Vulnerability database

15,868 results · page 11 of 318

• Oct 7, 2026Quiz And Survey Master: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-104391 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Stored XSS.This issue affects Quiz And Survey Master: from n/a through 11.2.7.

  Product

  Quiz And Survey Master

  Affected

  up to 11.2.7

  What to do

  Affects up to 11.2.7. Update Quiz And Survey Master to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 7, 2026OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.: Stored Cross-Site ScriptingCVE-2026-89417 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 's' Search Parameter via comments-atom Feed in all versions up to, and including, 6.3.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the front-end server serves the retained .tmp file without a Content-Type or X-Content-Type-Options header, enabling MIME-sniffing browsers such as Chromium to execute the injected script — a condition present by default on many Apache and nginx/php-fpm deployments.

  Product

  OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy.

  Affected

  up to 6.3.10

  What to do

  Affects up to 6.3.10. Update OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 7, 2026Kirki – Freeform Page Builder, Website Builder & Customizer: Stored Cross-Site ScriptingCVE-2026-102173 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via registration metadata in all versions up to, and including, 6.3.1 This is due to insufficient escaping in `ExceptionalElements::image_element()`, which concatenates a user-meta value straight into an `<img src="…">` attribute. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses a page rendering a Kirki users collection whose image element is bound to one of the nine registration meta fields. Requires public user registration to be enabled and a published page carrying a `kirki-register` element, which prints the required element nonce into the public markup.

  Product

  Kirki – Freeform Page Builder, Website Builder & Customizer

  Affected

  up to 6.3.1

  What to do

  Affects up to 6.3.1. Update Kirki – Freeform Page Builder, Website Builder & Customizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.CVE-2026-94675 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack <= 6.2.13 versions.

  Affected

  up to 6.2.13

  What to do

  Affects up to 6.2.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.CVE-2026-42636 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.4.6 versions.

  Affected

  up to 4.4.6

  What to do

  Affects up to 4.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.CVE-2026-42635 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WooCommerce Simple Auctions <= 3.0.10 versions.

  Affected

  up to 3.0.10

  What to do

  Affects up to 3.0.10. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section.CVE-2026-42634 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Video Background Block – Use video as background in the section. <= 2.0.3 versions.

  Affected

  up to 2.0.3

  What to do

  Affects up to 2.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Social Rocket: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42418 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Socialrocket Social Rocket social-rocket allows Reflected XSS.This issue affects Social Rocket: from n/a through 1.3.5.

  Product

  Social Rocket

  Affected

  up to 1.3.5

  What to do

  Affects up to 1.3.5. Update Social Rocket to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.CVE-2026-40807 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in CF7 Views &#8211; Complete Entry Management for Contact Form 7 <= 3.2.6 versions.

  Affected

  up to 3.2.6

  What to do

  Affects up to 3.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.CVE-2026-40806 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

  Affected

  up to 2.1.0

  What to do

  Affects up to 2.1.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39790 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikRentCar vikrentcar allows Reflected XSS.This issue affects VikRentCar: from n/a through 1.4.7.

  Product

  VikRentCar

  Affected

  up to 1.4.7

  What to do

  Affects up to 1.4.7. Update VikRentCar to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.CVE-2026-39788 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Front End PM <= 11.4.6 versions.

  Affected

  up to 11.4.6

  What to do

  Affects up to 11.4.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.CVE-2026-39784 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Hotel Booking <= 3.8 versions.

  Affected

  up to 3.8

  What to do

  Affects up to 3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Document Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-39781 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dan Rossiter Document Gallery document-gallery allows Reflected XSS.This issue affects Document Gallery: from n/a through 5.1.1.

  Product

  Document Gallery

  Affected

  up to 5.1.1

  What to do

  Affects up to 5.1.1. Update Document Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.CVE-2026-39780 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

  Affected

  up to 1.3.7

  What to do

  Affects up to 1.3.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.CVE-2026-39778 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Ansar Import – One Click Starter Sites – for Elementor & Themes <= 2.1.2 versions.

  Affected

  up to 2.1.2

  What to do

  Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.CVE-2026-39766 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.

  Affected

  up to 7.1.2

  What to do

  Affects up to 7.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.CVE-2026-39758 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Midtrans-WooCommerce <= 2.32.3 versions.

  Affected

  up to 2.32.3

  What to do

  Affects up to 2.32.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 CVE-2026-39750 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.0.6 versions.

  Affected

  up to 2.0.6

  What to do

  Affects up to 2.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.CVE-2026-39748 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in EduMall <= 4.5.3 versions.

  Affected

  up to 4.5.3

  What to do

  Affects up to 4.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.CVE-2026-39745 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.

  Affected

  up to 1.7.6

  What to do

  Affects up to 1.7.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.CVE-2026-39731 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.CVE-2026-39727 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.

  Affected

  up to 4.1.12

  What to do

  Affects up to 4.1.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.CVE-2026-39726 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.

