CVE-2026-107178 is a cross-site scripting (XSS) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin versions before 3.6.16. It allows users with contributor-level access or higher to inject JavaScript into the gallery lightbox configuration, which executes in the browsers of anyone viewing the gallery, including administrators.
A stored Cross-Site Scripting (XSS) vulnerability exists in the WP Booking System WordPress plugin before version 2.1.0.1. The plugin fails to properly sanitize and escape user-controllable input before storing and displaying it in an administration screen. This allows unauthenticated attackers to inject malicious scripts that execute in the context of an administrator's session when viewing the stored data.
CVE-2026-106469 is a cross-site scripting (XSS) vulnerability in the Gutenverse Form WordPress plugin before version 3.0.11. It arises because the plugin does not sanitize SVG icon markup stored in its form blocks before decoding and inserting it into the page. Authenticated users with Contributor-level access or higher can exploit this to store malicious SVG that executes JavaScript in the browser session of any user who views or previews the affected form, including administrators reviewing pending posts.
CVE-2026-105261 is a cross-site scripting (XSS) vulnerability in the WordPress plugin Schedule Post Changes With PublishPress Future (versions >=4.10.1 and <4.10.6). It allows users with Contributor role or higher to inject JavaScript via a shortcode attribute that is not properly sanitized. This malicious script executes in the session of any higher-privileged user who views the affected content, potentially compromising confidentiality, integrity, and availability.
CVE-2026-104644 is a cross-site scripting (XSS) vulnerability in the Image Photo Gallery Final Tiles Grid WordPress plugin before version 3.6.15. It allows users with contributor-level access or higher to inject JavaScript code via unsanitized gallery configuration values. This malicious script executes in the browsers of anyone viewing the gallery, including administrators.
The Social Share Buttons & Analytics Plugin – GetSocial.io for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.5. Authenticated users with subscriber-level access or higher can inject malicious scripts via the 'response' parameter. These scripts are stored in WordPress options and execute in an administrator's browser when visiting the GetSocial settings page.
The NewStatPress WordPress plugin versions up to and including 1.4.5 contain a stored cross-site scripting (XSS) vulnerability in the 'Last referrers' meta box on the Overview admin page. This vulnerability arises from insufficient output escaping of user-supplied query strings recorded in the plugin's statistics table. An unauthenticated attacker can inject malicious scripts that execute when a high-privileged user views the Overview page and interacts with the injected link.
The NewStatPress WordPress plugin is affected by a stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 1.4.5. This vulnerability arises from improper sanitization of the QUERY_STRING / REQUEST_URI parameter, allowing unauthenticated attackers to inject malicious scripts. Exploitation depends on an administrator placing the vulnerable shortcode on a public page and the attacker's crafted URL gaining enough hits to appear in the top pages list.
The FV Flowplayer Video Player WordPress plugin is vulnerable to stored Cross-Site Scripting (XSS) via the 'synopsis' shortcode attribute in all versions up to and including 7.5.54.7212. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the 'Parse Vimeo and YouTube links' option to be enabled and the 'liststyle' attribute set to "season". The vulnerability has a high severity with a CVSS score of 7.2.
The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'phone' listing field. This vulnerability exists in all versions up to and including 8.10.2.1. Authenticated users with subscriber-level access or higher can inject malicious scripts due to insufficient input sanitization and output escaping. The plugin grants subscriber roles permissions to edit and publish listings without moderation, enabling exploitation. The vulnerability has a CVSS 3.1 score of 6.4, indicating medium severity.
The Contact Form DB for Enfold WordPress plugin versions up to and including 2.0.2 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper input sanitization and output escaping of contact form field values, allowing unauthenticated attackers to inject malicious scripts. These scripts execute when a user views the injected page, affecting the admin interface where the payload is reflected unescaped in HTML attributes and table cells.
The Smart Forms plugin for WordPress, up to and including version 2.6.104, is vulnerable to stored Cross-Site Scripting (XSS) via the 'formString' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The AJAX handler that saves form values lacks nonce verification unless a specific option is enabled, meaning default installations permit unauthenticated submission and storage of malicious payloads.
The Verified Reviews (Avis Vérifiés) WordPress plugin versions up to and including 2.4.6 contain a stored cross-site scripting (XSS) vulnerability via the 'moderation' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. Additionally, an authentication bypass exists due to improper signature verification using loose comparisons, enabling attackers to bypass checks with crafted JSON payloads.
The PO/MO Editor plugin for WordPress up to version 1.4.2 contains a stored cross-site scripting (XSS) vulnerability via the 'podata' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users load the affected pages. The vulnerability arises from insufficient input sanitization and output escaping, allowing attacker-controlled translation files to replace legitimate ones.
The Cryptocurrency Donation Box – Bitcoin & Crypto Donations WordPress plugin is vulnerable to stored cross-site scripting (XSS) via the data_object parameter in all versions up to and including 2.2.13. This vulnerability allows unauthenticated attackers to inject arbitrary scripts that execute when users access the affected pages. The vulnerability arises because the AJAX action cdbbc_payment_verify is accessible without authentication and the nonce check can be bypassed due to the nonce being publicly exposed in JavaScript.
The Document Gallery plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in versions up to and including 5.1.1. This vulnerability arises from insufficient input sanitization and output escaping in the 'dg_thumber_webhook' action request body. Exploitation requires that logging be enabled in the plugin's Advanced settings, which is only enabled by default when WP_DEBUG is true; otherwise, an administrator must enable it manually. An unauthenticated attacker can inject arbitrary scripts that execute when a user accesses the affected page.
The Countdown Timer – Widget Countdown WordPress plugin versions 3.0.0 through 3.0.1 are vulnerable to stored Cross-Site Scripting (XSS) via the 'redirect_url' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises from insufficient input sanitization and output escaping.
Tutor LMS – eLearning and online course solution plugin for WordPress versions up to and including 4.1.0 is vulnerable to reflected Cross-Site Scripting (XSS) via the 'tab' parameter. The vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts. Exploitation requires a specific condition where a lesson page has an empty nav-items array, which can occur naturally under certain content and comment settings. This vulnerability has a medium severity rating with a CVSS score of 4.7.
FV Player 8 WordPress plugin versions up to and including 8.1.7 are vulnerable to stored cross-site scripting (XSS) via the 'synopsis' shortcode attribute. Authenticated users with contributor-level access or higher can inject malicious scripts that execute when other users view the affected pages. Additionally, unauthenticated visitors can exploit this vulnerability if the 'Parse Vimeo and YouTube links' setting is enabled, as it processes shortcodes in comment text.
The AnyComment WordPress plugin versions up to and including 0.3.6 contain a stored cross-site scripting (XSS) vulnerability via the 'email' parameter in the /wp-json/anycomment/v1/subscribe REST endpoint. This vulnerability arises from insufficient input sanitization and missing output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when an administrator views the Subscriptions admin page.