Threat database

CVE-2026-110384 is a reflected cross-site scripting (XSS) vulnerability in the Fancy Comments WordPress plugin by Heateor Support. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to execute malicious scripts in users' browsers. This affects Fancy Comments WordPress versions from 0 up to and including 1.2.21. The vulnerability has a high severity with a CVSS score of 7.1.

CVE-2026-94170 is a reflected cross-site scripting (XSS) vulnerability in Heateor Support's Sassy Social Share plugin affecting versions up to and including 3.3.79. This vulnerability arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1, indicating potential impacts on confidentiality, integrity, and availability. No patch or official remediation details are provided in the available data.

Unauthenticated Cross Site Request Forgery (CSRF) in Heateor Social Login <= 1.1.39 versions.

Cross-Site Request Forgery (CSRF) vulnerability in Heateor Support Heateor Social Login heateor-social-login allows Cross Site Request Forgery.This issue affects Heateor Social Login: from n/a through <= 1.1.39.