Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.4 Medium
User Frontend <= 4.3.12 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'wpuf_payment_method' Parameter
- wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
- Cross-site scripting (XSS)
- CVSS 7.2 High
Quiz and Survey Master (QSM) <= 11.2.6 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'qsm_hidden_questions' Parameter
- expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker
- Cross-site scripting (XSS)
- CVSS 8.8 High
LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules
- LTL Freight Quotes
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS
- Gallery PhotoBlocks
- Cross-site scripting (XSS)
- CVSS 3.5 Low
Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL
- Rank Math SEO
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Download Manager <= 3.3.57 - Unauthenticated DOM-Based Reflected Cross-Site Scripting via 'REFERRER' Parameter
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 7.2 High
Easy Digital Downloads <= 3.6.9 - Unauthenticated Stored Cross-Site Scripting via PayPal IPN Parameters
- smub Easy Digital Downloads – eCommerce Payments and Subscriptions made easy
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Graphene <= 2.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Fields
- silverks Graphene
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Brizy <= 2.8.18 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'brizy-compiled-sections' Post Meta
- themefusecom Brizy – Page Builder
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer
- jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Simple Newsletter Plugin <= 4.3.10 - Unauthenticated Stored Cross-Site Scripting via Subscriber Custom Field via Manage Preferences Form + Campaign Preview noptin_key Pivot
- picocodes Noptin – Newsletter, New Post Notifications & Email Automation
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Data Tables Generator by Supsystic <= 1.12.03 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table 'id' HTML Attribute
- supsysticcom Data Tables Generator by Supsystic
- Cross-site scripting (XSS)
- CVSS 7.2 High
Podlove Podcast Publisher <= 4.5.6 - Unauthenticated Stored Cross-Site Scripting via Auphonic Webhook
- eteubert Podlove Podcast Publisher
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GiveWP <= 4.17.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via givewp_campaign_grid Shortcode Attributes
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Kadence Blocks <= 3.7.12 - Authenticated (Author+) Stored Cross-Site Scripting via Block Font Family Attribute
- stellarwp Kadence Blocks — Page Builder Toolkit for Gutenberg Editor
- Cross-site scripting (XSS)
- CVSS 7.2 High
Presto Player <= 4.5.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <presto-player> Tag
- 2winfactor Presto Player
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Embed Any Document <= 2.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'embeddoc' Shortcode
- awsmin Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
- jetmonsters Getwid – Gutenberg Blocks
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Church Admin <= 5.1.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'email' Parameter
- andy_moyle Church Admin
- Cross-site scripting (XSS)
- CVSS 7.2 High
Real Estate Manager <= 7.3 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter
- rameez_iqbal Real Estate Manager – Property Listing and Agent Management
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
HivePress <= 1.7.31 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Listing Attribute Value in Administrator-configured HTML Format
- HivePress – Business Directory, Listings & Classified Ads Plugin
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GamiPress <= 7.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'video_id' Parameter
- rubengc GamiPress – Gamification plugin to reward points, badges & ranks in WordPress, now with AI
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
MP3 Audio Player <= 5.14.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
- MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Table Field Add-on for ACF and SCF <= 1.3.35 - Authenticated (Contributor+) Stored Cross-Site Scripting via Table Cell Content
- jonua Table Field Add-on for ACF and SCF
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpdm_packages Shortcode
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Form Maker by 10Web <= 1.15.48 - Reflected Cross-Site Scripting via 'inputs' Parameter Array Key
- Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Anti-Spam by CleanTalk <= 6.88 - Unauthenticated Stored Cross-Site Scripting via Comment Content via ContactsEncoder Greedy Regex
- Anti-Spam by CleanTalk – Spam Protection Without CAPTCHA
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
RSS Aggregator by Feedzy <= 5.2.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Feedzy Loop Block Feed URL / RSS <title>
- themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
- stepasyuk Filter Everything — WordPress & WooCommerce Filters
