CVE-2026-97328 is a Cross-Site Scripting (XSS) vulnerability in the WebP Express WordPress plugin versions before 0.25.16. The flaw occurs because the plugin does not properly escape values emitted into HTML element attributes by its bundled parser when a non-default image delivery mode is enabled. This allows unauthenticated users to inject malicious scripts that execute in the browsers of users viewing affected pages, including administrators.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Link Library WordPress plugin before version 7.9.6. This flaw allows users with Contributor role or higher to inject malicious scripts via a link field that is not properly sanitized or escaped. The vulnerability affects the link preview feature, which is generated without authentication and without verifying if the link is published, potentially exposing any visitor who views the preview to the malicious payload.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Photo Engine (Media Organizer & Lightroom) WordPress plugin versions before 6.5.8. The plugin fails to properly sanitize and escape collection and gallery names before storing and displaying them in the administrative dashboard. This allows authenticated users with author role or higher to inject malicious scripts that execute in the context of the admin dashboard.
A Cross-Site Scripting (XSS) vulnerability exists in the PixelYourSite WordPress plugin versions before 11.4.3 and PixelYourSite Pro versions before 12.6.8. The flaw arises because the plugins do not sanitize and escape a cookie value before outputting it on the page. On sites using full-page caching, this allows unauthenticated attackers to inject malicious scripts into the cached page, which are then served to other visitors.
WordPress Core versions up to and including 7.0.2 are vulnerable to a stored cross-site scripting (XSS) flaw via the Quick Edit feature. This vulnerability arises from insufficient escaping of user display names, allowing authenticated users with Contributor-level access or higher to inject malicious scripts. These scripts execute when higher privileged users access certain administrative pages. The issue specifically affects sites with a large number of users.
CVE-2026-114718 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail affecting versions before 1.6.20 and 1.7.5. The flaw occurs in the password plugin where error messages from a password driver are displayed without proper HTML escaping. This allows a backend capable of influencing the error text, such as the DirectAdmin API, to inject malicious scripts into the Roundcube interface. The issue was fixed by escaping the driver message before display in versions 1.6.20 and 1.7.5.
CVE-2026-84911 is a stored cross-site scripting (XSS) vulnerability in the Drupal AI (Artificial Intelligence) product. It affects versions from 0.0.0 up to but not including 1.3.13, and from 1.4.0 up to but not including 1.4.8. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker with high privileges and user interaction to inject malicious scripts. The issue has been fixed in versions 1.3.13 and 1.4.8.
CVE-2026-84915 is a stored cross-site scripting (XSS) vulnerability in the Drupal Component blocks module. It affects versions from 0.0.0 up to but not including 1.2.7. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in version 1.2.7.
CVE-2026-84924 is a reflected Cross-site Scripting (XSS) vulnerability in the Drupal Email Verification / SMS Verification / OTP Verification module. It affects versions from 0.0.0 up to but not including 2.4.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This flaw has a medium severity rating with a CVSS score of 5.4. A fix is available in version 2.4.0.
CVE-2026-84919 is a stored cross-site scripting (XSS) vulnerability in the Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery. It affects versions from 0.0.0 up to but not including 5.0.9. The vulnerability involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in version 5.0.9. The CVSS v3.1 base score is 4.6, indicating a medium severity level.
CVE-2026-87939 is a stored cross-site scripting (XSS) vulnerability in the Drupal Feed Block module. It affects Feed Block versions from 0.0.0 up to but not including 2.0.2, and from 3.0.0 up to but not including 3.0.2. The vulnerability arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The issue has been fixed in versions 2.0.2 and 3.0.2.
CVE-2026-87942 is a stored cross-site scripting (XSS) vulnerability in the Drupal SafeDelete module. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects SafeDelete versions from 0.0.0 up to but not including 1.0.88. A fix is available in version 1.0.88. The CVSS score is 4.6, indicating a medium severity level.
CVE-2026-87948 is a Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has been fixed in version 3.2.0. The CVSS score is 3.5, indicating a low severity impact with limited confidentiality and integrity impact and no availability impact.
CVE-2026-87949 is a Cross-Site Scripting (XSS) vulnerability in the Drupal SAML SSO - Service Provider module. It affects versions from 0.0.0 up to but not including 3.2.0. The vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The issue has a low CVSS score of 3.3 and was fixed in version 3.2.0.
CVE-2026-96360 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability arises from improper neutralization of input during web page generation. The issue has a low CVSS score of 3.5 and is fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96361 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It involves improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The issue has been fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96358 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module caused by improper neutralization of input during web page generation. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability allows an attacker with low privileges to execute scripts in the context of the user's browser. The issue has been fixed in versions 6.2.12 and 6.3.1.
CVE-2026-96359 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It arises from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts. The vulnerability affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. Fixed versions are 6.2.12 and 6.3.1. The CVSS score is 4.6 (medium severity).
CVE-2026-96362 is a Cross-Site Scripting (XSS) vulnerability in the Drupal Webform module. It affects Webform versions from 0.0.0 up to but not including 6.2.12, and from 6.3.0 up to but not including 6.3.1. The vulnerability involves improper neutralization of input during web page generation, which could allow an attacker to inject malicious scripts. The issue has been fixed in versions 6.2.12 and 6.3.1.