Browse CVEs

MEDIUM 6.4 CVE-2026-12938 The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the [newsletters_post] shortcode… No fix yet Fix from $1,6002026-07-29 MEDIUM 6.1 CVE-2026-14515 IBM WebSphere Application Server 8.5, and 9.0 traditional could allow a remote attacker to conduct a cross-site scripting attack. Websphere Application Server 8.5.5.31 / 9.0.5.29+ Fix from $1,6002026-07-28 HIGH 8.1 CVE-2026-48060 Litestar is an Asynchronous Server Gateway Interface (ASGI) framework. Prior to version 2.20.0, Litestar instances which use a template engine in con… Mitigation only Fix from $1,9502026-07-28 MEDIUM 6.1 CVE-2026-18084 Improper Neutralization of Input During Web Page Generation vulnerability in BlackBerry UEM Management Console of BlackBerry UEM allows Cross-Site Sc… Unified Endpoint Manager No fix yet Fix from $1,6002026-07-28 MEDIUM 5.5 CVE-2026-7775 IBM Sterling B2B Integrator 6.2.0.0 through 6.2.0.6, 6.2.1.0 through 6.2.1.1_2, and 6.2.2.0 through 6.2.2.0_1 and IBM Sterling File Gateway 6.2.0.0 t… No fix yet Fix from $1,6002026-07-28 CRITICAL 9.2 CVE-2026-67174 Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The tryResolveHT… Patch available Fix from $2,3002026-07-28 MEDIUM 6.3 CVE-2026-66921 Pivotick’s Markdown node-reference renderer failed to HTML-escape the attacker-controlled nodeName value before interpolating it into both the data-n… Patch available Fix from $1,6002026-07-28 MEDIUM 6.1 CVE-2026-65882 Joomla Extension - joomdle.com - Reflected XSS vulnerability in Joomdle < 3.1.1 - The goto url parameter of the moodle wrapper endpoint allowed a ref… No fix yet Fix from $1,6002026-07-28 HIGH 8.2 CVE-2026-66918 Pivotick fails to sanitize attacker-controlled SVG markup supplied through the per-node style.svgIcon property before inserting it into the document.… Patch available Fix from $1,9502026-07-28 MEDIUM 6.9 CVE-2026-66919 Pivotick contains a cross-site scripting vulnerability in the inspect and edit node modals. Node labels and descriptions originating from graph data … Patch available Fix from $1,6002026-07-28 MEDIUM 6.4 CVE-2026-15016 The Paid Memberships Pro – Content Restriction, User Registration, & Paid Subscriptions plugin for WordPress is vulnerable to Stored Cross-Site Scrip… No fix yet Fix from $1,6002026-07-28 MEDIUM 6.4 CVE-2026-15393 The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cros… No fix yet Fix from $1,6002026-07-28 HIGH 7.2 CVE-2026-13440 The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to St… No fix yet Fix from $1,9502026-07-28 MEDIUM 5.0 CVE-2026-11598 The Shortcodify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'name' Shortcode Attribute in all versions up to, and including… No fix yet Fix from $1,6002026-07-28 MEDIUM 5.2 CVE-2026-44387 ELECOM wireless LAN routers and access points devices contain a reflected cross-site scripting vulnerability in WebUI. If this vulnerability is explo… No fix yet Fix from $1,6002026-07-28 MEDIUM 6.1 CVE-2026-8167 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in THEWP Digital Solutions News Theme V8 allows Re… No fix yet Fix from $1,6002026-07-28 MEDIUM 6.4 CVE-2026-15730 The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Si… No fix yet Fix from $1,6002026-07-28 HIGH 7.1 CVE-2026-14870 The Database for Contact Form 7, WPforms, Elementor forms WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before refl… No fix yet Fix from $1,9502026-07-28 MEDIUM 6.1 CVE-2026-17528 Versions of the package nice-select2 before 2.4.1 are vulnerable to Cross-site Scripting (XSS) via the <select> element. An attacker can supply a mal… Patch available Fix from $1,6002026-07-28 HIGH 7.1 CVE-2026-65441 Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.16.3 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65443 Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65446 Unauthenticated Cross Site Scripting (XSS) in Kali Forms <= 2.4.18 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65447 Unauthenticated Cross Site Scripting (XSS) in Contest Gallery <= 30.0.6 versions. No fix yet Fix from $1,9502026-07-27 MEDIUM 6.5 CVE-2026-65448 Unauthenticated Cross Site Scripting (XSS) in Anti Spam and list cleaner &#8211; AcyChecker <= 1.8.1 versions. No fix yet Fix from $1,6002026-07-27 MEDIUM 6.1 CVE-2026-51565 Cross-site scripting (XSS) vulnerability in Modules/Docs/DocsController.php in Milk admin <=0.9.8 allows remote attackers to inject arbitrary web scr… No fix yet Fix from $1,6002026-07-27 HIGH 7.1 CVE-2026-61957 Unauthenticated Cross Site Scripting (XSS) in miniorange otp verification <= 5.5.1 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65437 Unauthenticated Cross Site Scripting (XSS) in Spam protection, AntiSpam, FireWall by CleanTalk <= 6.82 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65438 Unauthenticated Cross Site Scripting (XSS) in Message Filter for Contact Form 7 <= 1.6.3.9 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65439 Unauthenticated Cross Site Scripting (XSS) in Ultimate Addons for Contact Form 7 <=3.5.45 versions. No fix yet Fix from $1,9502026-07-27 HIGH 7.1 CVE-2026-65440 Unauthenticated Cross Site Scripting (XSS) in GetGenie <= 4.4.3 versions. No fix yet Fix from $1,9502026-07-27