Base de CVEs

CVE-2026-73190 Alta · 7.1 CWE-79 18/08/2026

WordPress WPDM – Premium Packages plugin <= 7.0.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM – Premium Packages: from n/a through 7.0.5.

CVE-2026-68567 Alta · 7.1 CWE-79 18/08/2026

WordPress Convert Pro plugin <= 1.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Grids EasyTest – Simplify A/B Testing convertpro allows DOM-Based XSS.This issue affects EasyTest – Simplify A/B Testing: from n/a through 1.0.1.

CVE-2026-68565 Média · 6.5 CWE-79 18/08/2026

WordPress GeoDirectory plugin <= 2.8.172 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in GeoDirectory <= 2.8.172 versions.

CVE-2026-66667 Alta · 7.1 CWE-79 18/08/2026

WordPress Templately plugin <= 3.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

CVE-2026-66646 Média · 6.5 CWE-79 18/08/2026

WordPress WP Tab Widget plugin <= 1.2.11 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WP Tab Widget <= 1.2.11 versions.

CVE-2026-66645 Média · 6.5 CWE-79 18/08/2026

WordPress Table Of Contents Block plugin <= 1.5.0 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Table Of Contents Block <= 1.5.0 versions.

CVE-2026-66644 Média · 6.5 CWE-79 18/08/2026

WordPress Typing Effect plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Typing Effect <= 1.3.7 versions.

CVE-2026-66643 Média · 6.5 CWE-79 18/08/2026

WordPress Wufoo Shortcode plugin <= 1.55 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Wufoo Shortcode <= 1.55 versions.

CVE-2026-66641 Média · 6.5 CWE-79 18/08/2026

WordPress Video Conferencing with Zoom plugin <= 4.6.8 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Video Conferencing with Zoom <= 4.6.8 versions.

CVE-2026-66640 Média · 6.5 CWE-79 18/08/2026

WordPress Login With Ajax plugin <= 4.5.1 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.

CVE-2026-66639 Média · 6.5 CWE-79 18/08/2026

WordPress WPZOOM Forms – Contact Form plugin for Gutenberg plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.

CVE-2026-66638 Média · 6.5 CWE-79 18/08/2026

WordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.

CVE-2026-66637 Média · 6.5 CWE-79 18/08/2026

WordPress Featured Video Plus plugin <= 2.3.3 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.

CVE-2026-66636 Média · 6.5 CWE-79 18/08/2026

WordPress Wise Chat plugin <= 3.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stored XSS.This issue affects Wise Chat: from n/a through 3.4.3.

CVE-2026-66633 Alta · 7.1 CWE-79 18/08/2026

WordPress Fluent Forms Pro Add On Pack plugin < 6.2.12 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

CVE-2026-66629 Alta · 7.1 CWE-79 18/08/2026

WordPress Kirki plugin <= 6.2.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

CVE-2026-66621 Alta · 7.1 CWE-79 18/08/2026

WordPress Ultimate Dashboard Pro plugin <= 3.11.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects Ultimate Dashboard Pro: from n/a through 3.11.2.

CVE-2026-45733 Alta · 8.3 CWE-79 18/08/2026

Trilium: Stored XSS in note icon rendering leads to Remote Code Execution in Electron desktop app

Trilium Notes is a cross-platform, hierarchical note taking application focused on building large personal knowledge bases. Prior to 0.103.0, the #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and apps/client/src/services/note_autocomplete.ts, allowing a stored payload to execute automatically when a victim opens a new tab or uses Ctrl+J and, because Electron enables nodeIntegration and disables contextIsolation, run operating-system commands as the victim. This issue is fixed in version 0.103.0.

CVE-2026-32547 Alta · 7.1 CWE-79 18/08/2026

WordPress BP Better Messages plugin <= 2.15.22 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

CVE-2026-32333 Alta · 7.1 CWE-79 18/08/2026

WordPress Mayosis Core plugin <= 5.4.7 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

CVE-2026-28569 Alta · 7.1 CWE-79 18/08/2026

WordPress SSL Zen plugin <= 4.7.43 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

CVE-2026-28568 Alta · 7.1 CWE-79 18/08/2026

WordPress Quill Forms plugin <= 5.7.1 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

CVE-2026-75838 Média · 5.1 CWE-79 18/08/2026

DOMPurify before 3.4.13 Cross-Site Scripting via IN_PLACE hook

DOMPurify before 3.4.13 contains a cross-site scripting vulnerability in IN_PLACE sanitization where element-removal hooks fail to neutralize detached subtrees. Attackers can supply HTML with event handlers on descendant elements that execute after sanitization completes, even though the returned root appears clean.

CVE-2026-75834 Média · 5.4 CWE-79 18/08/2026

Grav before 2.0.14 Stored XSS via Invalid UTF-8 Byte

Grav before 2.0.14 contains a stored cross-site scripting vulnerability in the Security::detectXss() function (system/src/Grav/Common/Security.php). All XSS detection patterns use the PCRE /u (UTF-8) modifier, so a single invalid UTF-8 byte anywhere in page content causes preg_match() to return false for every pattern, silently bypassing the save-time XSS safety gate (Validation::checkSafety()). An authenticated attacker with page-edit permissions (without the security.xss_whitelist privilege) can store malicious JavaScript that executes in the browser of a visitor who views the affected page.

CVE-2026-75831 Alta · 7.6 CWE-79 18/08/2026

Grav before 2.0.15 Stored XSS via audio/video source URL

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method. The media URL fragment is concatenated unescaped into rawHtml source elements, allowing attackers to inject arbitrary HTML and JavaScript that executes in viewers' sessions.