CVE Intelligence
Home / CVEs

CVE Database

Published vulnerabilities with severity, known exploitation and official sources.

Severity
Clear

10.084 result(s)

Export this search: RSS · CSV · STIX
CVE-2026-39745 High · 7.1 CWE-79 Oct 6, 2026
WordPress Contact Form to DB by BestWebSoft plugin <= 1.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Contact Form to DB by BestWebSoft <= 1.7.6 versions.
CVE-2026-39731 High · 7.1 CWE-79 Oct 6, 2026
WordPress Database for CF7 plugin <= 1.2.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Database for CF7 <= 1.2.6 versions.
CVE-2026-39727 Medium · 6.5 CWE-79 Oct 6, 2026
WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in WC Fields Factory <= 4.1.12 versions.
CVE-2026-39726 High · 7.1 CWE-79 Oct 6, 2026
WordPress Lumise Product Designer plugin <= 2.1.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Lumise Product Designer <= 2.1.1 versions.
CVE-2026-39724 High · 7.1 CWE-79 Oct 6, 2026
WordPress HTTP Requests Manager plugin <= 1.3.11 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in HTTP Requests Manager <= 1.3.11 versions.
CVE-2026-39722 High · 7.1 CWE-79 Oct 6, 2026
WordPress WPLMS theme <= 4.972 - Reflected Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WPLMS <= 4.972 versions.
CVE-2026-39720 High · 7.1 CWE-79 Oct 6, 2026
WordPress Mapster WP Maps plugin <= 2.0.4 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Mapster WP Maps <= 2.0.4 versions.
CVE-2026-32577 High · 7.1 CWE-79 Oct 6, 2026
WordPress Frontend File Manager plugin <= 23.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Frontend File Manager <= 23.6 versions.
CVE-2026-32575 High · 7.1 CWE-79 Oct 6, 2026
WordPress SUMO Affiliates Pro plugin <= 11.7.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in SUMO Affiliates Pro <= 11.7.0 versions.
CVE-2026-32574 High · 7.1 CWE-79 Oct 6, 2026
WordPress Smart Forms plugin <= 2.6.104 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in EDGARROJAS Smart Forms smart-forms allows DOM-Based XSS.This issue affects Smart Forms: from n/a through 2.6.104.
CVE-2026-32572 High · 7.1 CWE-79 Oct 6, 2026
WordPress WP User Frontend Pro plugin <= 4.2.13 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP User Frontend Pro <= 4.2.13 versions.
CVE-2026-32571 Medium · 6.5 CWE-79 Oct 6, 2026
WordPress Ohio Extra plugin <= 3.6.8 - Cross Site Scripting (XSS) vulnerability
Subscriber Cross Site Scripting (XSS) in Ohio Extra <= 3.6.8 versions.
CVE-2026-32570 High · 7.1 CWE-79 Oct 6, 2026
WordPress Progressify - Progressive Web App (PWA) plugin <= 1.6.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Progressify - Progressive Web App (PWA) <= 1.6.0 versions.
CVE-2026-32569 High · 7.1 CWE-79 Oct 6, 2026
WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
CVE-2026-105879 Medium · 6.5 CWE-79 Oct 6, 2026
WordPress JetElements For Elementor plugin <= 2.9.2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.2.
CVE-2026-105809 Medium · 4.3 CWE-79 Oct 6, 2026
SourceCodester Simple Student Information System Profile Field register.php cross site scripting
A vulnerability was identified in SourceCodester Simple Student Information System 1.0. This issue affects some unknown processing of the file /register.php of the component Profile Field Handler. The manipulation of the argument firstname/lastname leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used.
CVE-2026-105808 Low · 3.5 CWE-79 Oct 6, 2026
SourceCodester Simple Student Information System searchresults.php clean cross site scripting
A vulnerability was determined in SourceCodester Simple Student Information System 1.0. This vulnerability affects the function clean of the file searchresults.php. Executing a manipulation of the argument searchbox can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.
CVE-2026-105061 High · 7.1 CWE-79 Oct 6, 2026
WordPress WP Mailster plugin <= 1.9.0.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in WP Mailster <= 1.9.0.0 versions.
CVE-2026-104814 High · 7.1 CWE-79 Oct 6, 2026
WordPress Form Block plugin <= 1.8.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Form Block <= 1.8.1 versions.
CVE-2026-104672 High · 7.1 CWE-79 Oct 6, 2026
WordPress GiveWP plugin <= 4.17.0 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in GiveWP <= 4.17.0 versions.
CVE-2026-104670 High · 7.1 CWE-79 Oct 6, 2026
WordPress LearnPress plugin <= 4.4.9 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in LearnPress <= 4.4.9 versions.
CVE-2026-104395 High · 7.1 CWE-79 Oct 6, 2026
WordPress picu plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in picu <= 3.10.1 versions.
CVE-2026-104394 High · 7.1 CWE-79 Oct 6, 2026
WordPress Charitable plugin <= 1.8.12.3 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting (XSS) in Charitable <= 1.8.12.3 versions.
CVE-2026-103346 High · 7.1 CWE-79 Oct 6, 2026
WordPress Payflex Payment Gateway plugin <= 2.7.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tomlister Payflex Payment Gateway payflex-payment-gateway allows Reflected XSS.This issue affects Payflex Payment Gateway: from n/a through 2.7.1.
CVE-2026-75962 High · 7.2 CWE-79 Oct 6, 2026
Post SMTP <= 4.0.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user_email' Parameter (Multisite Registration → Failed Email Log)
The Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_email' parameter in all versions up to, and including, 4.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable without authentication on WordPress Multisite installations with public registration enabled, as WordPress accepts email addresses containing numeric HTML character references that Post SMTP's stricter validator rejects, persisting the attacker-controlled address verbatim to the email log via the failed-send exception message.