Top technology
Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
Linux 13140
Google 12525
Microsoft 12378
Apple 6692
Oracle 6673
Adobe 6383
Ibm 6286
Cisco 5751
Debian 3919
Mozilla 2886
Apache 2864
Redhat 2586
MEDIUM 6.1
CVE-2026-18344
The Wp Responsive Thumbnail Slider plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in versions up to, and…
No fix yet
MEDIUM 6.4
CVE-2026-18435
The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'toggleIcon' Blo…
No fix yet
MEDIUM 6.4
CVE-2026-16684
The Easy Property Listings plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'facebook' User Contact Method in all versions up to…
No fix yet
MEDIUM 6.4
CVE-2026-16685
The Download Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon' Shortcode Attribute in all versions up to, and incl…
No fix yet
MEDIUM 6.1
CVE-2026-17571
The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Reflected Cross-Site…
No fix yet
MEDIUM 6.4
CVE-2026-16090
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si…
No fix yet
MEDIUM 6.4
CVE-2026-16091
The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si…
No fix yet
MEDIUM 6.4
CVE-2026-15644
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in a…
No fix yet
MEDIUM 6.4
CVE-2026-15645
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'nav' Shortcode Attribute in all…
No fix yet
MEDIUM 6.4
CVE-2026-15649
The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all vers…
No fix yet
MEDIUM 6.4
CVE-2026-15662
The Advanced Woo Labels – Product Labels & Badges for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bg_color…
No fix yet
MEDIUM 6.4
CVE-2026-15950
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cros…
No fix yet
MEDIUM 6.4
CVE-2026-13458
The GenerateBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Dynamic Tag Injection in HTML Attributes in all versions up …
No fix yet
HIGH 7.2
CVE-2026-15052
The MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Form F…
No fix yet
MEDIUM 5.4
CVE-2026-15234
The Codeless Page Builder WordPress plugin through 1.1.4 does not sanitize or validate a shortcode attribute before using it as an HTML tag name when…
No fix yet
MEDIUM 5.4
CVE-2026-15262
The Admin Columns for ACF Fields WordPress plugin through 0.3.2 does not escape Advanced Custom Fields values before outputting them in the WordPress…
No fix yet
MEDIUM 5.4
CVE-2026-14292
The Download Manager WordPress plugin before 3.3.66 does not properly escape a package's title before outputting it in the front-end package template…
No fix yet
HIGH 7.1
CVE-2026-13725
The Dynamic Pricing With Discount Rules for WooCommerce WordPress plugin before 5.0.0 does not validate a nonce or user capabilities on one of its AJ…
No fix yet
MEDIUM 5.4
CVE-2026-12696
The wpForo Forum WordPress plugin before 3.1.2 does not sanitize and escape a user profile field before outputting it inside an HTML attribute on the…
No fix yet
MEDIUM 6.4
CVE-2026-7623
The SureForms – Contact Form, Payment Form & Other Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'hea…
No fix yet
MEDIUM 6.4
CVE-2026-13362
The SendPulse Email Marketing Newsletter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via _sp_form_code Post Meta in all version…
No fix yet
MEDIUM 6.1
CVE-2026-52232
A reflected cross-site scripting (XSS) vulnerability in the /logo.asp component of FS Inc S3150-8T2F Switch 2.2.0D Build 118101 allows attackers to e…
No fix yet
MEDIUM 5.4
CVE-2026-62324
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.12.31, Jodit's sanitizeHTMLElement method fails to use isDan…
Patch available
HIGH 7.3
CVE-2026-18481
Stored cross-site scripting in the participant URL handling in AWS Ops
Wheel before PR #168 might allow an authenticated remote user to steal
sessi…
Patch available
MEDIUM 5.4
CVE-2026-34495
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Johnson Controls FM Systems Employee allows Sto…
Fms Employee
after 2025.3.1
MEDIUM 5.3
CVE-2026-59232
Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead per…
Patch available
MEDIUM 5.1
CVE-2026-46594
A reflected cross-site scripting (XSS) vulnerability has been identified in the PHP Jabbers - PHP Poll Script. A malicious attacker can craft a speci…
No fix yet
MEDIUM 6.1
CVE-2026-14921
The Ultimate Addons for WPBakery Page Builder WordPress plugin before 3.21.5's shared link-rendering function, Ultimate_VC_Addons::uavc_link_init(),
No fix yet
MEDIUM 6.1
CVE-2026-14922
WP Photo Album Plus is vulnerable to stored Cross-Site Scripting in all versions up to, and including, 9.2.03.001 through a decode-after-sanitize (do…
No fix yet
MEDIUM 6.8
CVE-2026-14833
The Lightbox with PhotoSwipe WordPress plugin before 5.9.0 does not sanitise or escape a link data attribute before rendering it into the image light…
No fix yet