Updated 30 min ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

33added in the last 30 days

547new WordPress flaws this week

391,964entries in the database

35,119 results · page 82 of 703

Mar 31, 2026XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts.CVE-2026-35055 · Other software · XenForo · reported by VulnCheckMedium 5.1
XenForo before 2.3.9 and before 2.2.18 is vulnerable to cross-site scripting (XSS) related to lightbox usage in posts. An attacker can inject malicious scripts that execute when users interact with post content displayed in the lightbox.
Product
XenForo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulncheck.com xenforo.com
Mar 31, 2026XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering.CVE-2026-35054 · Other software · XenForo · reported by VulnCheckMedium 5.1
XenForo before 2.3.9 is vulnerable to stored cross-site scripting (XSS) related to BB code rendering. An attacker can inject malicious scripts through BB code that are stored and executed when other users view the content.
Product
XenForo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record vulncheck.com xenforo.com
Mar 31, 2026WP Shortcodes Plugin — Shortcodes Ultimate: Stored Cross-Site ScriptingCVE-2026-2480 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'max_width' attribute of the `su_box` shortcode in all versions up to, and including, 7.4.10 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
WP Shortcodes Plugin — Shortcodes Ultimate
Affected
up to 7.4.10
What to do
Affects up to 7.4.10. Update WP Shortcodes Plugin — Shortcodes Ultimate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2026A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied CVE-2026-3468 · Network & remote access · SonicWall · reported by PSIRT@sonicwall.comMedium 4.8
A stored Cross-Site Scripting (XSS) vulnerability has been identified in the SonicWall Email Security appliance due to improper neutralization of user-supplied input during web page generation, allowing a remote authenticated attacker as admin user to potentially execute arbitrary JavaScript code.
Product
Email Security
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record psirt.global.sonicwall.com
Mar 31, 2026Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component.CVE-2025-62184 · Other software · Pegasystems · reported by security@pega.comMedium 4.8
Pega Platform versions 8.1.0 through 25.1.0 are affected by a Stored Cross-site Scripting vulnerability in a user interface component. Requires an administrative user and given extensive access rights, impact to Confidentiality is low and Integrity is none.
Product
Pega Infinity
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record support.pega.com
Mar 31, 2026Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitCVE-2026-33276 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 8.6
Stored cross-site scripting (XSS) in Checkmk 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create hosts or services to execute arbitrary JavaScript in the browsers of other users performing searches in the Unified Search feature.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com
Mar 31, 2026Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject CVE-2026-20915 · Other software · Checkmk GmbH · reported by security@checkmk.comHigh 8.5
Stored cross-site scripting (XSS) in Checkmk version 2.5.0 (beta) before 2.5.0b2 allows authenticated users with permission to create pending changes to inject malicious JavaScript into the Pending Changes sidebar, which will execute in the browsers of other users viewing the sidebar.
Product
Checkmk
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record checkmk.com
Mar 31, 2026Query Monitor – The developer tools panel for: Reflected Cross-Site ScriptingCVE-2026-4267 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Query Monitor – The developer tools panel for WordPress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘$_SERVER['REQUEST_URI']’ parameter in all versions up to, and including, 3.20.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Query Monitor – The developer tools panel for
Affected
up to 3.20.3
What to do
Affects up to 3.20.3. Update Query Monitor – The developer tools panel for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2026Kubio AI Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-34887 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder allows Stored XSS.This issue affects Kubio AI Page Builder: from n/a through 2.7.0.
Product
Kubio AI Page Builder
Affected
up to 2.7.0
What to do
Affects up to 2.7.0. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com
Mar 31, 2026Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redactCVE-2026-3107 · Other software · Teampass · reported by cve-coordination@incibe.esCritical 9.3
Stored Cross-Site Scripting (XSS) in Teampass versions prior to 3.1.5.16, affecting the password manager's password import functionality at the endpoint 'redacted/index.php?page=items'. The application fails to properly sanitize and encode user-input data during the import process, allowing malicious JavaScript payloads to be persistently stored in the database. When other users view the imported passwords, the payload is automatically executed in their browsers, resulting in a stored XSS condition at the endpoint 'redacted/index.php?page=items'. Exploiting this vulnerability allows an attacker to execute arbitrary JavaScript code in the context of multiple users and the administrator, which can lead to session hijacking, credential theft, privilege abuse, and compromise of application integrity.
