Updated 6 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

528new WordPress flaws this week

391,528entries in the database

42,232 results · page 63 of 845

Jul 24, 2026Rich Showcase for Google Reviews: Stored Cross-Site ScriptingCVE-2026-15739 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Rich Showcase for Google Reviews plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'pagination' Shortcode Attribute in all versions up to, and including, 6.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Rich Showcase for Google Reviews
Affected
up to 6.9.9
What to do
Affects up to 6.9.9. Update Rich Showcase for Google Reviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026VikBooking Hotel Booking Engine & PMS: Reflected Cross-Site ScriptingCVE-2026-15346 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'category_id' parameter in all versions up to, and including, 1.8.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This is limited to browsers that support access keys as the injection is in a hidden element.
Product
VikBooking Hotel Booking Engine & PMS
Affected
up to 1.8.13
What to do
Affects up to 1.8.13. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Open User Map – Interactive Leaflet Maps: Stored Cross-Site ScriptingCVE-2026-15755 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.
Product
Open User Map – Interactive Leaflet Maps
Affected
up to 1.4.45
What to do
Affects up to 1.4.45. Update Open User Map – Interactive Leaflet Maps to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Fluent Support – Helpdesk & Customer Support Ticket System: Stored Cross-Site ScriptingCVE-2026-15665 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Fluent Support – Helpdesk & Customer Support Ticket System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'redirect-to' Shortcode Attribute in all versions up to, and including, 2.3.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The XSS payload is in a hidden attribute so it only fires in specific browsers when specific access keys are used making exploitation unlikely.
Product
Fluent Support – Helpdesk & Customer Support Ticket System
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update Fluent Support – Helpdesk & Customer Support Ticket System to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Visualizer – Tables & Charts Manager with Built-in AI Generator: Stored Cross-Site ScriptingCVE-2026-15653 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'backend-title' parameter in all versions up to, and including, 4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Visualizer – Tables & Charts Manager with Built-in AI Generator
Affected
up to 4.0.5
What to do
Affects up to 4.0.5. Update Visualizer – Tables & Charts Manager with Built-in AI Generator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Brands for WooCommerce: Stored Cross-Site ScriptingCVE-2026-15648 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Brands for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'width' Shortcode Attribute in all versions up to, and including, 3.8.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Brands for WooCommerce
Affected
up to 3.8.8
What to do
Affects up to 3.8.8. Update Brands for WooCommerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026WP Hotel Booking: Stored Cross-Site ScriptingCVE-2026-15464 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'widget_search' Shortcode Attribute in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on browsers where access keys can be used as the payload is stored in a hidden attribute.
Product
WP Hotel Booking
Affected
up to 2.3.2
What to do
Affects up to 2.3.2. Update WP Hotel Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15334 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'icon.view' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates: Stored Cross-Site ScriptingCVE-2026-15333 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cozyCustomFont' Block Attribute in all versions up to, and including, 2.2.11 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates
Affected
up to 2.2.11
What to do
Affects up to 2.2.11. Update Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 600+ Patterns, 58 Blocks & Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Firelight Lightbox: Stored DOM Cross-Site ScriptingCVE-2026-6454 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Firelight Lightbox plugin for WordPress is vulnerable to Stored DOM Cross-Site Scripting in versions up to and including 2.3.20. This is due to insufficient sanitization of the href attribute value within the FancyBox V2 PDF beforeLoad JavaScript callback generated in inc/fancybox-2.php, where this.href is string-concatenated directly into an HTML string without escaping, allowing a stored href containing entity-encoded double-quotes to break out of the data attribute and inject arbitrary event handlers into the DOM. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into pages that execute whenever a user clicks the malicious PDF link.
