Vulnerability database

12,185 results · page 35 of 244

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.CVE-2026-49055 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

  Affected

  up to 1.3.9.7

  What to do

  Affects up to 1.3.9.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.CVE-2026-48966 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

  Affected

  up to 3.15.0.2

  What to do

  Affects up to 3.15.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.CVE-2026-48885 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.

  Affected

  up to 2.3.10.1

  What to do

  Affects up to 2.3.10.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.CVE-2026-48880 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in WP Job Portal <= 2.5.2 versions.

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.CVE-2026-48876 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.

  Affected

  up to 2026.3

  What to do

  Affects up to 2026.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.CVE-2026-48871 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.

  Affected

  up to 5.1.3

  What to do

  Affects up to 5.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.CVE-2026-48870 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in King Addons for Elementor <= 51.1.62 versions.

  Affected

  up to 51.1.62

  What to do

  Affects up to 51.1.62. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.CVE-2026-48867 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.

  Affected

  up to 11.1.2

  What to do

  Affects up to 11.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.CVE-2026-48838 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.

  Affected

  up to 3.6.2

  What to do

  Affects up to 3.6.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.CVE-2026-45437 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

  Affected

  up to 1.0.6

  What to do

  Affects up to 1.0.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.CVE-2026-42775 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.

  Affected

  up to 5.7.2

  What to do

  Affects up to 5.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.CVE-2026-42688 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Modula Image Gallery <= 2.14.23 versions.

  Affected

  up to 2.14.23

  What to do

  Affects up to 2.14.23. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.CVE-2026-42686 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

  Affected

  up to 4.3.2.1

  What to do

  Affects up to 4.3.2.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.CVE-2026-42663 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Unauthenticated Cross Site Scripting (XSS) in Simple Membership <= 4.7.2 versions.

  Affected

  up to 4.7.2

  What to do

  Affects up to 4.7.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.CVE-2026-42658 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.

  Affected

  up to 5.3.8

  What to do

  Affects up to 5.3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.CVE-2026-42656 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Contest Gallery <= 28.1.6 versions.

  Affected

  up to 28.1.6

  What to do

  Affects up to 28.1.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.CVE-2026-42650 · WordPress plugins & themes · reported by PatchstackHigh 7.2

  Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.6.7 versions.

  Affected

  up to 5.6.7

  What to do

  Affects up to 5.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.CVE-2026-42649 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.

  Affected

  up to 1.2.11

  What to do

  Affects up to 1.2.11. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.CVE-2026-41556 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in ProfilePress <= 4.16.13 versions.

  Affected

  up to 4.16.13

  What to do

  Affects up to 4.16.13. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.CVE-2026-40791 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.

  Affected

  up to 1.2.46

  What to do

  Affects up to 1.2.46. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.CVE-2026-40787 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

  Affected

  up to 11.0.0

  What to do

  Affects up to 11.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.CVE-2026-40770 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.

  Affected

  up to 7.5.3

  What to do

  Affects up to 7.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.CVE-2026-40732 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.

  Affected

  up to 3.5

  What to do

  Affects up to 3.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.CVE-2026-39540 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in Shipment Tracker for Woocommerce <= 1.5.3.2 versions.

  Affected

  up to 1.5.3.2

  What to do

  Affects up to 1.5.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.CVE-2026-39514 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.

  Affected

  up to 2.17.3

  What to do

  Affects up to 2.17.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.CVE-2026-39507 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.

  Affected

  up to 2.3.2

  What to do

  Affects up to 2.3.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.CVE-2026-39491 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Subscriber Cross Site Scripting (XSS) in JupiterX Core <= 4.14.1 versions.

  Affected

  up to 4.14.1

  What to do

  Affects up to 4.14.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.CVE-2026-39463 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.

  Affected

  up to 4.9.31

  What to do

  Affects up to 4.9.31. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.CVE-2026-39451 · WordPress plugins & themes · reported by PatchstackMedium 6.3

  Unauthenticated Cross Site Scripting (XSS) in WP Google Review Slider <= 18.0 versions.

  Affected

  up to 18.0

  What to do

  Affects up to 18.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.CVE-2026-39449 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.CVE-2026-39447 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.

  Affected

  up to 1.6.10.6

  What to do

  Affects up to 1.6.10.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.CVE-2026-39435 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.

  Affected

  up to 15.1.3

  What to do

  Affects up to 15.1.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.CVE-2026-34902 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.

  Affected

  up to 4.6.3

  What to do

  Affects up to 4.6.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.CVE-2026-34900 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.

  Affected

  up to 4.14.2

  What to do

  Affects up to 4.14.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.CVE-2026-23970 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.

  Affected

  up to 3.2.8

  What to do

  Affects up to 3.2.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions.CVE-2025-68872 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Eli's WordCents adSense Widget with Analytics <= 1.3.03.27 versions.

  Affected

  up to 1.3.03.27

  What to do

  Affects up to 1.3.03.27. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.CVE-2025-68851 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.

  Affected

  up to 2.3

  What to do

  Affects up to 2.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.CVE-2025-68840 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.

  Affected

  up to 1.1.2

  What to do

  Affects up to 1.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.CVE-2025-15659 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Contributor Cross Site Scripting (XSS) in Elizaibots <= 1.0.2 versions.

