Updated 4 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

35,119 results · page 81 of 703

Apr 4, 2026Visitor Traffic Real Time Statistics: Stored Cross-Site ScriptingCVE-2026-2936 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Visitor Traffic Real Time Statistics plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'page_title' parameter in all versions up to, and including, 8.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an admin user accesses the Traffic by Title section.
Product
Visitor Traffic Real Time Statistics
Affected
up to 8.4
What to do
Affects up to 8.4. Update Visitor Traffic Real Time Statistics to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales: Stored Cross-Site ScriptingCVE-2026-0626 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpf_optin_form' shortcode in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping of the 'button_icon' parameter. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update WPFunnels – Easy Funnel Builder To Optimize Buyer Journeys And Get More Leads & Sales to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026Widgets for Social Photo Feed: Stored Cross-Site ScriptingCVE-2026-5425 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Widgets for Social Photo Feed plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'feed_data' parameter keys in all versions up to, and including, 1.7.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Widgets for Social Photo Feed
Affected
up to 1.7.9
What to do
Affects up to 1.7.9. Update Widgets for Social Photo Feed to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2026WP Travel Engine – Tour Booking Plugin – Tour Operator Software: Stored Cross-Site ScriptingCVE-2026-2437 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wte_trip_tax' shortcode in all versions up to, and including, 6.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Travel Engine – Tour Booking Plugin – Tour Operator Software
Affected
up to 6.7.5
What to do
Affects up to 6.7.5. Update WP Travel Engine – Tour Booking Plugin – Tour Operator Software to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible: Insecure Direct Object ReferenceCVE-2026-4896 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.7.25 via multiple AJAX actions including `wcfm_modify_order_status`, `delete_wcfm_article`, `delete_wcfm_product`, and the article management controller due to missing validation on user-supplied object IDs. This makes it possible for authenticated attackers, with Vendor-level access and above, to modify the status of any order, delete or modify any post/product/page, regardless of ownership.
Product
WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible
Affected
up to 6.7.25
What to do
Affects up to 6.7.25. Update WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 4, 2026ElementsKit Elementor Addons and Templates: Stored Cross-Site ScriptingCVE-2026-2600 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The ElementsKit Elementor Addons and Templates plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ekit_tab_title' parameter in the Simple Tab widget in all versions up to, and including, 3.7.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
ElementsKit Elementor Addons and Templates
Affected
up to 3.7.9
What to do
Affects up to 3.7.9. Update ElementsKit Elementor Addons and Templates to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026WP Shortcodes Plugin - Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-0738 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the su_carousel shortcode in all versions up to, and including, 7.4.8. This is due to insufficient input sanitization and output escaping in the 'su_slide_link' attachment meta field. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin - Shortcodes Ultimate
Affected
up to 7.4.8
What to do
Affects up to 7.4.8. Update WP Shortcodes Plugin - Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Apr 4, 2026WP Shortcodes Plugin - Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-0737 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin - Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.7. This is due to insufficient input sanitization and output escaping in the 'src' attribute of the su_lightbox shortcode. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin - Shortcodes Ultimate
Affected
up to 7.4.7
What to do
Affects up to 7.4.7. Update WP Shortcodes Plugin - Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org research.cleantalk.org
Apr 4, 2026Royal Addons for Elementor: Stored Cross-Site ScriptingCVE-2026-0664 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Royal Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_text' parameter in all versions up to, and including, 1.7.1049 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Royal Addons for Elementor
Affected
up to 1.7.1049
What to do
Affects up to 1.7.1049. Update Royal Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026Simple Shopping Cart: Stored Cross-Site ScriptingCVE-2026-0552 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Shopping Cart plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wpsc_display_product' shortcode in all versions up to, and including, 5.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Shopping Cart
Affected
up to 5.2.4
What to do
Affects up to 5.2.4. Update Simple Shopping Cart to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership: Stored Cross-Site ScriptingCVE-2025-15064 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the user description field in all versions up to, and including, 2.11.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The vulnerability is only exploitable when "HTML support for user description" is enabled in Ultimate Member settings.
Product
Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership
Affected
up to 2.11.1
What to do
Affects up to 2.11.1. Update Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com wordfence.com
Apr 4, 2026Xpro Addons — 140+ Widgets for Elementor: Stored Cross-Site ScriptingCVE-2025-13368 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Pricing Widget's 'onClick Event' setting in all versions up to, and including, 1.4.20 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Xpro Addons — 140+ Widgets for Elementor
Affected
up to 1.4.20
What to do
Affects up to 1.4.20. Update Xpro Addons — 140+ Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026Xpro Addons — 140+ Widgets for Elementor: Stored Cross-Site ScriptingCVE-2026-2949 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Xpro Addons — 140+ Widgets for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Icon Box widget in versions up to, and including, 1.4.24 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Xpro Addons — 140+ Widgets for Elementor
Affected
up to 1.4.24
What to do
Affects up to 1.4.24. Update Xpro Addons — 140+ Widgets for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 4, 2026Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem: Stored Cross-Site ScriptingCVE-2026-2924 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'imageLoad' parameter in versions up to, and including, 3.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem
Affected
up to 3.4.6
What to do
Affects up to 3.4.6. Update Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Apr 2, 2026Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to exCVE-2026-30252 · Other software · Interzen · reported by MITREMedium 6.1
Multiple reflected cross-site scripting (XSS) vulnerabilities in the login.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda and red_url parameters.
Product
Zencrm
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Apr 2, 2026A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execCVE-2026-30251 · Other software · Interzen · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the login_newpwd.php endpoint of Interzen Consulting S.r.l ZenShare Suite v17.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted URL injected into the codice_azienda parameter.
