Advisories · Weakness
Cross-site scripting (XSS).
Untrusted input rendered as script in someone else’s browser. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.1 Medium
Typemill SvgSanitizer.php saveImage cross site scripting
- Typemill
- Cross-site scripting (XSS)
- Code injection
- CVSS 6.8 Medium
Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute
- Media Library Assistant
- Cross-site scripting (XSS)
- CVSS 4.6 Medium
Thelia before 3.1.1 Stored XSS via SVG Store Logo and Banner Uploads
- Thelia
- Thelia Core
- Cross-site scripting (XSS)
- CVSS 5.1 Medium
PostyBirb Plus Submission Description Editor DescriptionInput.tsx cross site scripting
- PostyBirb Plus
- Cross-site scripting (XSS)
- Code injection
- CVSS 7.4 High
Thelia before 3.1.0 Stored XSS via Coupon Condition Customer Name
- Thelia
- Thelia Core
- Cross-site scripting (XSS)
-
WebDyne versions from 2.014 before 3.022 for Perl reflect request parameters unescaped into form field values, allowing cross-site scripting
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter
- ThemeHigh WooCommerce Extra Product Options Pro
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
FlexStock <= 3.17.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter via REST update endpoint
- wppool FlexStock – Product Stock Sync with Google Sheets for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint
- qriouslad Debug Log Manager – Conveniently Monitor and Inspect Errors
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Ninja Forms <= 3.15.5 - Reflected DOM-Based Cross-Site Scripting via 'querystring:<key>' URL Parameter
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
BuddyBoss Platform <= 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Group Name
- Boss Media BuddyBoss Platform
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
GeoDirectory <= 2.8.197 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_images' Image Title Delimiter Injection
- paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
- Cross-site scripting (XSS)
- CVSS 7.2 High
FeedWordPress <= 2026.0517 - Unauthenticated Stored Cross-Site Scripting via Syndicated Feed Content
- radgeek FeedWordPress
- Cross-site scripting (XSS)
- CVSS 7.2 High
WP Activity Log <= 5.6.1 - Unauthenticated Stored Cross-Site Scripting
- melapress WP Activity Log
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Smart Post <= 4.0.9 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User display_name via Author Filter block
- shapedplugin Smart Post – Post Grid, Post Carousel, Post Slider Gutenberg Blocks for Blog & News
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Content Pilot <= 2.2.4 - Unauthenticated Stored Cross-Site Scripting via RSS-linked article `<meta name="description">`
- pluginever Content Pilot – Autoblogging & Affiliate Marketing Suite
- Cross-site scripting (XSS)
- CVSS 7.2 High
WPO365 | MICROSOFT 365 GRAPH MAILER <= 6.2 - Unauthenticated Stored Cross-Site Scripting via Email Subject via wp_mail
- WPO365 | MICROSOFT 365 GRAPH MAILER
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
User Frontend <= 4.3.13 - Reflected Cross-Site Scripting via 'field_attr[required]' Parameter
- wedevs User Frontend – Membership, User Registration, User Profile, User Directory & Content Restriction with Frontend Post Submission
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
SEOPress <= 10.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Profile Field via %%archive_title%% Template Tag
- rainbowgeek SEOPress – AI SEO Plugin & On-site SEO
- Cross-site scripting (XSS)
- CVSS 7.2 High
Shield Security <= 22.3.2 - Unauthenticated Stored Cross-Site Scripting via Request Path (REQUEST_URI) in Traffic Log
- paultgoodchild Shield Security – Smart Bot Blocking, Brute-Force Login Protection & File Scanning
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors <= 4.17.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name profile-sync into author…
- Co-Authors, Multiple Authors and Guest Authors in an Author Box with PublishPress Authors
- Cross-site scripting (XSS)
- CVSS 7.2 High
Shipping Zones by Drawing for WooCommerce <= 3.3.0 - Unauthenticated Stored Cross-Site Scripting via 'szbd-picked' Checkout Parameter
- arosoft Shipping Zones by Drawing for WooCommerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
VikRentCar Car Rental Management System <= 1.4.10 - Unauthenticated Stored Cross-Site Scripting via 'optionals' Parameter
- e4jvikwp VikRentCar Car Rental Management System
- Cross-site scripting (XSS)
- CVSS 7.2 High
Welcart e-Commerce <= 2.12.5 - Unauthenticated Stored Cross-Site Scripting via 'gid' Parameter
- uscnanbu Welcart e-Commerce
- Cross-site scripting (XSS)
- CVSS 7.2 High
VikRentCar Car Rental Management System <= 1.4.9 - Unauthenticated Stored Cross-Site Scripting via 'poplink' Parameter
- e4jvikwp VikRentCar Car Rental Management System
- Cross-site scripting (XSS)
- CVSS 7.2 High
PDF Invoices & Packing Slips for WooCommerce <= 5.16.4 - Unauthenticated Stored Cross-Site Scripting via Billing First Name / Last Name / Company / Customer Note fields at guest checkout