Product
Firelight Lightbox
Affected
up to 2.3.20
What to do
Affects up to 2.3.20. Update Firelight Lightbox to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026Post Grid Gutenberg Blocks – PostX: Stored Cross-Site ScriptingCVE-2026-15100 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'searchnoresult' Block Attribute in all versions up to, and including, 5.0.32 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is particularly concerning in a cross-privilege scenario where a Contributor creates a pending or draft post containing the malicious block attribute, which then executes arbitrary JavaScript in the browser session of an Editor or Administrator who previews that post.
Product
Post Grid Gutenberg Blocks – PostX
Affected
up to 5.0.32
What to do
Affects up to 5.0.32. Update Post Grid Gutenberg Blocks – PostX to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 24, 2026MapSVG: Stored Cross-Site ScriptingCVE-2025-9205 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The MapSVG plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.14.0. This is due to insufficient input sanitization and output escaping on user supplied attributes within the map options. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
MapSVG
Affected
up to 8.14.0
What to do
Affects up to 8.14.0. Update MapSVG to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Jul 23, 2026Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability.CVE-2024-58355 · Other software · calcom · reported by VulnCheckCritical 9.3
Cal.com (calcom/cal.diy) versions through 4.7.15 contain a stored cross-site scripting vulnerability. The single booking view (e.g., https://app.cal.com/booking/<id>) renders booking-question field labels via React's dangerouslySetInnerHTML without sanitizing or escaping user input. An attacker who can create an event type with a malicious booking-question label can inject arbitrary HTML/JavaScript that executes when a victim opens the crafted booking URL. The issue is fixed in v4.7.16.
Product
cal.diy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 23, 2026Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booCVE-2024-58353 · Other software · calcom · reported by VulnCheckCritical 9.3
Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is vulnerable to cross-site scripting (XSS) on the publicly accessible single booking view (e.g., /booking/<id>). Booking question (form field) labels are rendered via React's dangerouslySetInnerHTML without proper input sanitization or CSP, so an attacker who can create an event type with a malicious booking question label can inject arbitrary HTML/JavaScript that executes when a victim visits the booking view URL. Self-hosted instances with open registration are particularly at risk. The issue is fixed in version 4.7.16.
Product
cal.diy
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 23, 2026Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer.CVE-2026-15968 · Other software · Progress · reported by security@progress.comHigh 7.1
Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Progress MOVEit Transfer. This issue affects MOVEit Transfer: before 2025.1.5, from 2026.0.0 before 2026.0.3.
Product
MOVEit Transfer
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.progress.com
Jul 23, 2026Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to injCVE-2026-65697 · Other software · usefathom · reported by VulnCheckMedium 5.1
Fathom Lite through 1.3.1 contains a stored cross-site scripting vulnerability in the analytics collection endpoint that allows unauthenticated attackers to inject a javascript: URI into the Top Pages dashboard by supplying a crafted hostname and pathname to the unauthenticated /collect endpoint. The parseHostname and parsePathname functions perform no URI scheme validation, allowing a javascript: hostname combined with a newline-prefixed pathname to be stored and later rendered as an anchor href in the authenticated dashboard without sanitization, enabling session hijacking and full account takeover when an operator clicks the poisoned entry.
Product
fathom
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 23, 2026Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated usersCVE-2026-65696 · Other software · sct · reported by VulnCheckMedium 5.3
Overseerr through 1.35.0 contains an authorization bypass through user-controlled key vulnerability in the push subscription API that allows authenticated users to list, read, and delete any other user's push subscriptions by supplying an arbitrary userId in the path parameters. Attackers can exploit the missing ownership check in the affected handlers to access target user records without the filteredFields filter, leaking sensitive data including email addresses and plexId values.
