CVE-2026-125807

WordPress HT Mega plugin <= 3.2.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in HTMega HT Mega ht-mega-for-elementor allows Stored XSS.This issue affects HT Mega: from n/a through 3.2.8.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125824

WordPress WP Go Maps plugin <= 10.1.10 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Go Maps WP Go Maps wp-google-maps allows Stored XSS.This issue affects WP Go Maps: from n/a through 10.1.10.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-124012

Dixell/Copeland XWEB EVO Hardcoded Administrator Daily Password Authentication Bypass

XWEB EVO 5.6.2 through 5.8.8 contains a hardcoded credential vulnerability where the Administrator web account is configured to use password_mode daily_password with no stored password, as the Users.authenticate function in lualib_users.lua synthesizes the Administrator configuration without validating any stored secret. Attackers who can derive the MAC-based daily password can authenticate as Administrator to obtain a full admin session on the device. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124006

Dixell/Copeland XWEB EVO Predictable Root Password Generation

XWEB EVO through 5.8.8 contains a predictable credential generation vulnerability that allows attackers to derive the Linux root password by computing a fixed prefix combined with a daily password value. Attackers can calculate the deterministic root credential, which before 5.7.0 was identical across all units and from 5.7.0 onward remains derivable from the MAC-based daily password, to gain unauthorized root access to the underlying operating system. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-124004

Dixell/Copeland XWEB EVO Hardcoded Administrator Backdoor Password

XWEB EVO before 5.6.2 contains a hardcoded backdoor password vulnerability that allows unauthenticated remote attackers to gain full administrative access to the built-in Administrator account. Attackers can authenticate using the hardcoded credential xwebevonewgeneration in a single request to obtain a complete admin session and full control over the application. This product line reached it's end of service date in March 2026.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Copeland

Products

Xweb Evo

CVE-2026-128910

DJI AeroScope Mobile: Hard-coded root password on the serial console

Use of hard-coded credentials (CWE-798) on the 1300 communications board in DJI AeroScope Mobile (TP703) firmware 03.00.00.26, with 1300 communications board firmware 02.00.07.12 through 02.00.08.40, allows an attacker with physical access to the board's serial console to log in as root. The same password hash is present on every unit and uses DES crypt, so the password can be recovered offline from the distributed firmware. No network login service accepts this password by default. Confirmed on a physical device. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. DJI has discontinued AeroScope Mobile and no fixed firmware is available.

CVSS 3.1 · 6.8 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-121721

WordPress Gutenberg Blocks plugin <= 3.7.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg allows Stored XSS.This issue affects Gutenberg Blocks: from n/a through 3.7.6.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-125833

WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.24.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Product Filter yith-woocommerce-ajax-navigation allows Stored XSS.This issue affects YITH WooCommerce Ajax Product Filter: from n/a through 5.24.0.

CVSS 3.1 · 6.5 Medium EPSS n/a KEV · Not listed

Vendors

—

Products

—

CVE-2026-126070

Action View: Possible XSS vulnerability in Action View strip_tags

Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML. Prior to 8.1.4.1 and 8.0.5.2, strip_tags in Action View returns its sanitized output marked html_safe, but the underlying sanitizer encodes only &, < and >, leaving " and ' unencoded. Because ERB does not escape a string marked html_safe, untrusted input passed through strip_tags and rendered inside a quoted HTML attribute value could close the attribute and add new attributes, possibly leading to XSS. