CVE-2026-15180

Tracking Code Manager <= 2.6.0 - Reflected Cross-Site Scripting via 'TCM_ErrorMessages'

The Tracking Code Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'TCM_ErrorMessages' POST Parameter in all versions up to, and including, 2.6.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-108484

WordPress Best Payments Plugin for WP plugin <= 4.6.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPManageNinja Best Payments Plugin for WP wp-payment-form allows Stored XSS.This issue affects Best Payments Plugin for WP: from n/a through 4.6.27.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107867

WordPress JetProductTables plugin <= 1.2.4 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetProductTables jet-product-tables allows Reflected XSS.This issue affects JetProductTables: from n/a through 1.2.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107751

Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'user_name' Parameter

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'user_name' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save-time sanitizer mbw_htmlspecialchars2() is ineffective against this vector because the exploit payload relies solely on unquoted HTML attribute syntax using only spaces, alphanumerics, and characters such as =, parentheses, and dots — none of which are escaped.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107631

Record of Consent Extension for Complianz <= 2.5 - Unauthenticated Stored Cross-Site Scripting via 'uid' Parameter

The Record of Consent Extension for Complianz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'uid' parameter in all versions up to, and including, 2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is possible because the enforcing nonce is emitted via wp_localize_script on wp_enqueue_scripts and is therefore readable by any unauthenticated frontend visitor, and no capability or role check gates the write path.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-102562

AcyMailing <= 11.1.0 - Unauthenticated Stored Cross-Site Scripting via 'customField[]' Parameter

The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar() sanitizer, whose HTML-tag stripper only matches complete tags (requiring a closing '>'), together with SubscriberInsertion::replaceUserInformation() and the archive view template, which substitute the stored subscriber field value into the mail body and emit it without HTML encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses the online-archive URL for the poisoned subscriber, including administrators who click the plugin-generated link in the Subscribers → History screen.

CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-9373

PeproDev Branches Map <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PeproDev Branches Map plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.0.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-0609

Logo Slider <= 4.9.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'logo-slider' Shortcode

The Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image alt text in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping in the 'logo-slider' shortcode. This makes it possible for authenticated attackers, with author level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Logichunt Wordpress

Products

Logo Slider – Logo Carousel, Logo Showcase & Client Logo Slider Plugin Wordpress

CVE-2026-84891

Security vulnerability affects the Windows GIM component as part of IBM Guardium Data Protection

IBM Guardium Data Protection 12.0, 12.1, and 12.2 could allow a remote attacker to obtain sensitive information due to use of hard-coded credentials.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Ibm

Products

Guardium Data Protection

CVE-2026-97030

Recognize yield as regexp preceder keyword in html/template

A trusted template author may have previously written a valid template wherein the use of the 'yield' keyword would not be correctly escaped. We now ensure that valid keyword uses are escaped and non-keyword uses are not escaped.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Html/template

CVE-2026-97020

PO/MO Editor <= 1.4.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'podata' Parameter

The PO/MO Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'podata' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is loaded as a replacement .po/.mo translation file via the plugin's own load_textdomain_mofile filter, causing WordPress to serve the attacker-written translation in place of the original core strings.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-95807

FV Player 8 <= 8.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute

The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'synopsis' Shortcode Attribute in all versions up to, and including, 8.1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Unauthenticated visitors can also exploit this vulnerability when the 'Parse Vimeo and YouTube links' (parse_comments) setting is enabled, as this causes the plugin to process shortcodes within comment text.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-94448

Reset context tracking on consecutive template expressions in html/template

When a JavaScript template literal contains consecutive expressions, the context tracking state was not properly reset upon entering a new expression. We now ensure that template-literal expression entries correctly reset context variables so all subsequent regular expression literals are accurately recognized and escaped.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Go Standard Library

Products

Html/template

CVE-2026-110849

n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview

n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the owner, and act with their session.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n

CVE-2026-108920

SourceCodester Drug Recommendation System Admin Record Tables user_record.php cross site scripting

A security vulnerability has been detected in SourceCodester Drug Recommendation System 1.0. This affects an unknown function of the file Admin/user_record.php of the component Admin Record Tables. Such manipulation of the argument name/email leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Sourcecodester

Products

Drug Recommendation System

CVE-2026-108908

Netcore NR268 Web UI l7_call_board_user_set.cgi eval cross site scripting

A vulnerability was identified in Netcore NR268 1.7.121109. Affected by this vulnerability is the function eval of the file /router/l7_call_board_user_set.cgi of the component Web UI. Such manipulation of the argument title/note/URL/content leads to cross site scripting. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Netcore

Products

Nr268

CVE-2026-108584

FunnyWolf Viper config hard-coded credentials

A security flaw has been discovered in FunnyWolf Viper up to 3.1.11. The affected element is an unknown function of the file /root/viper/.git/config. Performing a manipulation results in hard-coded credentials. Remote exploitation of the attack is possible. The exploit has been released to the public and may be used for attacks.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Funnywolf

Products

Viper

CVE-2026-107756

Meow Lightbox <= 5.6.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Output Buffering parser noise substitution via comment body + display_name

The Meow Lightbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name + comment' parameter in all versions up to, and including, 5.6.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is only exploitable when the plugin's Output Buffering option is enabled (disabled by default), and requires the attacker to have at least one previously approved comment on the site so that subsequent comments are auto-approved by WordPress core.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107422

WordPress WP w3all phpBB plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in axew3.com WP w3all phpBB wp-w3all-phpbb-integration allows Stored XSS.This issue affects WP w3all phpBB: from n/a through 3.1.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103425

Booking Package <= 1.7.29 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'id' Shortcode Attribute

The Booking Package plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter in all versions up to, and including, 1.7.29 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—