Advisories · Weakness

Cross-site scripting (XSS).

Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-103305 CVE record

CVSS 8.8 High

Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
- Prenotazioni
- Cross-site scripting (XSS)
Not analysed yet 11 Oct 2026
CVE-2026-12980 CVE record

CVSS 6.8 Medium

Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
- Post Snippets
- Cross-site scripting (XSS)
Not analysed yet 11 Oct 2026
CVE-2026-57742 CVE record

CVSS 7.1 High

WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
- ThemeREX Group Kids Planet
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-78534 CVE record

CVSS 7.1 High

WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
- Keen IT Solutions Educavo
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-78532 CVE record

CVSS 7.1 High

WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
- designthemes LMS
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62116 CVE record

CVSS 7.1 High

WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
- Dmitry V. Barcode Scanner with Inventory & Order Manager
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62100 CVE record

CVSS 7.1 High

WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
- kutethemes KuteShop
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62095 CVE record

CVSS 7.1 High

WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
- kutethemes Biolife
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62093 CVE record

CVSS 7.1 High

WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
- kutethemes TechOne
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62091 CVE record

CVSS 7.1 High

WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
- kutethemes Armania
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62082 CVE record

CVSS 7.1 High

WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability
- An-Themes Pin WP
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62064 CVE record

CVSS 7.1 High

WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- Bracketweb Ambed
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62037 CVE record

CVSS 7.1 High

WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
- bPlugins Document Embedder
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62034 CVE record

CVSS 7.1 High

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability
- bPlugins Before After Image Comparison – Image comparison for WP
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-62027 CVE record

CVSS 7.1 High

WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
- bPlugins Team Section Block
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42715 CVE record

CVSS 7.1 High

WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability
- Photo Gallery by 10Web
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42711 CVE record

CVSS 7.1 High

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability
- Slider by 10Web
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42709 CVE record

CVSS 7.1 High

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability
- RadiusTheme Food Menu – Restaurant Menu & Online Ordering for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42702 CVE record

CVSS 7.1 High

WordPress Tutor LMS plugin <= 4.1.0 - Cross Site Scripting (XSS) vulnerability
- Themeum Tutor LMS
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42699 CVE record

CVSS 7.1 High

WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability
- FolioVision FV Player 8
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42697 CVE record

CVSS 7.1 High

WordPress Social Share Icons & Social Share Buttons plugin <= 3.7.5 - Cross Site Scripting (XSS) vulnerability
- Inisev Social Share Icons & Social Share Buttons
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42693 CVE record

CVSS 7.1 High

WordPress Jannah theme < 7.6.8 - Cross Site Scripting (XSS) vulnerability
- TieLabs Jannah
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42632 CVE record

CVSS 7.1 High

WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability
- Qode Real Estate
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-42631 CVE record

CVSS 7.1 High

WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability
- Qode Music
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-40803 CVE record

CVSS 7.1 High

WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability
- Jotform – AI Chatbot
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-39800 CVE record

CVSS 7.1 High

WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability
- Anton Bond Additional Order Filters for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-39799 CVE record

CVSS 7.1 High

WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability
- Joomunited WP File Download
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-57806 CVE record

CVSS 7.1 High

WordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.3.9 - Reflected Cross Site Scripting (XSS) vulnerability
- drfuri Martfury - WooCommerce Marketplace WordPress Theme
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-94160 CVE record

CVSS 7.1 High

WordPress ThemeStek Extras for LabtechCO Theme plugin <= 8.4 - Reflected Cross Site Scripting (XSS) vulnerability
- ThemeStek Extras for LabtechCO Theme
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-97264 CVE record

CVSS 7.1 High

WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
- Greg Winiarski WPAdverts
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-97263 CVE record

CVSS 7.1 High

WordPress WPAdverts plugin <= 2.3.4 - Cross Site Scripting (XSS) vulnerability
- Greg Winiarski WPAdverts
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-102388 CVE record

CVSS 7.1 High

WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability
- WPMU DEV Forminator
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-106139 CVE record