Product
Teampass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 31, 2026Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the lCVE-2026-3106 · Other software · Teampass · reported by cve-coordination@incibe.esCritical 9.3
Blind Cross-Site Scripting (XSS) in Teampass, versions prior to 3.1.5.16, within the password manager login functionality in the 'contraseña' parameter of the login form 'redacted/index.php'. During failed authentication attempts, the application does not properly clean or encode the information entered by the user in the username field. As a result, arbitrary JavaScript code is automatically executed in the administrator's browser when viewing failed login entries, resulting in a blind XSS condition.
Product
Teampass
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 31, 2026Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104.CVE-2025-41357 · Other software · Anon Proxy Server · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. It affects 'host' parameter in '/diagdns.php' endpoint.
Product
Anon Proxy Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 31, 2026Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104.CVE-2025-41356 · Other software · Anon Proxy Server · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. It affects 'host' parameter in '/diagconnect.php' endpoint.
Product
Anon Proxy Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 31, 2026Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104.CVE-2025-41355 · Other software · Anon Proxy Server · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross-Site Scripting (XSS) vulnerability in Anon Proxy Server v0.104. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending him/her a malicious URL. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on behalf of the user. It affects 'port' and 'proxyPort' parameters in '/anon.php' endpoint.
Product
Anon Proxy Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 31, 2026A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x throCVE-2025-10553 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A Stored Cross-site Scripting (XSS) vulnerability affecting Factory Resource Management in DELMIA Factory Resource Manager from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Product
DELMIA Factory Resource Manager
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com
Mar 31, 2026A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x throCVE-2025-10551 · Other software · Dassault Systèmes · reported by 3DS.Information-Security@3ds.comHigh 8.7
A Stored Cross-site Scripting (XSS) vulnerability affecting Document Management in ENOVIA Collaborative Industry Innovator from Release 3DEXPERIENCE R2023x through Release 3DEXPERIENCE R2025x allows an attacker to execute arbitrary script code in user's browser session.
Product
ENOVIA Collaborative Industry Innovator
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record 3ds.com
Mar 31, 2026Ibtana – WordPress Website Builder: Stored Cross-Site ScriptingCVE-2026-1834 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Ibtana – WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ive' shortcode in all versions up to, and including, 1.2.5.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Ibtana – WordPress Website Builder
Affected
up to 1.2.5.7
What to do
Affects up to 1.2.5.7. Update Ibtana – WordPress Website Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 31, 2026Loco Translate: Reflected Cross-Site ScriptingCVE-2026-4146 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The Loco Translate plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘update_href’ parameter in all versions up to, and including, 2.8.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
Loco Translate
Affected
up to 2.8.2
What to do
Affects up to 2.8.2. Update Loco Translate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 30, 2026Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HCVE-2026-4794 · Other software · PaperCut · reported by eb41dac7-0af8-4f84-9f6d-0272772514f4Low 2.1
Multiple cross-site scripting (XSS) vulnerabilities in PaperCut NG/MF before 25.0.10 allow authenticated administrator users to inject arbitrary web script or HTML code via different UI fields. This could be used to compromise other admininistrator's sessions or perform unauthorized actions via the administrator's authenticated context (e.g. requires an active login session).
Product
PaperCut NG/MF
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record papercut.com
Mar 30, 2026Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitatiCVE-2026-27508 · Other software · Smoothwall · reported by VulnCheckMedium 5.1
Smoothwall Express versions prior to 3.1 Update 13 contain a reflected cross-site scripting vulnerability in the /redirect.cgi endpoint due to improper sanitation of the url parameter. Attackers can craft malicious URLs with javascript: schemes that execute arbitrary JavaScript in victims' browsers when clicked through the unsanitized link.
Product
Express
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.smoothwall.org vulncheck.com
Mar 30, 2026Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitaCVE-2026-26352 · Other software · Smoothwall · reported by VulnCheckMedium 5.1
Smoothwall Express versions prior to 3.1 Update 13 contain a stored cross-site scripting vulnerability in the /cgi-bin/vpnmain.cgi script due to improper sanitation of the VPN_IP parameter. Authenticated attackers can inject arbitrary JavaScript through VPN configuration settings that executes when the affected page is viewed by other users.
