CWE-79: Cross-site Scripting vulnerabilities

CVE-2026-57742 is a high-severity reflected cross-site scripting (XSS) vulnerability in ThemeREX Group's Kids Planet product. It allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability affects versions up to and including 2.2.14.2. No patch or remediation information is currently provided.

CVE-2026-78534 is a high-severity cross-site scripting (XSS) vulnerability affecting Keen IT Solutions Educavo versions up to and including 3.4.2. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No specific patch or remediation information is provided in the available data.

CVE-2026-78532 is a high-severity unauthenticated Cross-Site Scripting (XSS) vulnerability affecting designthemes LMS versions up to and including 8.3. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability can be exploited without authentication and impacts confidentiality, integrity, and availability. No specific patch or remediation details are provided in the available data.

CVE-2026-62116 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in Dmitry V.'s Barcode Scanner with Inventory & Order Manager software versions up to 1.13.1. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication, potentially impacting confidentiality, integrity, and availability.

CVE-2026-62100 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in KuteShop versions up to and including 4.2.9. This vulnerability allows an attacker to inject malicious scripts during web page generation without requiring authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No patch or remediation information is currently provided by the vendor.

CVE-2026-62095 is a high-severity vulnerability in kutethemes Biolife versions up to and including 3.2.3. It is an unauthenticated cross-site scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62093 is a high-severity vulnerability in kutethemes TechOne versions up to and including 3.0.3. It is an unauthenticated cross-site scripting (XSS) flaw caused by improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that can lead to partial confidentiality, integrity, and availability impacts.

CVE-2026-62091 is a high severity unauthenticated cross-site scripting (XSS) vulnerability affecting kutethemes Armania versions up to and including 1.4.8. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is currently provided.

CVE-2026-62082 is a high severity unauthenticated Cross-Site Scripting (XSS) vulnerability in An-Themes Pin WP affecting versions up to 7.0. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. The vulnerability impacts confidentiality, integrity, and availability as indicated by the CVSS vector.

CVE-2026-62064 is a high-severity Cross-Site Scripting (XSS) vulnerability affecting Bracketweb Ambed versions up to and including 1.0.0. This vulnerability allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

CVE-2026-62037 is a high severity unauthenticated Cross-Site Scripting (XSS) vulnerability in bPlugins Document Embedder versions up to 2.4.0. This vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. The vulnerability is identified as CWE-79 and has a CVSS v3.1 score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided by the vendor. Users should monitor vendor advisories for updates and apply fixes once available.

CVE-2026-62034 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the Before After Image Comparison – Image comparison for WP plugin for WordPress. It affects versions up to and including 1.1.21. The vulnerability allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability.

CVE-2026-62027 is a high-severity vulnerability in the bPlugins Team Section Block plugin, versions up to and including 2.0.4. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability.

CVE-2026-42715 is a high-severity cross-site scripting (XSS) vulnerability affecting Photo Gallery by 10Web versions 1.8.47 and earlier. It allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability requires user interaction to exploit and has a low attack complexity. No specific patch or remediation details are provided in the available data.

CVE-2026-42711 is a high-severity cross-site scripting (XSS) vulnerability in Slider by 10Web versions up to and including 1.2.63. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability.

CVE-2026-42709 is a high-severity unauthenticated cross-site scripting (XSS) vulnerability in the RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin, affecting versions up to 6.0.5. This vulnerability allows attackers to inject malicious scripts during web page generation without authentication. The flaw is categorized under CWE-79, indicating improper neutralization of input. No specific affected versions or patch information is provided in the available data.

CVE-2026-42702 is a high-severity reflected Cross-site Scripting (XSS) vulnerability in Themeum Tutor LMS affecting versions from initial release up to 4.1.0. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of the victim's browser. This vulnerability can lead to partial confidentiality, integrity, and availability impacts. No official patch or vendor advisory is provided in the data, so patch status is not confirmed.

CVE-2026-42699 is a high-severity vulnerability in FolioVision FV Player 8 versions up to 8.1.8. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can be triggered without authentication and affects confidentiality, integrity, and availability to a limited extent.

CVE-2026-42697 is a reflected cross-site scripting (XSS) vulnerability in the Inisev Social Share Icons & Social Share Buttons plugin (ultimate-social-media-plus). This vulnerability affects versions from initial releases up to 3.7.5. It allows an attacker to inject malicious scripts during web page generation, potentially impacting confidentiality, integrity, and availability. The vulnerability has a high severity score of 7.1 according to CVSS 3.1.

CVE-2026-42693 is a reflected cross-site scripting (XSS) vulnerability in TieLabs Jannah versions prior to 7.6.8. It results from improper neutralization of input during web page generation, allowing attackers to execute arbitrary scripts within the context of the affected application. The issue is resolved in version 7.6.8.