The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'poplink' parameter affecting all versions up to and including 1.4.9. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires a WordPress nonce token (vikwp_nonce), which the plugin exposes to unauthenticated visitors on the public booking-confirmation page, enabling attackers to obtain a valid token without authentication.
The Welcart e-Commerce plugin for WordPress versions up to and including 2.12.5 is vulnerable to stored cross-site scripting (XSS) via the 'gid' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The attack involves forging a ROBOT PAYMENT browser-return request to store a malicious 'gid' value in order metadata, which executes when an administrator views the order in the WordPress admin panel.
The WP Job Portal WordPress plugin up to version 2.7.0 is vulnerable to stored cross-site scripting (XSS) via the 'degreetitle' parameter. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users view the affected pages. The plugin allows self-registration, enabling any visitor to create an account capable of exploiting this vulnerability.
The VikRentCar Car Rental Management System plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'optionals' parameter. This vulnerability affects all versions up to and including 1.4.10. It allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages.
The Shipping Zones by Drawing for WooCommerce plugin for WordPress versions up to and including 3.3.0 is vulnerable to stored cross-site scripting (XSS) via the 'szbd-picked' checkout parameter. An unauthenticated attacker can submit a crafted JSON payload during guest checkout that injects malicious attributes into a Google Maps link in the WooCommerce admin order view. This malicious code executes when an administrator views the injected order, potentially compromising the admin interface.
The Discussion Board WordPress Forum Plugin is vulnerable to stored cross-site scripting (XSS) in versions up to and including 2.6.0. The vulnerability arises from insufficient output escaping of the user profile Website (user_url) field, allowing authenticated users with subscriber-level access or higher to inject malicious scripts. These scripts execute when any user views a Discussion Board topic containing the attacker's reply.
The W3 Total Cache plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'comment' parameter affecting all versions up to and including 2.10.7. This vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires that a Pro license was previously active with REST caching enabled but is now inactive while Disk Enhanced page caching remains configured, and that the attacker has a previously approved commenter identity.
The Webmention plugin for WordPress versions up to and including 5.10.1 contains a stored cross-site scripting (XSS) vulnerability via the Open Graph og:title meta tag. This vulnerability arises from insufficient input sanitization, allowing unauthenticated attackers to inject arbitrary scripts. However, exploitation requires an administrator to approve the injected webmention comment, as the payload is stored in comment content without proper filtering.
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress versions up to and including 5.16.4 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient input sanitization and output escaping of certain parameters such as billing_address.first_name, last_name, company, and customer_note. An incomplete fix introduced in version 5.16.2 attempted to block raw-tag payloads but was bypassed by entity-encoded payloads, allowing script injection that executes when a user accesses the affected page.
The SureCart WordPress plugin up to version 4.9.4 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. The injected scripts execute when users visit pages that load SureCart's web-component bundle, such as those containing a SureCart Buy Button block. For exploitation, the injected comment must be auto-approved or approved by a moderator.
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post_images' parameter in all versions up to, and including, 2.8.197 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload does not fire for the attacker directly; it executes in the browser of any Administrator or Editor who opens the pending listing's edit screen, making this a privilege-escalation-capable stored XSS chain triggered through normal editorial workflow.
The NextGEN Gallery WordPress plugin (versions up to and including 4.5.4) contains a stored DOM-based cross-site scripting (XSS) vulnerability via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Exploitation requires the site to use the Shutter or Shutter Reloaded lightbox and for the injected comment to be approved through WordPress's moderation system before the payload executes for other users.
The PPWP – Password Protect Pages plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 1.9.26. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment / shortcode attribute desc_below_form' parameter. Unauthenticated attackers can inject arbitrary scripts that execute when users access the affected pages. The vulnerability is exacerbated by WordPress's comment_content filter and comment_whitelist setting, allowing auto-approval of subsequent comments from previously approved users without administrator intervention.
The Ninja Forms plugin for WordPress up to version 3.15.5 is vulnerable to stored cross-site scripting (XSS) via the 'formData.extra' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The nonce check intended to prevent unauthorized requests is effectively bypassed due to the nf_ajax_submit endpoint issuing a valid nonce on failure, making exploitation straightforward.
The Meow Lightbox WordPress plugin up to version 5.6.4 is vulnerable to stored cross-site scripting (XSS) via the 'post_content' parameter used in bbPress reply bodies. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary JavaScript. Exploitation requires specific plugin settings enabled by the administrator, including Output Buffering, the HtmlDomParser engine, Aggressive Resolve, and a stored-HTML submission surface with a permissive kses allow-list. When these conditions are met, the injected script executes in the context of any user viewing the affected page.
A cross-site scripting (XSS) vulnerability identified as CVE-2026-114538 affects Microsoft product version 3.0. The vulnerability is categorized as moderately critical and relates to the Bootstrap component. No CVSS score or detailed technical impact information is provided.
A stored cross-site scripting (XSS) vulnerability exists in the PDF Invoices & Packing Slips for WooCommerce WordPress plugin versions from 5.16.2 up to but not including 5.16.5. The plugin does not properly escape certain customer-supplied order fields, such as billing and shipping addresses and customer order notes, in generated invoice and packing-slip documents. This allows unauthenticated users placing guest orders to inject malicious scripts that execute when a shop administrator views these documents.
AdminNeo versions prior to 5.5.1 are vulnerable to a cross-site scripting (XSS) attack due to unsanitized insertion of the MySQL server version string into a script tag with a valid Content Security Policy (CSP) nonce. An attacker controlling a reachable MySQL server can craft a malicious version string that breaks out of the JavaScript context and executes arbitrary code in the victim's browser. This vulnerability requires no authentication when combined with login CSRF. A fix is available in version 5.5.1.
A Cross-site Scripting (XSS) vulnerability exists in phoenix_html, a component of the Phoenix Framework, due to improper neutralization of input during web page generation. The vulnerability arises because attribute names are not properly escaped, allowing an attacker controlling attribute names to inject malicious attributes and scripts into rendered HTML. This affects phoenix_html versions from 1.0.0 before 3.3.5 and from 4.0.0 before 4.4.0. The issue occurs when untrusted input is used to build attribute keys rendered through HEEx <tag {@attrs}>, content_tag/3, or direct calls. The vulnerability has a medium severity with a CVSS score of 5.3. No known exploits in the wild or patch information is provided.
WIT SynApps Runtime versions through 1.4.11 have a pre-authentication reflected cross-site scripting (XSS) vulnerability. This flaw allows unauthenticated attackers to inject and execute arbitrary JavaScript by submitting a crafted LINK query parameter to the /System/Session-1 endpoint. Exploitation can lead to credential harvesting, manipulation of the login process, access to browser-visible data, and same-origin requests to internal controller endpoints, including origin-switching in Cloud RIA scenarios.