- wpovernight PDF Invoices & Packing Slips for WooCommerce
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Product Filter for WooCommerce by WBW <= 3.4.6 - Reflected Cross-Site Scripting via 'wpf_fid' JSON Parameter
- woobewoo Product Filter for WooCommerce by WBW
- Cross-site scripting (XSS)
- CVSS 7.2 High
User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting
- specialk User Submitted Posts – Enable Users to Submit Posts from the Front End
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
Discussion Board <= 2.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Profile Website (user_url) Field
- marketingfire Discussion Board – WordPress Forum Plugin
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Job Portal <= 2.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'degreetitle' Parameter
- wpjobportal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website
- Cross-site scripting (XSS)
- CVSS 7.2 High
Relevanssi <= 4.28.5 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Late Entity Decode
- comesio Relevanssi – A Better Search
- Cross-site scripting (XSS)
- CVSS 7.2 High
ThirstyAffiliates <= 3.12.1 - Unauthenticated Stored Cross-Site Scripting via Comment Content via <ta> Tag
- supercleanse ThirstyAffiliates – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Predictable Minify Placeholder
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
- CVSS 7.2 High
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments
- SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
Webmention <= 5.10.1 - Unauthenticated Stored Cross-Site Scripting via Open Graph og:title Meta Tag
- pfefferle Webmention
- Cross-site scripting (XSS)
- CVSS 7.2 High
W3 Total Cache <= 2.10.7 - Unauthenticated Stored Cross-Site Scripting via Comment Content Cached as HTML after License Expiry
- boldgrid W3 Total Cache
- Cross-site scripting (XSS)
- CVSS 6.8 Medium
Firelight Lightbox < 2.3.24 - Contributor+ Stored XSS via Image 'src' Attribute
- Firelight Lightbox
- Cross-site scripting (XSS)
- CVSS 7.2 High
PPWP <= 1.9.26 - Unauthenticated Stored Cross-Site Scripting via '[ppwp]' Shortcode 'desc_below_form' Attribute via Placeholder Marker Collision
- buildwps PPWP – Password Protect Pages
- Cross-site scripting (XSS)
- CVSS 7.2 High
Ninja Forms <= 3.15.5 - Unauthenticated Stored Cross-Site Scripting via 'extra' Parameter via Metadata Key Normalization
- kstover Ninja Forms – Contact Form Builder with Calculators, Quizzes, Signatures & AI Form Builder
- Cross-site scripting (XSS)
- CVSS 7.2 High
Meow Lightbox <= 5.6.4 - Unauthenticated Stored Cross-Site Scripting via HTML Parser Quote-Metadata Desynchronization
- tigroumeow Meow Lightbox
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML
- smub Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery
- Cross-site scripting (XSS)
- CVSS 4.0, no score published
AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)
- Cross-site scripting (XSS)
<5.5.1 · fixed in 5.5.1
GHSA-rx7m-wxwq-vxr9 · CVE-2026-96632 - CVSS 7.5 High
PDF Invoices & Packing Slips for WooCommerce 5.16.2 - 5.16.4 - Unauthenticated Stored XSS via Order Address and Customer Note Fields
- PDF Invoices & Packing Slips for WooCommerce
- Cross-site scripting (XSS)
- CVSS 8.7 High
Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
- shopper
- Cross-site scripting (XSS)
- Privilege escalation
- CVSS 5.3 Medium
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
- Cross-site scripting (XSS)
>=1.0.0, <3.3.5 || >=4.0.0, <4.4.0 · fixed in 3.3.5, 4.4.0
EEF-CVE-2026-117645 · CVE-2026-117645 - CVSS 5.1 Medium
WIT SynApps Runtime 1.4.11 Reflected XSS via LINK Parameter
- WIT SynApps Runtime
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
- Aguila Technologies WP Customer Area
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
- impleCode eCommerce Product Catalog
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
- Kitae Park Mang Board WP
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
- e4jvikwp VikRentCar
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
- MultiVendorX
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
- Spacetime Ad Inserter
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
- Saad Iqbal All In One Login
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
- Cozmoslabs Profile Builder
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
- Raul P. Fast Velocity Minify
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
- bookingalgorithms BA Book Everything
- Cross-site scripting (XSS)
- CVSS 7.1 High
WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
- e4jvikwp VikRentCar
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
- wpeverest User Registration
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
- Brainstorm Force Ultimate Addons for Elementor - Lite
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
WordPress GIFTiT – Free Gifts for WooCommerce plugin <= 4.5 - Content Injection vulnerability
- ithemelandco GIFTiT – Free Gifts for WooCommerce
- Cross-site scripting (XSS)