Home / CVEs
CVE Database
Published vulnerabilities with severity, known exploitation and official sources.
CVE-2026-86798
High · 8.8
CWE-79 Oct 11, 2026
HootBoard <= 3.1.4 - Unauthenticated Stored XSS via Board Configuration REST Endpoint
The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.
CVE-2026-84261
High · 8.8
CWE-79 Oct 11, 2026
click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Stored XSS via post_notifications
The click5 CRM add-on to Contact Form 7 WordPress plugin through 1.0.4 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
CVE-2026-84260
High · 8.8
CWE-79 Oct 11, 2026
click5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
The click5 CRM add-on to Gravity Forms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
CVE-2026-84259
High · 8.8
CWE-79 Oct 11, 2026
click5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Stored XSS via post_notifications
The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
CVE-2026-84258
High · 8.8
CWE-79 Oct 11, 2026
click5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Stored XSS via post_notifications
The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not sanitise and escape content submitted through an unauthenticated endpoint before outputting it back in an admin page, leading to Stored XSS which could be used against high privilege users such as admin.
CVE-2026-81156
Medium · 6.8
CWE-79 Oct 11, 2026
Robo Gallery < 5.2.6 - Contributor+ Stored XSS via Gallery Settings
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its gallery settings before outputting them on the gallery edit screen, allowing users with the Contributor role and above to store JavaScript that executes in the context of an administrator who opens the gallery for editing.
CVE-2026-81155
Medium · 6.8
CWE-79 Oct 11, 2026
Robo Gallery < 5.2.6 - Author+ Stored XSS via Gallery Search Label
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape a gallery setting before outputting it on a frontend page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing a gallery, including administrators.
CVE-2026-81154
Medium · 6.8
CWE-79 Oct 11, 2026
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Alt Text
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape image alt text before outputting it in one of its gallery layouts, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected gallery, including administrators.
CVE-2026-81153
Medium · 6.8
CWE-79 Oct 11, 2026
Robo Gallery < 5.2.6 - Author+ Stored XSS via Image Overlay Effect Meta
The Robo Gallery WordPress plugin before 5.2.6 does not sanitise and escape some of its image settings before outputting them in a gallery page, allowing users with the Author role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of any visitor viewing the gallery, including administrators, even where the unfiltered_html capability is disallowed such as on multisite.
CVE-2026-12980
Medium · 6.8
CWE-79 Oct 11, 2026
Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable
The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.
CVE-2026-103305
High · 8.8
CWE-79 Oct 11, 2026
Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update
The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.
CVE-2026-78534
High · 7.1
CWE-79 Oct 10, 2026
WordPress Educavo theme <= 3.4.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Educavo <= 3.4.2 versions.
CVE-2026-78532
High · 7.1
CWE-79 Oct 10, 2026
WordPress LMS theme <= 8.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LMS <= 8.3 versions.
CVE-2026-62116
High · 7.1
CWE-79 Oct 10, 2026
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
CVE-2026-62100
High · 7.1
CWE-79 Oct 10, 2026
WordPress KuteShop theme <= 4.2.9 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in KuteShop <= 4.2.9 versions.
CVE-2026-62095
High · 7.1
CWE-79 Oct 10, 2026
WordPress Biolife theme <= 3.2.3 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Biolife <= 3.2.3 versions.
CVE-2026-62093
High · 7.1
CWE-79 Oct 10, 2026
WordPress TechOne theme <= 3.0.3 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in TechOne <= 3.0.3 versions.
CVE-2026-62091
High · 7.1
CWE-79 Oct 10, 2026
WordPress Armania theme <= 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Armania <= 1.4.8 versions.
CVE-2026-62082
High · 7.1
CWE-79 Oct 10, 2026
WordPress Pin WP theme <= 7.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Pin WP <= 7.0 versions.
CVE-2026-62064
High · 7.1
CWE-79 Oct 10, 2026
WordPress Ambed theme <= 1.0.0 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Ambed <= 1.0.0 versions.
CVE-2026-62037
High · 7.1
CWE-79 Oct 10, 2026
WordPress Document Embedder plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Document Embedder <= 2.4.0 versions.
CVE-2026-62034
High · 7.1
CWE-79 Oct 10, 2026
WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Before After Image Comparison – Image comparison for WP <= 1.1.21 versions.
CVE-2026-62027
High · 7.1
CWE-79 Oct 10, 2026
WordPress Team Section Block plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Team Section Block <= 2.0.4 versions.
CVE-2026-57742
High · 7.1
CWE-79 Oct 10, 2026
WordPress Kids Planet theme <= 2.2.14.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Group Kids Planet allows Reflected XSS.
This issue affects Kids Planet: from n/a through 2.2.14.2.
CVE-2026-42715
High · 7.1
CWE-79 Oct 10, 2026
WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.