Product
Express
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record community.smoothwall.org vulncheck.com
Mar 30, 2026Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.0 allow attackers toCVE-2026-30082 · Other software · reported by MITREMedium 6.1
Multiple stored cross-site scripting (XSS) vulnerabilities in the Edit feature of the Software Package List page of IngEstate Server v11.14.0 allow attackers to execute arbitrary web scripts or HTML via injecting a crafted payload into the About application, What's news, or Release note parameters.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com ingenico.com
Mar 28, 2026Twentig: Stored Cross-Site ScriptingCVE-2026-2602 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Twentig plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'featuredImageSizeWidth' parameter in versions up to, and including, 1.9.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Twentig
Affected
up to 1.9.7
What to do
Affects up to 1.9.7. Update Twentig to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 28, 2026Quads Ads Manager for Google AdSense: Stored Cross-Site ScriptingCVE-2026-2595 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The Quads Ads Manager for Google AdSense plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.98.1 due to insufficient input sanitization and output escaping of multiple ad metadata parameters. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Quads Ads Manager for Google AdSense
Affected
up to 2.0.98.1
What to do
Affects up to 2.0.98.1. Update Quads Ads Manager for Google AdSense to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Mar 27, 2026A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu.CVE-2026-5010 · Other software · Sanoma · reported by cve-coordination@incibe.esMedium 5.1
A reflected Cross-Site Scripting (XSS) vulnerability has been discovered in Clickedu. This vulnerability allows an attacker to execute JavaScript code in the victim’s browser by sending them a malicious URL using the endpoint “/user.php/”. This vulnerability can be exploited to steal sensitive user data, such as session cookies, or to perform actions on the user’s behalf.
Product
Clickedu
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 27, 2026A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionality.CVE-2025-61190 · Other software · Lyrasis · reported by MITREMedium 6.1
A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in DSpace JSPUI 6.5 within the search/discover filtering functionality. The vulnerability exists due to improper sanitization of user-supplied input via the filter_type_1 parameter.
Product
Dspace
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com gist.github.com
Mar 27, 2026ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arCVE-2026-32859 · Other software · Bytedance Inc. · reported by VulnCheckMedium 5.1
ByteDance DeerFlow versions prior to commit 5dbb362 contain a stored cross-site scripting vulnerability in the artifacts API that allows attackers to execute arbitrary scripts by uploading malicious HTML or script content as artifacts. Attackers can store malicious content that executes in the browser context when users view artifacts, leading to session compromise, credential theft, and arbitrary script execution.
Product
DeerFlow
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 27, 2026Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality.CVE-2026-25100 · Other software · Bludit · reported by cvd@cert.plMedium 4.8
Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim visits the URL of the uploaded resource. The uploaded resource itself is accessible without authentication. The vendor was notified early about this vulnerability, but stopped responding in the middle of coordination. All versions up to 3.18.2 are considered to be vulnerable, future versions might also be vulnerable.
Product
Bludit
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record cert.pl github.com
Mar 27, 2026Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows StoreCVE-2026-3457 · Other software · Thalesgroup · reported by psirt@thalesgroup.comHigh 7
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Thales Sentinel LDK Runtime on Windows allows Stored XSS. This issue affects Sentinel LDK Runtime: before 10.22.
Product
Sentinel LDK Runtime
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record supportportal.thalesgroup.com
Mar 27, 2026WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability.CVE-2026-33559 · WordPress plugins & themes · reported by vultures@jpcert.or.jpMedium 5.1
WordPress Plugin "OpenStreetMap" provided by MiKa contains a cross-site scripting vulnerability. On the site with the affected version of the plugin enabled, a logged-in user with a page-creating/editing privilege can embed some malicious script with a crafted HTTP request. When a victim user accesses this page, the script may be executed in the user's web browser.
What to do
Update the plugin to the newest version.
Full record and what to do →NVD record jvn.jp wordpress.org
Mar 26, 2026Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, iCVE-2026-33664 · Other software · kestra-io · reported by GitHubHigh 7.3
Kestra is an open-source, event-driven orchestration platform Versions up to and including 1.3.3 render user-supplied flow YAML metadata fields — description, inputs[].displayName, inputs[].description — through the Markdown.vue component instantiated with html: true. The resulting HTML is injected into the DOM via Vue's v-html without any sanitization. This allows a flow author to embed arbitrary JavaScript that executes in the browser of any user who views or interacts with the flow. This is distinct from GHSA-r36c-83hm-pc8j / CVE-2026-29082, which covers only FilePreview.vue rendering .md files from execution outputs. The present finding affects different components, different data sources, and requires significantly less user interaction (zero-click for input.displayName). As of time of publication, it is unclear if a patch is available.
