The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance WordPress plugin up to version 1.7 is vulnerable to stored cross-site scripting (XSS) via the comment field. This vulnerability arises from insufficient input sanitization and output escaping in the plugin's Remove mode, allowing unauthenticated attackers to inject malicious scripts that execute when users view the affected pages. Exploitation requires the malicious comment to be published either automatically for known commenters or through manual approval by a moderator.
CVE-2026-111037 is a reflected Cross-Site Scripting (XSS) vulnerability in the Tenders module of the Coupa Supplier Portal SaaS platform. It occurs because the list_item_function parameter is reflected in server responses without proper sanitization and is embedded in a JavaScript event handler context. An attacker with a low-privileged account can craft malicious URLs that execute arbitrary scripts in a victim's browser, potentially allowing unauthorized actions, information disclosure, or UI manipulation. The vulnerability has a medium severity score of 5.1 and was fixed on 2026-11-04.
The Slim Jetpack WordPress plugin up to version 2.7.0.1 is vulnerable to stored Cross-Site Scripting (XSS) via the 'g<PAGE_ID>-website' contact-field parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts that execute when users access affected pages. The plugin's nonce and authentication checks apply only to logged-in users, enabling unauthenticated visitors to store payloads through pages containing the [contact-form] shortcode.
The Simple CAPTCHA with Cloudflare Turnstile WordPress plugin versions up to 1.44.3 contain a stored cross-site scripting (XSS) vulnerability. This flaw arises from insufficient sanitization and escaping of the 'id' attribute in the [gravity-simple-turnstile] shortcode, allowing authenticated users with contributor-level access or higher to inject malicious scripts. These scripts execute whenever a user accesses the affected page.
CVE-2026-57666 is a reflected cross-site scripting (XSS) vulnerability in the WP Customer Area plugin by Aguila Technologies. It affects versions from initial release up to 8.4.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. A fix is available in version 8.4.2.
A stored cross-site scripting (XSS) vulnerability exists in the wpDiscuz plugin for WordPress, affecting versions prior to 7.6.74. This flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. The vulnerability has a high severity rating and is fixed in version 7.6.74.
CVE-2026-62007 is a reflected cross-site scripting (XSS) vulnerability in Unlimited Elements For Elementor (Free Widgets, Addons, Templates) affecting versions prior to 2.0.27. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1. A fix is available in version 2.0.27.
CVE-2026-54861 is a reflected cross-site scripting (XSS) vulnerability in the WP Customer Area plugin by Aguila Technologies. It affects versions from initial release up to 8.4.1. The vulnerability allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. A fix is available in version 8.4.2.
CVE-2026-57639 is a reflected cross-site scripting (XSS) vulnerability in the WP Booking System plugin by Roland Murg. It affects versions from initial releases up to 2.1.0.6. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute malicious scripts in the context of the affected site. The issue is fixed in version 2.1.0.7.
CVE-2026-119477 is a stored cross-site scripting (XSS) vulnerability in WP Photo Album Plus, a WordPress plugin by Jacob N. Breetvelt. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts. This affects versions from the initial release up to 9.3.05.003. A fix is available in version 9.3.06.001.
CVE-2026-54851 is a reflected cross-site scripting (XSS) vulnerability in the Contact Form by WPForms plugin by Awesomemotive. It affects versions from initial releases up to 2.0.3. The vulnerability allows improper neutralization of input during web page generation, potentially enabling an attacker to execute arbitrary scripts in the context of the victim's browser. A fix is available in version 2.0.3.1.
The Text Typing WordPress plugin versions before 2.2.2 contain a vulnerability where a block attribute is not properly sanitized and escaped before storage and output. This flaw allows users with Contributor role or higher to inject stored cross-site scripting (XSS) payloads that execute in the browsers of visitors to affected pages.
The All-in-One Video Gallery WordPress plugin versions prior to 5.0.0 contain a vulnerability where certain shortcode attributes are not properly validated or escaped before being output on pages or posts. This flaw allows users with contributor-level permissions or higher to execute stored cross-site scripting (XSS) attacks.