Product
Zenshare Suite
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/.CVE-2026-34823 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/password/web/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/.CVE-2026-34822 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the new_cert_name parameter to /manage/ca/certificate/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/.CVE-2026-34821 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/vpnauthentication/user/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/.CVE-2026-34820 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/ipsec/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi.CVE-2026-34819 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the REMARK parameter to /cgi-bin/openvpnclient.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/.CVE-2026-34818 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/localdomains/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi.CVE-2026-34817 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the ADDRESS BCC parameter to /cgi-bin/smtprouting.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/.CVE-2026-34816 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the domain parameter to /manage/smtpscan/domainrouting/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi.CVE-2026-34815 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the DOMAIN parameter to /cgi-bin/smtpdomains.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi.CVE-2026-34814 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the group parameter to /cgi-bin/proxygroup.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi.CVE-2026-34813 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the user parameter to /cgi-bin/proxyuser.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi.CVE-2026-34812 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the mimetypes parameter to /cgi-bin/proxypolicy.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi.CVE-2026-34811 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/xtaccess.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi.CVE-2026-34810 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/vpnfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi.CVE-2026-34809 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/zonefw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi.CVE-2026-34808 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/outgoingfw.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi.CVE-2026-34807 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/incoming.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi.CVE-2026-34806 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/snat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi.CVE-2026-34805 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/dnat.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/.CVE-2026-34804 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the dscp parameter to /manage/qos/rules/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/.CVE-2026-34803 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the name parameter to /manage/qos/classes/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi.CVE-2026-34802 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark user ham spam parameter to /cgi-bin/salearn.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/.CVE-2026-34801 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dhcp/fixed_leases/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi.CVE-2026-34800 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the NAME parameter to /cgi-bin/uplinkeditor.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/.CVE-2026-34799 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /manage/dnsmasq/hosts/. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi.CVE-2026-34798 · Other software · Endian · reported by VulnCheckMedium 5.1
Endian Firewall version 3.3.25 and prior allow stored cross-site scripting (XSS) via the remark parameter to /cgi-bin/routing.cgi. An authenticated attacker can inject arbitrary JavaScript that is stored and executed when other users view the affected page.
Product
Endian Firewall
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record help.endian.com vulncheck.com
Apr 2, 2026MSTW League Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-34890 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mark O’Donnell MSTW League Manager allows DOM-Based XSS.This issue affects MSTW League Manager: from n/a through 2.10.
Product
MSTW League Manager
Affected
up to 2.10
What to do
Affects up to 2.10. Update MSTW League Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Apr 1, 2026IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting.CVE-2026-1243 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.4
IBM Content Navigator 3.0.15, 3.1.0, and 3.2.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Product
Content Navigator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Apr 1, 2026IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting.CVE-2025-66484 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.5
IBM Aspera Shares 1.9.9 through 1.11.0 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Product
Aspera Shares
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com
Apr 1, 2026Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute CVE-2026-29598 · Other software · reported by MITREMedium 5.4
Multiple stored cross-site scripting (XSS) vulnerabilities in the submit_add_user.asp endpoint of DDSN Interactive Acora CMS v10.7.1 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the First Name and Last Name parameters.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Apr 1, 2026King Addons for Elementor: Multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilitiesCVE-2025-13535 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The King Addons for Elementor plugin for WordPress is vulnerable to multiple Contributor+ DOM-Based Stored Cross-Site Scripting vulnerabilities in all versions up to, and including, 51.1.38. This is due to insufficient input sanitization and output escaping across multiple widgets and features. The plugin uses esc_attr() and esc_url() within JavaScript inline event handlers (onclick attributes), which allows HTML entities to be decoded by the DOM, enabling attackers to break out of the JavaScript context. Additionally, several JavaScript files use unsafe DOM manipulation methods (template literals, .html(), and window.location.href with unvalidated URLs) with user-controlled data. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts via Elementor widget settings that execute when a user accesses the injected page or when an administrator previews the page in Elementor's editor. The vulnerability was partially patched in version 5.1.51.
Product
King Addons for Elementor
Affected
up to 51.1.38
What to do
Affects up to 51.1.38. Update King Addons for Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Apr 1, 2026A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URLCVE-2026-3877 · Other software · VertiGIS · reported by vulnerability@ncsc.chHigh 7.3
A reflected cross-site scripting (XSS) vulnerability in the dashboard search functionality of the VertiGIS FM solution allows attackers to craft a malicious URL, that if visited by an authenticated victim, will execute arbitrary JavaScript in the victim's context. Such a URL could be delivered through various means, for instance, by sending a link or by tricking victims to visit a page crafted by the attacker.
Product
VertiGIS FM
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record redguard.ch
Apr 1, 2026Ultimate Addons for WPBakery Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-34889 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force Ultimate Addons for WPBakery Page Builder allows DOM-Based XSS.This issue affects Ultimate Addons for WPBakery Page Builder: from n/a before 3.21.4.
Product
Ultimate Addons for WPBakery Page Builder
Fixed in
3.21.4
What to do
Update Ultimate Addons for WPBakery Page Builder to 3.21.4 or newer.
Full record and what to do →NVD record patchstack.com
Mar 31, 2026XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post CVE-2026-35057 · Other software · XenForo · reported by VulnCheckMedium 5.1
XenForo before 2.3.10 and before 2.2.19 is vulnerable to stored cross-site scripting (XSS) in structured text mentions, primarily affecting legacy profile post content. An attacker can inject malicious scripts through crafted mentions that are stored and executed when other users view the content.
Product
XenForo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com xenforo.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.