Vulnerability database

15,357 results · page 13 of 308

• Oct 9, 2026FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-42695 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.

  Product

  FV Flowplayer Video Player

  Affected

  up to 7.5.54.7212

  What to do

  Affects up to 7.5.54.7212. Update FV Flowplayer Video Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Pond: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94066 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SpabRice Pond pond allows Reflected XSS.This issue affects Pond: from n/a through 2.6.1.

  Product

  Pond

  Affected

  up to 2.6.1

  What to do

  Affects up to 2.6.1. Update Pond to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Education Center: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94063 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeREX Education Center education allows Reflected XSS.This issue affects Education Center: from n/a through 3.6.12.

  Product

  Education Center

  Affected

  up to 3.6.12

  What to do

  Affects up to 3.6.12. Update Education Center to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Whistle - Sports Club: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94061 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Designthemes Whistle - Sports Club whistle-sports-club allows Reflected XSS.This issue affects Whistle - Sports Club: from n/a through 4.2.

  Product

  Whistle - Sports Club

  Affected

  up to 4.2

  What to do

  Affects up to 4.2. Update Whistle - Sports Club to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Voldor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94060 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Voldor voldor allows Reflected XSS.This issue affects Voldor: from n/a through 1.0.0.

  Product

  Voldor

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Voldor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Ogency: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94059 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.

  Product

  Ogency

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Ogency to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Treck: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94058 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Treck treck allows Reflected XSS.This issue affects Treck: from n/a through 1.0.0.

  Product

  Treck

  Affected

  up to 1.0.0

  What to do

  Affects up to 1.0.0. Update Treck to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026WPFunnels: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62029 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPFunnels Team WPFunnels wpfunnels allows Stored XSS.This issue affects WPFunnels: from n/a through 3.13.3.

  Product

  WPFunnels

  Affected

  up to 3.13.3

  What to do

  Affects up to 3.13.3. Update WPFunnels to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026WP Associate Post R2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105870 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.

  Product

  WP Associate Post R2

  Affected

  up to 5.0.1

  What to do

  Affects up to 5.0.1. Update WP Associate Post R2 to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026AcyMailing SMTP Newsletter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105318 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Datasolution AcyMailing SMTP Newsletter acymailing allows Reflected XSS.This issue affects AcyMailing SMTP Newsletter: from n/a through 11.1.0.

  Product

  AcyMailing SMTP Newsletter

  Affected

  up to 11.1.0

  What to do

  Affects up to 11.1.0. Update AcyMailing SMTP Newsletter to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Html5 Audio Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62039 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Html5 Audio Player html5-audio-player allows Stored XSS.This issue affects Html5 Audio Player: from n/a through 2.8.8.

  Product

  Html5 Audio Player

  Affected

  up to 2.8.8

  What to do

  Affects up to 2.8.8. Update Html5 Audio Player to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96761 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart e-Commerce usc-e-shop allows Reflected XSS.This issue affects Welcart e-Commerce: from n/a through 2.12.3.

  Product

  Welcart e-Commerce

  Affected

  up to 2.12.3

  What to do

  Affects up to 2.12.3. Update Welcart e-Commerce to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026NEX-Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96607 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Basix NEX-Forms nex-forms-express-wp-form-builder allows Reflected XSS.This issue affects NEX-Forms: from n/a through 9.3.1.

  Product

  NEX-Forms

  Affected

  up to 9.3.1

  What to do

  Affects up to 9.3.1. Update NEX-Forms to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026FiboSearch: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96553 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.

  Product

  FiboSearch

  Affected

  up to 1.34.1

  What to do

  Affects up to 1.34.1. Update FiboSearch to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Simple Payment: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-96332 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in yalla ya! Simple Payment simple-payment allows Reflected XSS.This issue affects Simple Payment: from n/a through 2.5.4.

  Product

  Simple Payment

  Affected

  up to 2.5.4

  What to do

  Affects up to 2.5.4. Update Simple Payment to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Media LIbrary Assistant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95609 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41.

  Product

  Media LIbrary Assistant

  Affected

  up to 3.41

  What to do

  Affects up to 3.41. Update Media LIbrary Assistant to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026HUSKY: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95608 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.

  Product

  HUSKY

  Affected

  up to 1.4.3.2

  What to do

  Affects up to 1.4.3.2. Update HUSKY to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Search in Place: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95598 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.