  Affected

  up to 2.1.1

  What to do

  Affects up to 2.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.CVE-2026-39724 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.

  Affected

  up to 1.3.11

  What to do

  Affects up to 1.3.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.CVE-2026-39722 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.

  Affected

  up to 4.972

  What to do

  Affects up to 4.972. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.CVE-2026-39720 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.

  Affected

  up to 2.0.4

  What to do

  Affects up to 2.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.CVE-2026-32577 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.

  Affected

  up to 23.6

  What to do

  Affects up to 23.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.CVE-2026-32575 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.

  Affected

  up to 11.7.0

  What to do

  Affects up to 11.7.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Smart Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-32574 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.

  Product

  Smart Forms

  Affected

  up to 2.6.104

  What to do

  Affects up to 2.6.104. Update Smart Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.CVE-2026-32572 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.

  Affected

  up to 4.2.13

  What to do

  Affects up to 4.2.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.CVE-2026-32571 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.

  Affected

  up to 3.6.8

  What to do

  Affects up to 3.6.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.CVE-2026-32570 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.

  Affected

  up to 1.6.0

  What to do

  Affects up to 1.6.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.CVE-2026-32569 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.

  Affected

  up to 6.2.2

  What to do

  Affects up to 6.2.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105879 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.

  Product

  JetElements For Elementor

  Affected

  up to 2.9.2.2

  What to do

  Affects up to 2.9.2.2. Update JetElements For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.CVE-2026-105061 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.

  Affected

  up to 1.9.0.0

  What to do

  Affects up to 1.9.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.CVE-2026-104814 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.

  Affected

  up to 1.8.1

  What to do

  Affects up to 1.8.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.CVE-2026-104672 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.

  Affected

  up to 4.17.0

  What to do

  Affects up to 4.17.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.CVE-2026-104670 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.

  Affected

  up to 4.4.9

  What to do

  Affects up to 4.4.9. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.CVE-2026-104395 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.

  Affected

  up to 3.10.1

  What to do

  Affects up to 3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.CVE-2026-104394 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.

  Affected

  up to 1.8.12.3

  What to do

  Affects up to 1.8.12.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Payflex Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103346 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.

  Product

  Payflex Payment Gateway

  Affected

  up to 2.7.1

  What to do

  Affects up to 2.7.1. Update Payflex Payment Gateway to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 6, 2026Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App: Stored Cross-Site ScriptingCVE-2026-75962 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message.

  Product

  Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App

  Affected

  up to 4.0.1

  What to do

  Affects up to 4.0.1. Update Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Oct 6, 2026Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.CVE-2026-39760 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Real 3D FlipBook <= 5.5 versions.

  Affected

  up to 5.5

  What to do

  Affects up to 5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Photo Reviews for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100515 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VillaTheme Photo Reviews for WooCommerce woo-photo-reviews allows Reflected XSS.This issue affects Photo Reviews for WooCommerce: from n/a through 1.2.30.

  Product

  Photo Reviews for WooCommerce

  Affected

  up to 1.2.30

  What to do

  Affects up to 1.2.30. Update Photo Reviews for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026RepairBuddy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-100509 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Stored XSS.This issue affects RepairBuddy: from n/a through 4.1225.

  Product

  RepairBuddy

  Affected

  up to 4.1225

  What to do

  Affects up to 4.1225. Update RepairBuddy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Image Slider Widget: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42700 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Image Slider Widget image-slider-widget allows Stored XSS.This issue affects Image Slider Widget: from n/a through 1.1.130.

  Product

  Image Slider Widget

  Affected

  up to 1.1.130

  What to do

  Affects up to 1.1.130. Update Image Slider Widget to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026Adsmonetizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-15643 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jose Fernandez Adsmonetizer adsensei-b30 allows Reflected XSS.This issue affects Adsmonetizer: from n/a through 3.2.4.

  Product

  Adsmonetizer

  Affected

  up to 3.2.4

  What to do

  Affects up to 3.2.4. Update Adsmonetizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 5, 2026LearnPress: Stored cross-site scriptingCVE-2026-105397 · WordPress plugins & themes · reported by VulnCheckMedium 5.1

  LearnPress plugin for WordPress through 4.4.9.1 contains a stored cross-site scripting vulnerability that allows authenticated instructors to inject scripts via quiz question hint and explanation fields. Attackers with the Instructor role can submit unsanitized payloads through the update_question AJAX handler that execute in the session of every student taking the quiz.

  Product

  LearnPress

  Affected

  up to 4.4.9.1

  What to do

  Affects up to 4.4.9.1. Update LearnPress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordgithub.complugins.svn.wordpress.org

• Oct 5, 2026QR Redirector: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105069 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nikki Blight QR Redirector qr-redirector allows Stored XSS.This issue affects QR Redirector: from n/a through 2.0.5.

  Product

  QR Redirector

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update QR Redirector to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.