CVSS 5.4 Medium

Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue
- Progress Software Kendo UI for Vue
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-106138 CVE record

CVSS 5.4 Medium

Cross-Site Scripting via Chart Tooltip in KendoReact
- Progress Software KendoReact
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-107657 CVE record

CVSS 7.2 High

HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
- HivePress – Business Directory, Listings & Classified Ads Plugin
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-4791 CVE record

CVSS 6.4 Medium

PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
- PeproDev Ultimate Profile Solutions
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-93951 CVE record

CVSS 7.1 High

WordPress Zeinet theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
- Bracketweb Zeinet
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-103478 CVE record

CVSS 6.4 Medium

Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
- codename065 Premium Packages – Sell Digital Products Securely
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-97340 CVE record

CVSS 6.4 Medium

Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
- ThemeFusion Avada | Website Builder For WordPress & WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-102774 CVE record

CVSS 6.4 Medium

SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
- brainstormforce SureDash – Community, Courses & Member Dashboard
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-100178 CVE record

CVSS 7.2 High

WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
- gwin WPAdverts – Classifieds Plugin
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-96765 CVE record

CVSS 7.2 High

WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
- WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-97396 CVE record

CVSS 6.4 Medium

Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
- Email Marketing for WordPress and WooCommerce – Retainful
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-101921 CVE record

CVSS 4.7 Medium

WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
- smub WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-101920 CVE record

CVSS 7.2 High

Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
- Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-100147 CVE record

CVSS 7.2 High

FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
- teamfunnelkit FunnelKit – Funnel Builder for WooCommerce Checkout
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-96563 CVE record

CVSS 6.4 Medium

Motors <= 1.4.124 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'stm_f_s' Parameter
- stylemix Motors – Car Dealership & Classified Listings Plugin
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-96278 CVE record

CVSS 7.2 High

WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
- opajaap WP Photo Album Plus
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-103427 CVE record

CVSS 6.4 Medium

Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
- wpinsider-1 Simple Membership
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-96572 CVE record

CVSS 7.2 High

WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- aguidrevitch WP Meteor Website Speed Optimization Addon
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-107742 CVE record

CVSS 7.2 High

10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-100196 CVE record

CVSS 7.2 High

LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
- wp_media LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-102402 CVE record

CVSS 6.4 Medium

Team <= 6.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ttp_filter_taxonomy' Post Meta via [tlpteam] Shortcode
- techlabpro1 Team – Team Members Showcase Plugin
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-6243 CVE record

CVSS 6.4 Medium

Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- shabti Frontend Admin by DynamiApps
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-5725 CVE record

CVSS 6.1 Medium

Favicon Rotator <= 1.2.11 - Reflected Cross-Site Scripting via 'fvrt_' prefix
- archetyped Favicon Rotator
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-100161 CVE record

CVSS 7.2 High

Photo Reviews for WooCommerce <= 1.2.30 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'wcpr_image_upload_id' Parameter
- villatheme Photo Reviews for WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-103897 CVE record

CVSS 4.4 Medium

Responsive Lightbox & Gallery <= 2.7.9 - Authenticated (Editor+) Stored Cross-Site Scripting via Comment Content 'title' Attribute
- dfactory Responsive Lightbox & Gallery
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-89100 CVE record

CVSS 6.1 Medium

Payment Plugins for Stripe WooCommerce <= 4.0.17 - Reflected DOM-Based Cross-Site Scripting via '#response' URL Fragment
- paymentplugins Payment Plugins for Stripe WooCommerce
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-95684 CVE record

CVSS 7.2 High

VikBooking Hotel Booking Engine & PMS <= 1.8.15 - Unauthenticated Stored Cross-Site Scripting via 'attachments[name]' Parameter
- e4jvikwp VikBooking Hotel Booking Engine & PMS
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026
CVE-2026-96840 CVE record

CVSS 7.2 High

Post Grid Gutenberg Blocks <= 5.1.0 - Unauthenticated Stored Cross-Site Scripting via display_name User Field
- wpxpo Post Grid Gutenberg Blocks – PostX
- Cross-site scripting (XSS)
Not analysed yet 10 Oct 2026