Product
kestra
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 26, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XCVE-2026-3529 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Google Analytics GA4 allows Cross-Site Scripting (XSS).This issue affects Google Analytics GA4: from 0.0.0 before 1.1.14.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Mar 26, 2026Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSSCVE-2026-3528 · Websites & servers · reported by mlhess@drupal.orgMedium 6.1
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Calculation Fields allows Cross-Site Scripting (XSS).This issue affects Calculation Fields: from 0.0.0 before 1.0.4.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record drupal.org
Mar 26, 2026A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in CVE-2026-29969 · Other software · Workflowfirst · reported by MITREMedium 6.1
A cross-site scripting (XSS) vulnerability in the wff_cols_pref.css.aspx endpoint of staffwiki v7.0.1.19219 allows attackers to execute arbitrary Javascript in the context of the user's browser via a crafted HTTP request.
Product
Staffwiki
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 26, 2026Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.CVE-2026-30162 · Other software · Auntvt · reported by MITREMedium 6.1
Cross Site Scripting (xss) vulnerability in Timo 2.0.3 via crafted links in the title field.
Product
Timo
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 26, 2026A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the contCVE-2026-29934 · Other software · Lightcms Project · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /admin/menus component of Lightcms v2.0 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referer value in the request header.
Product
Lightcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com
Mar 26, 2026A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the cCVE-2026-29933 · Other software · Yzmcms · reported by MITREMedium 6.1
A reflected cross-site scripting (XSS) vulnerability in the /index/login.html component of YZMCMS v7.4 allows attackers to execute arbitrary Javascript in the context of the user's browser via modifying the referrer value in the request header.
Product
Yzmcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Mar 26, 2026SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended scripCVE-2026-28298 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 5.9
SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
Product
SolarWinds Observability Self-Hosted
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Mar 26, 2026SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended scripCVE-2026-28297 · Other software · SolarWinds · reported by psirt@solarwinds.comMedium 6.1
SolarWinds Observability Self-Hosted was found to be affected by a stored cross-site scripting vulnerability, which when exploited, can lead to unintended script execution.
Product
SolarWinds Observability Self-Hosted
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record documentation.solarwinds.com solarwinds.com
Mar 26, 2026Complianz – GDPR/CCPA Cookie Consent: Stored Cross-Site ScriptingCVE-2026-2389 · WordPress plugins & themes · reported by WordfenceMedium 4.9
The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 7.4.4.2. This is due to the `revert_divs_to_summary` function replacing `”` HTML entities with literal double-quote characters (`"`) in post content without subsequent sanitization. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the injected page. The Classic Editor plugin is required to be installed and activated in order to exploit this vulnerability.
Product
Complianz – GDPR/CCPA Cookie Consent
Affected
up to 7.4.4.2
What to do
Affects up to 7.4.4.2. Update Complianz – GDPR/CCPA Cookie Consent to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026Fluent Booking: Stored Cross-Site ScriptingCVE-2026-2231 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Fluent Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via multiple parameters in all versions up to, and including, 2.0.01 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Fluent Booking
Affected
up to 2.0.01
What to do
Affects up to 2.0.01. Update Fluent Booking to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller.CVE-2025-41027 · Other software · GDTaller · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'app_recuperarclave.php'.
Product
GDTaller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 26, 2026Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller.CVE-2025-41026 · Other software · GDTaller · reported by cve-coordination@incibe.esMedium 5.1
Reflected Cross Site Scripting (XSS) vulnerabilities in GDTaller. These vulnerabilities allows an attacker execute JavaScript code in the victim's browser by sending a malicious URL in 'site' parameter in 'app_login.php'.