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.CVE-2025-15658 · WordPress plugins & themes · reported by PatchstackMedium 5.9

  Administrator Cross Site Scripting (XSS) in WP Emmet <= 0.3.4 versions.

  Affected

  up to 0.3.4

  What to do

  Affects up to 0.3.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 15, 2026WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to mCVE-2016-20070 · WordPress plugins & themes · reported by VulnCheckMedium 5.1

  WordPress Booking Calendar Contact Form 1.0.23 contains privilege escalation and stored cross-site scripting vulnerabilities that allow authenticated users to modify plugin options and inject malicious scripts by failing to verify user privileges and sanitize input parameters. Attackers with subscriber-level accounts can inject XSS payloads through parameters like price, name, calendar_language, and email_confirmation_to_user via admin-ajax.php and admin.php endpoints to execute arbitrary JavaScript in administrator browsers.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordwordpress.dwbooster.comexploit-db.com

• Jun 15, 2026WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file uplCVE-2016-20066 · WordPress plugins & themes · reported by VulnCheckMedium 5.1

  WordPress CP Polls 1.0.8 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts through unsanitized file upload functionality. Attackers can upload files containing script payloads with event handlers like onerror attributes to execute arbitrary JavaScript in the browsers of users viewing the affected content.

  What to do

  Update the plugin to the newest version.

  Full record and what to do →NVD recordexploit-db.comvulncheck.com

• Jun 13, 2026Online Scheduling and Appointment Booking System – Bookly: Stored Cross-Site ScriptingCVE-2026-5513 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bookly-customer-full-name' cookie in versions up to, and including, 27.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires 'Remember personal information in cookies' setting to be enabled (disabled by default).

  Product

  Online Scheduling and Appointment Booking System – Bookly

  Affected

  up to 27.2

  What to do

  Affects up to 27.2. Update Online Scheduling and Appointment Booking System – Bookly to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jun 13, 2026Canvas: Stored Cross-Site ScriptingCVE-2026-9629 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Canvas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Canvas

  Affected

  up to 2.5.2

  What to do

  Affects up to 2.5.2. Update Canvas to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 13, 2026Page Builder: Pagelayer – Drag and Drop website builder: Stored Cross-Site ScriptingCVE-2026-3297 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Page Builder: Pagelayer – Drag and Drop website builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Anchor block in versions up to, and including, 2.0.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Page Builder: Pagelayer – Drag and Drop website builder

  Affected

  up to 2.0.9

  What to do

  Affects up to 2.0.9. Update Page Builder: Pagelayer – Drag and Drop website builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com

• Jun 13, 2026FooGallery: Stored Cross-Site ScriptingCVE-2026-9134 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'custom_attribute_key' shortcode parameter in versions up to, and including, 3.1.31 This is due to an incomplete JavaScript event handler blacklist in the foogallery_sanitize_javascript() function, which blocks only a subset of HTML event attributes (onmouseover, onmouseout, onpointerenter, onclick, onload, onchange, onerror) while permitting others such as 'onmouseenter', combined with the failure to escape the attribute key when building the gallery container HTML in foogallery_build_container_attributes_safe(). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  FooGallery

  Affected

  up to 3.1.31

  What to do

  Affects up to 3.1.31. Update FooGallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 13, 2026GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites: Stored Cross-Site ScriptingCVE-2026-9109 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REST API Translation Storage in all versions up to, and including, 2.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The deterministically derived API key (sha256 of the site URL) is printed in the HTML source of every page via the JavaScript variable gptApiKey, meaning any unauthenticated visitor can retrieve the key and submit malicious translation payloads to the /wp-json/gptranslate/v1/request endpoint without any additional precondition.

  Product

  GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites

  Affected

  up to 2.31

  What to do

  Affects up to 2.31. Update GPTranslate – Multilingual AI Translation for WordPress: Automatically Translate Websites to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 11, 2026Presto Player: Stored Cross-Site ScriptingCVE-2026-9125 · WordPress plugins & themes · reported by WordfenceMedium 6.4

  The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link_url' parameter of the [presto_player_overlay] shortcode in versions up to, and including, 4.2.0 This is due to insufficient input sanitization and output escaping in the getOverlays() function, which copies the link_url shortcode attribute directly into the overlay configuration without scheme validation, allowing javascript: URIs to survive and be rendered as the href of a clickable anchor element by the presto-dynamic-overlay-ui web component. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  Product

  Presto Player

  Affected

  up to 4.2.0

  What to do

  Affects up to 4.2.0. Update Presto Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org

• Jun 11, 2026SliceWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42653 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP allows Stored XSS. This issue affects SliceWP: from n/a through 1.2.6.

  Product

  SliceWP

  Affected

  up to 1.2.6

  What to do

  Affects up to 1.2.6. Update SliceWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Jun 11, 2026WP Mail Log: Improper neutralization of input during web page generation ('cross-site scripting')CVE-2023-33999 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Log allows DOM-Based XSS. This issue affects WP Mail Log: from n/a through 1.0.2.

  Product

  WP Mail Log

  Affected

  up to 1.0.2

  What to do

  Affects up to 1.0.2. Update WP Mail Log to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.