CVE-2026-42715

WordPress Photo Gallery by 10Web plugin <= 1.8.47 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Photo Gallery by 10Web <= 1.8.47 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42711

WordPress Slider by 10Web plugin <= 1.2.63 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Slider by 10Web <= 1.2.63 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42709

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42699

WordPress FV Player 8 plugin <= 8.1.8 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in FV Player 8 <= 8.1.8 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42695

WordPress FV Flowplayer Video Player plugin <= 7.5.54.7212 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV Flowplayer Video Player fv-wordpress-flowplayer allows Stored XSS.This issue affects FV Flowplayer Video Player: from n/a through 7.5.54.7212.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42632

WordPress Qode Real Estate plugin <= 1.1.7.3 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Qode Real Estate <= 1.1.7.3 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-42631

WordPress Qode Music plugin <= 2.1.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Qode Music <= 2.1.8.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-40803

WordPress Jotform – AI Chatbot plugin <= 3.8.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Jotform &#8211; AI Chatbot <= 3.8.2 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39800

WordPress Additional Order Filters for WooCommerce plugin <= 1.24 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in Additional Order Filters for WooCommerce <= 1.24 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-39799

WordPress WP File Download plugin <= 6.3.6 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting (XSS) in WP File Download <= 6.3.6 versions.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-12980

Post Snippets <= 4.2.4 - Contributor+ Stored XSS via Snippet Variable

The Post Snippets WordPress plugin through 4.2.4 does not properly escape variable values substituted into snippets before outputting them, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when the content is viewed.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-105870

WordPress WP Associate Post R2 plugin <= 5.0.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Delight Star Inc. WP Associate Post R2 wp-associate-post-r2 allows Reflected XSS.This issue affects WP Associate Post R2: from n/a through 5.0.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-103305

Prenotazioni <= 1.7.5 - Unauthenticated Stored XSS via Settings Update

The Prenotazioni WordPress plugin through 1.7.5 does not have authorisation and CSRF checks when saving its settings, and does not escape some of them when outputting them, allowing unauthenticated users to perform Stored Cross-Site Scripting attacks against administrators and site visitors.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-102388

WordPress Forminator plugin <= 1.57.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Forminator forminator allows Stored XSS.This issue affects Forminator: from n/a through 1.57.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-8787

Portabilis i-Diario Registro das atividades registros-de-conteudos-por-disciplina cross site scripting

A security flaw has been discovered in Portabilis i-Diario up to 1.5.0. The affected element is an unknown function of the file /registros-de-conteudos-por-disciplina/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos results in cross site scripting. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The patch is identified as 821342cd8d952e8bd214cb16145da785a92f5681. A patch should be applied to remediate this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Portabilis

Products

I-diario

CVE-2025-8786

Portabilis i-Diario Registro das atividades registros-de-conteudos-por-areas-de-conhecimento cross site scripting

A vulnerability was identified in Portabilis i-Diario up to 1.5.0. Impacted is an unknown function of the file /registros-de-conteudos-por-areas-de-conhecimento/ of the component Registro das atividades. The manipulation of the argument Registro de atividades/Conteúdos leads to cross site scripting. The attack may be initiated remotely. The exploit is publicly available and might be used. The identifier of the patch is 821342cd8d952e8bd214cb16145da785a92f5681. It is suggested to install a patch to address this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Portabilis

Products

I-diario

CVE-2025-8511

Portabilis i-Diario Observações diario-de-observacoes cross site scripting

A vulnerability was found in Portabilis i-Diario 1.5.0. Impacted is an unknown function of the file /diario-de-observacoes/ of the component Observações. Performing a manipulation of the argument Descrição results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The patch is named 821342cd8d952e8bd214cb16145da785a92f5681. It is suggested to install a patch to address this issue. The vendor confirms: "Audited values shown on that screen are now sanitized on output: only a minimal allowlist of basic formatting tags is kept and all attributes are stripped, so injected <script> or event-handler markup is removed and displayed as inert text."

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Portabilis

Products

I-diario

CVE-2026-87780

LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated Stored XSS via Shipping Rules

The LTL Freight Quotes WordPress plugin before 4.2.19 does not sanitise and escape values submitted through an unauthenticated endpoint before storing them and outputting them back in an administrative page, leading to Stored XSS which will execute in the session of any administrator viewing it.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-107323

Gallery PhotoBlocks 1.3.5 - Contributor+ Stored XSS

The Gallery PhotoBlocks WordPress plugin before 1.3.6 does not sanitize and escape one of its gallery settings before outputting it into an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of anyone who views a page containing the gallery, including administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-104754

Rank Math SEO < 1.0.280 - Admin+ Stored XSS via Redirection Source URL

The Rank Math SEO WordPress plugin before 1.0.280 does not escape a stored redirection source value before outputting it in an administrative list view, allowing users who can manage redirections (Administrators by default) to store JavaScript that executes in the session of any user who later opens that view, including a Super Administrator on multisite.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

—

Products

—