Product
GDTaller
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record incibe.es
Mar 26, 2026DSGVO snippet for Leaflet Map and its Extensions: Stored Cross-Site ScriptingCVE-2026-4389 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The DSGVO snippet for Leaflet Map and its Extensions plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `leafext-cookie-time` and `leafext-delete-cookie` shortcodes in all versions up to, and including, 3.1. This is due to insufficient input sanitization and output escaping on user supplied attributes (`unset`, `before`, `after`). This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
DSGVO snippet for Leaflet Map and its Extensions
Affected
up to 3.1
What to do
Affects up to 3.1. Update DSGVO snippet for Leaflet Map and its Extensions to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026Blackhole for Bad Bots: Stored Cross-Site ScriptingCVE-2026-4329 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Blackhole for Bad Bots plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent HTTP header in all versions up to and including 3.8. This is due to insufficient input sanitization and output escaping. The plugin uses sanitize_text_field() when capturing bot data (which strips HTML tags but does not escape HTML entities like double quotes), then stores the data via update_option(). When an administrator views the Bad Bots log page, the stored data is output directly into HTML input value attributes (lines 75-83) without esc_attr() and into HTML span content without esc_html(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the Blackhole Bad Bots admin page.
Product
Blackhole for Bad Bots
Affected
up to 3.8
What to do
Affects up to 3.8. Update Blackhole for Bad Bots to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026Simple Download Counter: Stored Cross-Site ScriptingCVE-2026-4278 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Simple Download Counter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sdc_menu' shortcode in all versions up to, and including, 2.3. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes, specifically the 'text' and 'cat' attributes. The 'text' attribute is output directly into HTML content on line 159 without any escaping (e.g., esc_html()). The 'cat' attribute is used unescaped in HTML class attributes on lines 135 and 157 without esc_attr(). This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
Simple Download Counter
Affected
up to 2.3
What to do
Affects up to 2.3. Update Simple Download Counter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026ShortPixel Image Optimizer: Stored Cross-Site ScriptingCVE-2026-4335 · WordPress plugins & themes · reported by WordfenceMedium 5.4
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3. This is due to insufficient output escaping in the getEditorPopup() function and its corresponding media-popup.php template. Specifically, the attachment's post_title is retrieved from the database via get_post() in AjaxController.php (line 435) and passed directly to the view template (line 449), where it is rendered into an HTML input element's value attribute without esc_attr() escaping (media-popup.php line 139). Since WordPress allows Authors to set arbitrary attachment titles (including double-quote characters) via the REST API, a malicious author can craft an attachment title that breaks out of the HTML attribute and injects arbitrary JavaScript event handlers. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts that execute whenever a higher-privileged user (such as an administrator) opens the ShortPixel AI editor popup (Background Removal or Image Upscale) for the poisoned attachment.
Product
ShortPixel Image Optimizer
Affected
up to 6.4.3
What to do
Affects up to 6.4.3. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026BWL Advanced FAQ Manager Lite: Stored Cross-Site ScriptingCVE-2026-4075 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The BWL Advanced FAQ Manager Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'baf_sbox' shortcode in all versions up to and including 1.1.1. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes such as 'sbox_id', 'sbox_class', 'placeholder', 'highlight_color', 'highlight_bg', and 'cont_ext_class'. These attributes are directly interpolated into HTML element attributes without any esc_attr() escaping in the baf_sbox() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Product
BWL Advanced FAQ Manager Lite
Affected
up to 1.1.1
What to do
Affects up to 1.1.1. Update BWL Advanced FAQ Manager Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 26, 2026FloristPress for Woo – Customize your eCommerce store for your Florist: Reflected Cross-Site ScriptingCVE-2026-1986 · WordPress plugins & themes · reported by WordfenceMedium 6.1
The FloristPress for Woo – Customize your eCommerce store for your Florist plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'noresults' parameter in all versions up to, and including, 7.8.2 due to insufficient input sanitization and output escaping on the user supplied 'noresults' parameter. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Product
FloristPress for Woo – Customize your eCommerce store for your Florist
Affected
up to 7.8.2
What to do
Affects up to 7.8.2. Update FloristPress for Woo – Customize your eCommerce store for your Florist to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org plugins.trac.wordpress.org
Mar 25, 2026IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to stored cross-site scripting.CVE-2026-2485 · Other software · IBM · reported by psirt@us.ibm.comMedium 4.8
IBM Infosphere Information Server 11.7.0.0 through 11.7.1.6 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session.
Product
InfoSphere Information Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record ibm.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.