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
FV Flowplayer Video Player <= 7.5.54.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Unquoted popup Shortcode Attribute
- foliovision FV Flowplayer Video Player
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Download Manager <= 3.3.71 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'regurl' Shortcode Attribute
- codename065 Download Manager
- Cross-site scripting (XSS)
- CVSS 4.7 Medium
Fluent Forms <= 6.2.14 - Reflected Cross-Site Scripting via '{get.*}' Editor SmartCode Parameter
- wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GeoDirectory <= 2.8.188 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Contact Email Custom Field
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Data Tables Generator by Supsystic <= 1.15.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Cell 'data' Value via updateRows Action
- supsysticcom Data Tables Generator by Supsystic
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Table Field Add-on for ACF and SCF <= 1.4.1-RC2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Table Field Value
- jonua Table Field Add-on for ACF and SCF
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Advanced Classifieds & Directory Pro <= 3.4.4 - Authenticated (Custom+) Stored Cross-Site Scripting via 'phone' Parameter
- pluginsware Advanced Classifieds & Directory Pro
- Cross-site scripting (XSS)
- CVSS 7.6 High
@tinacms/web-components: `tina-markdown` writes rich-text link URLs into `href` without scheme validation, allowing stored XSS
- Cross-site scripting (XSS)
<0.2.1 · fixed in 0.2.1
GHSA-c42q-qvc3-j6vg · CVE-2026-108260 - CVSS 9.3 CriticalCritical · CVSS 9+
Contao: Cross-site scripting in the comments bundle
- Cross-site scripting (XSS)
- CWE-116
>=4.0.0, <5.3.50 || >=5.4.0-RC1, <5.7.12 · fixed in 5.3.50, 5.7.12
GHSA-628f-v4f6-p37r · CVE-2026-107845 - CVSS 6.5 Medium
WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability
- FolioVision FV Flowplayer Video Player
- Cross-site scripting (XSS)
- CVSS 7.7 High
AstronRPA through 1.1.6 RCE via Smart-Component Chat XSS and IPC Bridge
- iflytek astron-rpa
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
Moderator Toolbox before 4.0.14 Stored XSS via Removal Reasons Configuration
- toolbox-team reddit-moderator-toolbox
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
- Smartertools Smartermail
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Pond theme <= 2.6.1 - Reflected Cross Site Scripting (XSS) vulnerability
- SpabRice Pond
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Education Center theme <= 3.6.12 - Reflected Cross Site Scripting (XSS) vulnerability
- ThemeREX Education Center
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Stored XSS in TMT Machine's Talassoft Industrial Management Software
- TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Whistle - Sports Club theme <= 4.2 - Reflected Cross Site Scripting (XSS) vulnerability
- Designthemes Whistle - Sports Club
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Voldor theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- Bracketweb Voldor
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Ogency theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- Bracketweb Ogency
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Treck theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- Bracketweb Treck
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability
- Delight Star Inc. WP Associate Post R2
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress AcyMailing SMTP Newsletter plugin <= 11.1.0 - Cross Site Scripting (XSS) vulnerability
- Datasolution AcyMailing SMTP Newsletter
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WPFunnels plugin <= 3.13.3 - Cross Site Scripting (XSS) vulnerability
- WPFunnels
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Html5 Audio Player plugin <= 2.8.8 - Cross Site Scripting (XSS) vulnerability
- bPlugins Html5 Audio Player
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Gloria Admin Panel plugin <= 1.3 - Reflected Cross Site Scripting (XSS) vulnerability
- bkninja Gloria Admin Panel
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Grand Restaurant theme < 7.0.11 - Reflected Cross Site Scripting (XSS) vulnerability
- ThemeGoods Grand Restaurant
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Total Donations plugin <= 2.0.5 - Cross Site Scripting (XSS) vulnerability
- KlbTheme Total Donations
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Kubio AI Page Builder plugin <= 2.9.3 - Cross Site Scripting (XSS) vulnerability
- Extend Themes Kubio AI Page Builder
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Sassy Social Share plugin <= 3.3.79 - Cross Site Scripting (XSS) vulnerability
- Heateor Support Sassy Social Share
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress NEX-Forms plugin <= 9.3.1 - Cross Site Scripting (XSS) vulnerability
- Basix NEX-Forms
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Simple Payment plugin <= 2.5.4 - Cross Site Scripting (XSS) vulnerability
- yalla ya! Simple Payment
- Cross-site scripting (XSS)