Product
overseerr
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 23, 2026GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attaCVE-2026-48539 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the MailInsights scheduled report configuration that allows authenticated attackers to inject arbitrary web script or HTML via the report name parameter to /Archiver/MailInsights.aspx. The injected payload is stored by ReportScheduling.btnSaveReport_Click() without output encoding and is executed in the browser of the user who created the scheduled report when they subsequently view the MailInsights page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers CVE-2026-48538 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the default import settings configuration that allows authenticated attackers to inject arbitrary web script or HTML via the configured folders parameter to /Archiver/ImportSettingsWizard.ashx. The injected payload is stored by ImportSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Archive Assistant default import settings.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers tCVE-2026-48537 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File Archive Assistant configuration that allows authenticated attackers to inject arbitrary web script or HTML via the excluded extensions parameter to /Archiver/FileArchiveAssistantWizard.aspx. The injected payload is stored by FileArchiveAssistantWizard.btnSave_Click() without output encoding and is executed in the browsers of users who subsequently view the File Archive Assistant settings page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers toCVE-2026-48536 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the General Settings SMTP configuration that allows authenticated attackers to inject arbitrary web script or HTML via the SMTP server address parameter to /Archiver/GeneralSettingsWizard.aspx. The injected payload is stored by GeneralSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers tCVE-2026-48535 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Call Home proxy server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the proxy server address parameter to /Archiver/CallHomeSettingsWizard.aspx. The injected payload is stored by CallHomeSettingsWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the General Settings Additional Settings page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arCVE-2026-48534 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the IMAP Server configuration that allows authenticated attackers to inject arbitrary web script or HTML via the server URL parameter to /Archiver/ImapServerWizard.aspx. The injected payload is stored by ImapServerWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the IMAP Server configuration page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attaCVE-2026-48532 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the File History Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/FAARetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the File History Retention Policies page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to injeCVE-2026-48531 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.13 contains a stored cross-site scripting vulnerability in the Retention Policy configuration that allows authenticated attackers to inject arbitrary web script or HTML via the policy name parameter to /Archiver/RetentionPolicyWizard.aspx. The injected payload is stored by RetentionPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Retention and Spam Policies page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to CVE-2026-48530 · Other software · GFI Software · reported by VulnCheckMedium 5.1
GFI Archiver before 15.14 contains a stored cross-site scripting vulnerability in the Classification Rules configuration that allows authenticated attackers to inject arbitrary web script or HTML via the rule name and email criteria parameters to /Archiver/CategorizationPolicyWizard.aspx. The injected payload is stored by CategorizationPolicyWizard.SaveAllConfigSettings() without output encoding and is executed in the browsers of users who subsequently view the Classification Rules page.
Product
GFI Archiver
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gfi.ai vulncheck.com
Jul 23, 2026DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes.CVE-2026-65901 · Other software · cure53 · reported by VulnCheckMedium 5.1
DOMPurify through 3.4.6 contains a cross-site scripting vulnerability in IN_PLACE mode that trusts attacker-controlled nodeName on live non-form nodes. Attackers can supply hostile live DOM objects with real script children whose observable nodeName is clobbered to appear as allowed elements, causing scripts to execute when the sanitized tree is inserted into a live document.
Product
DOMPurify
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com vulncheck.com
Jul 23, 2026SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler.CVE-2026-65606 · Other software · siyuan-note · reported by VulnCheckCritical 9.4
SiYuan before v3.7.2 contains a cross-site scripting vulnerability in the siyuan:// protocol handler. When a siyuan://plugins/<name> link references a name that is not an installed plugin, the application opens a custom tab and inserts the link's icon parameter into the tab header via innerHTML without escaping it (app/src/layout/Tab.ts), allowing injection of an <img onerror=...> element. Because the SiYuan Desktop renderer runs with nodeIntegration:true, the injected JavaScript can access Node's require and call require('child_process').execSync(...), escalating the cross-site scripting into arbitrary operating-system command execution.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 23, 2026SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering.CVE-2026-65605 · Other software · siyuan-note · reported by VulnCheckCritical 9.4
SiYuan before v3.7.2 contains a stored cross-site scripting vulnerability in Attribute View (database) cell rendering. A Template column value is rendered as HTML via text/template without auto-escaping, and EscapeHTML is only applied when HasUnclosedHtmlTag returns true; because balanced self-closing tags such as <img> are skipped by that check, a payload like <img src=x onerror=...> is stored unescaped and later inserted into the page via innerHTML, executing when the database is viewed. Because the desktop renderer runs with nodeIntegration enabled, the injected script can reach require and escalate to arbitrary command execution.
