CVE-2026-42632 is a high-severity cross-site scripting (XSS) vulnerability affecting Qode Real Estate versions up to and including 1.1.7.3. The flaw allows unauthenticated attackers to inject malicious scripts during web page generation due to improper input neutralization. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability of the affected application.
CVE-2026-42631 is a high-severity vulnerability in Qode Music versions up to and including 2.1.8.2. It is an unauthenticated Cross-Site Scripting (XSS) flaw that arises from improper neutralization of input during web page generation. This vulnerability allows an attacker to inject malicious scripts that may lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is currently provided.
CVE-2026-40803 is a high-severity vulnerability in Jotform – AI Chatbot versions up to 3.8.2. It is an unauthenticated Cross-Site Scripting (XSS) flaw that allows improper neutralization of input during web page generation. This vulnerability can lead to partial compromise of confidentiality, integrity, and availability. No specific affected versions or patch information is provided.
CVE-2026-39800 is a high severity vulnerability involving unauthenticated Cross-Site Scripting (XSS) in the Additional Order Filters for WooCommerce plugin by Anton Bond. It affects versions up to and including 1.24. The vulnerability allows an attacker to inject malicious scripts during web page generation without authentication. This can lead to partial compromise of confidentiality, integrity, and availability. No official patch or remediation details are provided in the available data.
CVE-2026-39799 is a high-severity vulnerability in the WP File Download plugin by Joomunited. It allows unauthenticated attackers to perform cross-site scripting (XSS) attacks due to improper neutralization of input during web page generation. This affects versions up to and including 6.3.6. The vulnerability can lead to partial confidentiality, integrity, and availability impacts. No patch or remediation information is provided in the available data.
A reflected Cross-site Scripting (XSS) vulnerability exists in themeStek Extras for LabtechCO Theme through version 8.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in a user's browser. The issue affects versions up to and including 8.4. The vulnerability has a high severity rating with a CVSS score of 7.1.
A reflected cross-site scripting (XSS) vulnerability exists in Greg Winiarski WPAdverts plugin versions up to and including 2.3.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in a victim's browser. The vulnerability has a high severity rating with a CVSS score of 7.1.
A stored cross-site scripting (XSS) vulnerability exists in the WPAdverts plugin by Greg Winiarski, affecting versions up to 2.3.4. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.
A stored cross-site scripting (XSS) vulnerability exists in WPMU DEV Forminator plugin versions up to 1.57.3. This vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1.
The HivePress – Business Directory, Listings & Classified Ads Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.7.31. This vulnerability arises from insufficient input sanitization and output escaping of a custom user attribute field, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires specific plugin configuration involving text-type custom user attributes displayed inside HTML attribute contexts and enabled front-end user profiles.
PeproDev Ultimate Profile Solutions WordPress plugin versions up to and including 8.2.36 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from improper sanitization and escaping of user input in the 'button' attribute of the 'logout-url' shortcode. Authenticated users with contributor-level or higher privileges can inject malicious scripts that execute when other users view the affected pages.
CVE-2026-93951 is a reflected cross-site scripting (XSS) vulnerability in Bracketweb Zeinet up to version 1.0.0. It arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts that execute in the context of a victim's browser. The vulnerability has a high severity rating with a CVSS score of 7.1. No patch or remediation information is currently provided.
The Premium Packages – Sell Digital Products Securely WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the 'checkout[billing][phone]' parameter and related fields. This vulnerability exists in all versions up to and including 7.2.6 and allows authenticated users with subscriber-level access or higher to inject malicious scripts that execute when other users view the affected pages.
The Avada Website Builder theme for WordPress and WooCommerce is vulnerable to a stored cross-site scripting (XSS) flaw in user profile social link fields. Authenticated users with Subscriber-level access or higher can inject malicious scripts into author pages via social contact-method fields. Exploitation requires a user to click the malicious social icon link, and the site setting 'Open Social Icons in a New Window' must be disabled. This vulnerability affects versions up to and including 7.16.1.
SureDash – Community, Courses & Member Dashboard plugin for WordPress versions up to 1.12.1 is vulnerable to a stored DOM-based Cross-Site Scripting (XSS) flaw via the image 'alt' attribute in community post content. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The vulnerability arises because entity-encoded payloads bypass server-side filtering and are decoded client-side by GLightbox, leading to script execution.
WPAdverts – Classifieds Plugin for WordPress versions up to and including 2.3.4 is vulnerable to stored cross-site scripting (XSS) via the 'adverts_location' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. The issue arises from insufficient input sanitization and output escaping.
The WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 44.1. This vulnerability arises from insufficient input sanitization and output escaping of the 'id_token' parameter, allowing unauthenticated attackers to inject malicious scripts. The malicious payload is stored in the wpo365_errors transient for up to three days and executes when an administrator visits the WPO365 wizard page. No prior authentication or user interaction is required for the initial injection.
The Email Marketing for WordPress and WooCommerce – Retainful plugin versions up to 1.0.10 are vulnerable to a stored Cross-Site Scripting (XSS) flaw. This vulnerability arises from improper sanitization and escaping of the 'data' parameter, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user accesses the affected pages, potentially leading to information disclosure or session hijacking.
A reflected cross-site scripting (XSS) vulnerability exists in the WPForms – AI Form Builder for WordPress plugin in all versions up to and including 2.0.2.1. The flaw arises from insufficient input sanitization and output escaping of a user-controllable parameter referenced by a smart tag in form descriptions. Exploitation requires a site administrator to have saved a form embedding the vulnerable smart tag inside an iframe srcdoc attribute and enabled the form description on a public page. An unauthenticated attacker can inject arbitrary scripts that execute when a user interacts with a crafted link.
Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress plugin versions up to and including 5.2.12 are vulnerable to a stored DOM-based cross-site scripting (XSS) flaw. The vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter within the href attribute of comment content. This allows unauthenticated attackers to inject arbitrary scripts that execute when users visit affected pages. The issue affects the free version of the plugin due to the author-filter rewriter not appending a specific marker, making all href attributes attacker-controllable.