  Product

  Search in Place

  Affected

  up to 1.5.5

  What to do

  Affects up to 1.5.5. Update Search in Place to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026ShopBuilder – Elementor WooCommerce Builder Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95596 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Reflected XSS.This issue affects ShopBuilder – Elementor WooCommerce Builder Addons: from n/a through 3.4.1.

  Product

  ShopBuilder – Elementor WooCommerce Builder Addons

  Affected

  up to 3.4.1

  What to do

  Affects up to 3.4.1. Update ShopBuilder – Elementor WooCommerce Builder Addons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-95591 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp VikBooking Hotel Booking Engine & PMS vikbooking allows Reflected XSS.This issue affects VikBooking Hotel Booking Engine & PMS: from n/a through 1.8.14.

  Product

  VikBooking Hotel Booking Engine & PMS

  Affected

  up to 1.8.14

  What to do

  Affects up to 1.8.14. Update VikBooking Hotel Booking Engine & PMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Salon booking system: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94668 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dimitri Grassi Salon booking system salon-booking-system allows Reflected XSS.This issue affects Salon booking system: from n/a through 10.31.5.

  Product

  Salon booking system

  Affected

  up to 10.31.5

  What to do

  Affects up to 10.31.5. Update Salon booking system to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026JetReviews: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94667 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetReviews jet-reviews allows Stored XSS.This issue affects JetReviews: from n/a through 3.1.2.

  Product

  JetReviews

  Affected

  up to 3.1.2

  What to do

  Affects up to 3.1.2. Update JetReviews to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Classified Listing: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94665 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid Classified Listing classified-listing allows Stored XSS.This issue affects Classified Listing: from n/a through 6.1.2.

  Product

  Classified Listing

  Affected

  up to 6.1.2

  What to do

  Affects up to 6.1.2. Update Classified Listing to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026JetBlog: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94661 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlog jet-blog allows Reflected XSS.This issue affects JetBlog: from n/a through 2.4.10.

  Product

  JetBlog

  Affected

  up to 2.4.10

  What to do

  Affects up to 2.4.10. Update JetBlog to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026UsersWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94641 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan UsersWP userswp allows Reflected XSS.This issue affects UsersWP: from n/a through 1.2.73.

  Product

  UsersWP

  Affected

  up to 1.2.73

  What to do

  Affects up to 1.2.73. Update UsersWP to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026BlockStrap Page Builder - Bootstrap Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94632 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Stiofan BlockStrap Page Builder - Bootstrap Blocks blockstrap-page-builder-blocks allows Reflected XSS.This issue affects BlockStrap Page Builder - Bootstrap Blocks: from n/a through 0.1.58.

  Product

  BlockStrap Page Builder - Bootstrap Blocks

  Affected

  up to 0.1.58

  What to do

  Affects up to 0.1.58. Update BlockStrap Page Builder - Bootstrap Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Betheme: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94415 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Muffingroup Betheme betheme allows Reflected XSS.This issue affects Betheme: from n/a through 28.5.8.

  Product

  Betheme

  Affected

  up to 28.5.8

  What to do

  Affects up to 28.5.8. Update Betheme to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Sassy Social Share: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94170 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support Sassy Social Share sassy-social-share allows Reflected XSS.This issue affects Sassy Social Share: from n/a through 3.3.79.

  Product

  Sassy Social Share

  Affected

  up to 3.3.79

  What to do

  Affects up to 3.3.79. Update Sassy Social Share to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Kubio AI Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94167 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Extend Themes Kubio AI Page Builder kubio allows Reflected XSS.This issue affects Kubio AI Page Builder: from n/a through 2.9.3.

  Product

  Kubio AI Page Builder

  Affected

  up to 2.9.3

  What to do

  Affects up to 2.9.3. Update Kubio AI Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026UpSolution Core: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94166 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through 8.44.

  Product

  UpSolution Core

  Affected

  up to 8.44

  What to do

  Affects up to 8.44. Update UpSolution Core to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Grand Restaurant: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94161 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGoods Grand Restaurant grandrestaurant allows Reflected XSS.This issue affects Grand Restaurant: from n/a before 7.0.11.

  Product

  Grand Restaurant

  Fixed in

  7.0.11

  What to do

  Update Grand Restaurant to 7.0.11 or newer.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Total Donations: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94159 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KlbTheme Total Donations totaldonations allows Stored XSS.This issue affects Total Donations: from n/a through 2.0.5.

  Product

  Total Donations

  Affected

  up to 2.0.5

  What to do

  Affects up to 2.0.5. Update Total Donations to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Gloria Admin Panel: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-94158 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bkninja Gloria Admin Panel gloria-admin-panel allows Reflected XSS.This issue affects Gloria Admin Panel: from n/a through 1.3.

  Product

  Gloria Admin Panel

  Affected

  up to 1.3

  What to do

  Affects up to 1.3. Update Gloria Admin Panel to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026JetBlocks For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62049 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetBlocks For Elementor jet-blocks allows Stored XSS.This issue affects JetBlocks For Elementor: from n/a through 1.5.2.1.

  Product

  JetBlocks For Elementor

  Affected

  up to 1.5.2.1

  What to do

  Affects up to 1.5.2.1. Update JetBlocks For Elementor to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 9, 2026Ocean Pro Demos and Ocean eComm Treasure Box: Stored Cross-Site ScriptingCVE-2026-81929 · WordPress plugins & themes · reported by WordfenceHigh 7.2

  The Ocean Pro Demos and Ocean eComm Treasure Box plugins for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.5.4, and 1.8.0, respectively, due to insufficient authorization, input sanitization, and output escaping in the Popup Builder's save_popup_content AJAX action. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into a published Gutenberg popup that will execute whenever a user accesses a page on which the popup is configured to display. A valid premium license, the Popup Builder module, and at least one published Gutenberg popup configured for display are required.

  Product

  Ocean Pro Demos and Ocean eComm Treasure Box

  Affected

  up to 1.5.4

  What to do

  Affects up to 1.5.4. Update Ocean Pro Demos and Ocean eComm Treasure Box to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recorddocs.oceanwp.orgdocs.oceanwp.org

• Oct 9, 2026AWP Classifieds: Does not validate the type of files extracted from an uploaded ZIP archive during its listing-import featureCVE-2025-15700 · WordPress plugins & themes · reported by WPScanHigh 8.8

  The AWP Classifieds WordPress plugin before 4.4.9 does not validate the type of files extracted from an uploaded ZIP archive during its listing-import feature, allowing users with the AWP Classifieds WordPress plugin before 4.4.9's management capability to upload arbitrary PHP files to a publicly accessible, network-shared directory and achieve remote code execution.

  Product

  AWP Classifieds

  Fixed in

  4.4.9

  What to do

  Update AWP Classifieds to 4.4.9 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 8, 2026aBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-40804 · WordPress plugins & themes · reported by PatchstackHigh 7.1

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kodezen LLC aBlocks ablocks allows Reflected XSS.This issue affects aBlocks: from n/a through 2.16.0.

  Product

  aBlocks

  Affected

  up to 2.16.0

  What to do

  Affects up to 2.16.0. Update aBlocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026Zotpress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-27420 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Seaborn Zotpress zotpress allows Stored XSS.This issue affects Zotpress: from n/a through 7.4.4.

  Product

  Zotpress

  Affected

  up to 7.4.4

  What to do

  Affects up to 7.4.4. Update Zotpress to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026WP Plugin Info Card: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-62127 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MediaRon LLC WP Plugin Info Card wp-plugin-info-card allows Stored XSS.This issue affects WP Plugin Info Card: from n/a through 6.3.5.

  Product

  WP Plugin Info Card

  Affected

  up to 6.3.5

  What to do

  Affects up to 6.3.5. Update WP Plugin Info Card to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026Gutenberg Blocks by Kadence Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105890 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web / StellarWP Gutenberg Blocks by Kadence Blocks kadence-blocks allows Stored XSS.This issue affects Gutenberg Blocks by Kadence Blocks: from n/a through 3.7.12.

  Product

  Gutenberg Blocks by Kadence Blocks

  Affected

  up to 3.7.12

  What to do

  Affects up to 3.7.12. Update Gutenberg Blocks by Kadence Blocks to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026Robo Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105887 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Robosoft Robo Gallery robo-gallery allows Stored XSS.This issue affects Robo Gallery: from n/a through 5.1.6.

  Product

  Robo Gallery

  Affected

  up to 5.1.6

  What to do

  Affects up to 5.1.6. Update Robo Gallery to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026MasterStudy LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105079 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes MasterStudy LMS masterstudy-lms-learning-management-system allows Stored XSS.This issue affects MasterStudy LMS: from n/a through 3.7.52.

  Product

  MasterStudy LMS

  Affected

  up to 3.7.52

  What to do

  Affects up to 3.7.52. Update MasterStudy LMS to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026WP Store Locator: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-105078 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3.

  Product

  WP Store Locator

  Affected

  up to 3.0.3

  What to do

  Affects up to 3.0.3. Update WP Store Locator to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026ShortPixel Image Optimizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2026-103070 · WordPress plugins & themes · reported by PatchstackMedium 6.5

  Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.

  Product

  ShortPixel Image Optimizer

  Affected

  up to 6.5.6

  What to do

  Affects up to 6.5.6. Update ShortPixel Image Optimizer to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.

  Full record and what to do →NVD recordpatchstack.com

• Oct 8, 2026Easy Digital Downloads: Does not consult the site's user registration setting before creating a WordPress accountCVE-2026-105190 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The Easy Digital Downloads WordPress plugin before 3.7.1 does not consult the site's user registration setting before creating a WordPress account, allowing unauthenticated users to create an account and receive a logged-in session even when registration is disabled. The created account receives the site's default role.

  Product

  Easy Digital Downloads

  Fixed in

  3.7.1

  What to do

  Update Easy Digital Downloads to 3.7.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 8, 2026TutorStarter: Does not respect the site's user registration setting in one of its AJAX registration handlersCVE-2026-104671 · WordPress plugins & themes · reported by WPScanMedium 5.3

  The TutorStarter WordPress theme before 4.0.4 does not respect the site's user registration setting in one of its AJAX registration handlers, allowing unauthenticated visitors to create WordPress user accounts even when user registration is disabled.

  Product

  TutorStarter

  Fixed in

  4.0.4

  What to do

  Update TutorStarter to 4.0.4 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 8, 2026SMS Alert: Does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbersCVE-2026-94258 · WordPress plugins & themes · reported by WPScanLow 2.7

  The SMS Alert WordPress plugin before 4.0.1 does not check that the acting administrator is allowed to manage the selected users before returning their stored billing phone numbers, allowing an administrator of one site on a multisite network to disclose the phone numbers of users who belong to other sites on that network. This affects multisite only, and requires the SMS Alert WordPress plugin before 4.0.1's gateway credentials to be stored on the acting administrator's own site.

  Product

  SMS Alert

  Fixed in

  4.0.1

  What to do

  Update SMS Alert to 4.0.1 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 8, 2026Wallet System for WooCommerce: Does not verify that the user submitting a wallet transfer owns the wallet being debitedCVE-2026-94245 · WordPress plugins & themes · reported by WPScanMedium 6.5

  The Wallet System for WooCommerce WordPress plugin before 2.8.0 does not verify that the user submitting a wallet transfer owns the wallet being debited, allowing any authenticated user, including one with only the Subscriber role, to move an arbitrary user's wallet balance, including an administrator's, into an account they control.

  Product

  Wallet System for WooCommerce

  Fixed in

  2.8.0

  What to do

  Update Wallet System for WooCommerce to 2.8.0 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 8, 2026BackWPup: Does not properly restrict the destination path of files extracted during a backup restoreCVE-2026-86828 · WordPress plugins & themes · reported by WPScanMedium 6.6

  The BackWPup WordPress plugin before 5.7.7 does not properly restrict the destination path of files extracted during a backup restore when its fallback archive library is used, allowing high-privileged users to write files outside the intended restore directory, potentially leading to remote code execution.

  Product

  BackWPup

  Fixed in

  5.7.7

  What to do

  Update BackWPup to 5.7.7 or newer.

  Full record and what to do →NVD recordwpscan.com

• Oct 8, 2026Image Photo Gallery Final Tiles Grid: Does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script blockCVE-2026-104646 · WordPress plugins & themes · reported by WPScanMedium 6.8

  The Image Photo Gallery Final Tiles Grid WordPress plugin before 3.6.14 does not sanitise several gallery configuration values that can be overridden through its gallery shortcode before printing them into an inline script block, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes in the session of anyone viewing the post, including an administrator previewing a pending submission. No gallery ownership is required: any gallery that already exists on the site can be referenced.

  Product

  Image Photo Gallery Final Tiles Grid

  Fixed in

  3.6.14

  What to do

  Update Image Photo Gallery Final Tiles Grid to 3.6.14 or newer.

  Full record and what to do →NVD recordwpscan.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.