configured to allow object content. This vulnerability allows specially crafted markup to execute attacker-controlled JavaScript in a browser context isolated from the embedding application's origin. The issue is fixed in versions 47.7.4 and 48.5.1.
NextChat version 2.16.1 has a client-side cross-site scripting (XSS) vulnerability in its Plugin Editor. This flaw arises from unsafe rendering of externally supplied OpenAPI plugin schema content using React's dangerouslySetInnerHTML without proper sanitization. An attacker can host a malicious schema and trick users into loading it, leading to arbitrary JavaScript execution within the NextChat application context. Exploitation can expose JavaScript-accessible cookies and other client-side data.
Adobe Campaign Classic contains a reflected Cross-Site Scripting (XSS) vulnerability (CVE-2026-104350). This flaw allows attackers to inject malicious scripts via crafted URLs or compromised web pages, potentially enabling them to hijack user sessions or escalate privileges. Exploitation requires user interaction. The vulnerability has a critical severity rating with a CVSS score of 9.3.
TinyMCE versions from 7.9.3 up to but not including 7.9.4 and from 8.5.1 up to but not including 8.9.3 contain a stored cross-site scripting (XSS) vulnerability in the media plugin. The vulnerability arises because elements created through data-mce-object are inserted into the active document before proper sanitization, allowing malicious scripts to execute. This issue has been fixed in versions 7.9.4 and 8.9.3.