Product
siyuan
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 23, 2026Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.CVE-2026-65550 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Shop Manager Cross Site Scripting (XSS) in Tabs <= 2.5 versions.
Affected
up to 2.5
What to do
Affects up to 2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.CVE-2026-65538 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Machete <= 5.2 versions.
Affected
up to 5.2
What to do
Affects up to 5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.CVE-2026-65534 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in Custom links in Elementor Image Carousel <= 1.1.1 versions.
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.CVE-2026-65533 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Smart SEO Tool <= 4.1.2 versions.
Affected
up to 4.1.2
What to do
Affects up to 4.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.CVE-2026-65528 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in BSK PDF Manager <= 3.8 versions.
Affected
up to 3.8
What to do
Affects up to 3.8. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.CVE-2026-65527 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in LIQUID SPEECH BALLOON <= 1.2.5 versions.
Affected
up to 1.2.5
What to do
Affects up to 1.2.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65522 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.CVE-2026-65519 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Author Cross Site Scripting (XSS) in Photo Gallery <= 2.7.7.29 versions.
Affected
up to 2.7.7.29
What to do
Affects up to 2.7.7.29. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.CVE-2026-65518 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Accept Donations with PayPal & Stripe <= 1.5.5 versions.
Affected
up to 1.5.5
What to do
Affects up to 1.5.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.CVE-2026-65514 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Appointment Hour Booking <= 1.5.86 versions.
Affected
up to 1.5.86
What to do
Affects up to 1.5.86. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.CVE-2026-65511 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
Affected
up to 7.5.4
What to do
Affects up to 7.5.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.CVE-2026-65510 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in PeproDev Ultimate Invoice <= 2.2.6 versions.
Affected
up to 2.2.6
What to do
Affects up to 2.2.6. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.CVE-2026-65503 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.
Affected
up to 3.0.5
What to do
Affects up to 3.0.5. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Dokan Pro: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65492 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in weDevs Dokan Pro allows Reflected XSS. This issue affects Dokan Pro: from n/a before 5.0.7.
Product
Dokan Pro
Fixed in
5.0.7
What to do
Update Dokan Pro to 5.0.7 or newer.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.CVE-2026-65483 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Author Cross Site Scripting (XSS) in HashThemes Demo Importer <= 1.4.2 versions.
Affected
up to 1.4.2
What to do
Affects up to 1.4.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026LA-Studio Element Kit for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65482 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows DOM-Based XSS.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.3.
Product
LA-Studio Element Kit for Elementor
Affected
up to 1.6.3
What to do
Affects up to 1.6.3. Update LA-Studio Element Kit for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026TheGem: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65480 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodexThemes TheGem allows DOM-Based XSS. This issue affects TheGem: from n/a before 5.12.1.1.
Product
TheGem
Fixed in
5.12.1.1
What to do
Update TheGem to 5.12.1.1 or newer.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Modula Image Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-65475 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery allows Stored XSS. This issue affects Modula Image Gallery: from 2.14.25 through 2.14.30.
Product
Modula Image Gallery
Affected
up to 2.14.30
What to do
Affects up to 2.14.30. Update Modula Image Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.CVE-2026-65473 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.
Affected
up to 4.9.12
What to do
Affects up to 4.9.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.CVE-2026-65470 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in Fluent Support <= 2.3.0 versions.
Affected
up to 2.3.0
What to do
Affects up to 2.3.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Jul 23, 2026Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.CVE-2026-65465 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Contributor Cross Site Scripting (XSS) in JetElements For Elementor <= 2.9.1.1 versions.
Affected
up to 2.9.1.1
What to do
Affects up to 2.9.1.1. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.