2026

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in WPVibes WP Mail Lo

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iova.Mihai SliceWP

A vulnerability in Kedro version 1.2.0 allows an attacker to exploit path traversal by providing a crafted version strin

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to be

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to b

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.0.0 to be

WordPress Sliced Invoices 3.8.2 contains an authenticated SQL injection vulnerability that allows authenticated attacker

Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Inco

Improper Control of Interaction Frequency vulnerability in MIA Technology Inc. Pizzy Library allows Flooding. This issu

An out-of-bounds read vulnerability was found in the VA JPEG decoder in GStreamer's gst-plugins-bad. The JPEG parser rea

A signed integer overflow vulnerability was found in GStreamer's VMnc decoder. A crafted VMnc stream with large cursor d

A vulnerability was found in the GStreamer RealMedia demuxer (gst-plugins-ugly). When processing a RealMedia (.rm) file,

A flaw was found in GStreamer's RealMedia demuxer in the gst-plugins-ugly package. When processing a RealMedia file cont

Unauthenticated Cross Site Scripting (XSS) in iRobots.txt SEO <= 1.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Okay Toolkit <= 2.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Eli&#039;s WordCents adSense Widget with Analytics <= 1.3.03.27 versions.

Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.

Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.14.2 versions.

Unauthenticated Cross Site Scripting (XSS) in WooCommerce Product Table Lite <= 4.6.3 versions.

Unauthenticated Cross Site Scripting (XSS) in CformsII <= 15.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Simply Schedule Appointments <= 1.6.10.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Contact Form to Any API <= 3.0.3 versions.

Subscriber Broken Authentication in FunnelKit Automations <= 3.7.3 versions.

Unauthenticated Cross Site Scripting (XSS) in ManageWP Worker <= 4.9.31 versions.

Unauthenticated Cross Site Scripting (XSS) in Social Slider Feed <= 2.3.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Paid Member Subscriptions <= 2.17.3 versions.

Subscriber Insecure Direct Object References (IDOR) in EventPrime <= 4.3.0.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Notification for Telegram <= 3.5 versions.

Unauthenticated Cross Site Scripting (XSS) in Coupon Affiliates <= 7.5.3 versions.

Subscriber Broken Authentication in AutomatorWP <= 5.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.0.0 versions.

Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Time Slots Booking Form <= 1.2.46 versions.

Unauthenticated Cross Site Scripting (XSS) in Favicon Rotator <= 1.2.11 versions.

Unauthenticated Cross Site Scripting (XSS) in Classified Listing <= 5.3.8 versions.

Subscriber Cross Site Scripting (XSS) in EventPrime <= 4.3.2.1 versions.

Unauthenticated Cross Site Scripting (XSS) in AutomatorWP <= 5.7.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

Unauthenticated Cross Site Scripting (XSS) in Post SMTP <= 3.6.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Quiz And Survey Master <= 11.1.2 versions.

Unauthenticated Cross Site Scripting (XSS) in MW WP Form <= 5.1.3 versions.

Unauthenticated Cross Site Scripting (XSS) in Stop Spammers <= 2026.3 versions.

Unauthenticated Cross Site Scripting (XSS) in HollerBox <= 2.3.10.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Funnel Builder by FunnelKit <= 3.15.0.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Drag and Drop Multiple File Upload – Contact Form 7 <= 1.3.9.7 versions.

Unauthenticated Cross Site Scripting (XSS) in SEO Redirection <= 9.17 versions.

Unauthenticated Cross Site Scripting (XSS) in Min Max Step Quantity Limits Manager for WooCommerce <= 5.2.2 versions.

Unauthenticated Cross Site Scripting (XSS) in Pods <= 3.3.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Media LIbrary Assistant <= 3.35 versions.

OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards