Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 51,970

Export CSV
CVE-2026-120114

Debug Log Manager <= 2.5.2 - Unauthenticated Stored Cross-Site Scripting via 'log_js_errors' AJAX Endpoint

The Debug Log Manager – Conveniently Monitor and Inspect Errors plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'message (and pageUrl)' parameter in all versions up to, and including, 2.5.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has debug logging enabled with JS error logging active, and that the attacker can obtain the publicly emitted dlmVars.jsErrorLogging nonce — which is broadcast on every frontend page — to pass the nonce check on the unauthenticated endpoint.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Qriouslad Wordpress-extensions
Products
Debug Log Manager – Conveniently Monitor And Inspect Errors Debug Log Manager
CVE-2026-104926

WooCommerce Extra Product Options Pro <= 3.3.2 - Reflected Cross-Site Scripting via '<fieldname>_start' / '<fieldname>_end' Parameter

The WooCommerce Extra Product Options Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the '<fieldname>_start / <fieldname>_end' parameter in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This vulnerability is only exploitable on product pages where a Date & Time Range Picker extra field is configured, though the required field name is visible in the product page source and requires no prior knowledge to discover.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed
Vendors
Themehigh Wordpress-extensions
Products
Woocommerce Extra Product Options Pro Woocommerce Extra Product Options Pro
CVE-2026-113482

Media Library Assistant < 3.44 - Contributor+ Stored XSS via mla_item_parameter Shortcode Attribute

The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before outputting it in an attribute of generated links, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Media Library Assistant
CVE-2026-120597

Welcart e-Commerce Plugin paymentESCOTT.main.class.php error_page_message cross site scripting

A vulnerability was identified in Welcart e-Commerce Plugin up to 2.12.6 on WordPress. This affects the function ESCOTT_MAIN::error_page_message of the file classes/paymentESCOTT.main.class.php. Such manipulation of the argument ResponseCd leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. Upgrading to version 2.12.7 mitigates this issue. It is recommended to upgrade the affected component. The value is now escaped with esc_html() before output. The vendor was contacted early, responded in a very professional manner and quickly released a fixed version of the affected product.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Welcart Wordpress-extensions
Products
E-commerce Plugin E-commerce Plugin
CVE-2026-120552

SEO Engine <= 0.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Entity-Encoded Post Title via Strip-then-Decode in build_title()

The SEO Engine – Smart SEO with AI, Schema & Redirection for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title' parameter in all versions up to, and including, 0.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_filter_kses (applied via title_save_pre for Contributors and Authors) strips literal tag markup on save but leaves HTML-entity-encoded payloads intact in the database, meaning entity-encoded XSS payloads stored via the standard WordPress REST API (POST /wp-json/wp/v2/posts) are not neutralized before reaching the vulnerable sink.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Tigroumeow Wordpress-extensions
Products
Seo Engine – Smart Seo With Ai, Schema & Redirection For Wordpress Seo Engine
CVE-2026-120843

WordPress Posts Table with Search & Sort plugin <= 1.4.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Stored XSS.This issue affects Posts Table with Search & Sort: from n/a through 1.4.14.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Barn2 Plugins Wordpress-extensions
Products
Posts Table With Search & Sort Posts Table With Search & Sort
CVE-2026-114185

WordPress AnyWhere Elementor plugin <= 1.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows Stored XSS.This issue affects AnyWhere Elementor: from n/a through 1.3.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions Wpvibes
Products
Anywhere Elementor Anywhere Elementor
CVE-2026-124411

WordPress SureCart plugin <= 4.12.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force SureCart surecart allows Stored XSS.This issue affects SureCart: from n/a through 4.12.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Brainstormforce Wordpress-extensions
Products
Surecart Surecart
CVE-2026-104719

CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Cookieyes
CVE-2026-112243

Duplicator < 5.1.0 - Reflected XSS via 'logname' Parameter

The Duplicator WordPress plugin before 5.1.0, duplicator-pro WordPress plugin before 5.1.0 does not sanitise and escape a parameter before reflecting it on one of its administrative pages in certain configurations, leading to Reflected Cross-Site Scripting that executes in the session of a logged-in administrator who is tricked into opening a crafted link.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Duplicator Duplicator-pro
CVE-2026-115250

Text Typing < 2.2.2 - Contributor+ Stored XSS

The Text Typing WordPress plugin before 2.2.2 does not properly sanitize and escape a block attribute before storing it and later outputting it into a page element that is read and rendered by client-side script, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the browser of anyone viewing the affected page.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Text Typing
CVE-2026-118983

VikWidgetsLoader < 1.12.3 - Contributor+ Stored XSS via Speakers and Cookies Policy Blocks

The VikWidgetsLoader WordPress plugin before 1.12.3 does not sanitise or escape several block attributes before outputting them inside HTML attributes, allowing users with the Contributor role to store arbitrary JavaScript that executes in the browser of any user viewing the affected post, including the administrator or editor who reviews the pending submission.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Vikwidgetsloader
CVE-2026-54851

WordPress Contact Form by WPForms plugin <= 2.0.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive Contact Form by WPForms wpforms-lite allows Reflected XSS.This issue affects Contact Form by WPForms: from n/a through 2.0.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Awesomemotive Wordpress-extensions
Products
Contact Form By Wpforms Contact Form By Wpforms
CVE-2026-57666

WordPress WP Customer Area plugin <= 8.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila Technologies WP Customer Area customer-area allows Reflected XSS.This issue affects WP Customer Area: from n/a through 8.4.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Aguilatechnologies Wordpress-extensions
Products
Wp Customer Area Wp Customer Area
CVE-2026-115498

Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g<PAGE_ID>-website (Website contact-field)' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The nonce and authentication checks on form submission are only enforced for logged-in users, allowing unauthenticated visitors to store payloads via any page containing the [contact-form] shortcode.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed
Vendors
Wingerspeed Wordpress-extensions
Products
Slim Jetpack Slim Jetpack
CVE-2026-119468

WordPress Noptin plugin <= 4.4.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter Team Noptin newsletter-optin-box allows Stored XSS.This issue affects Noptin: from n/a through 4.4.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Noptin Newsletter Team Wordpress-extensions
Products
Noptin Noptin
CVE-2025-15701

Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise and escape some of its settings before outputting them on front-end pages, which could allow high-privilege users such as Administrators to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed, for example on a multisite network.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Easy Social Icons
CVE-2025-15702

Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS

The Cloud Blocks WordPress plugin through 1.1.8 does not perform any authorisation or sanitisation when storing block asset URLs, allowing unauthenticated users to store malicious scripts that are executed in the browser of any privileged user, such as an administrator, who opens the block editor.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Cloud Blocks
CVE-2026-105259

Easy Social Icons < 4.0.3 - Author+ Stored XSS via SVG Upload

The Easy Social Icons WordPress plugin before 4.0.3 does not sanitise SVG files, which it adds to the list of file types that may be uploaded site-wide, allowing users with the Author role and above to upload a malicious SVG containing XSS payloads. Where another installed Easy Social Icons WordPress plugin before 4.0.3 exposes an upload route to unauthenticated visitors, the same issue can be triggered without an account.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Easy Social Icons
CVE-2026-109150

WP PageNavi Style <= 1.4 - Stored XSS via CSRF

The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF check when they are saved, which could allow attackers to make a logged-in administrator store arbitrary JavaScript via a CSRF attack that is then executed in the browser of everyone who visits the site's front end.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Wordpress-extensions
Products
Wp Page Navi Style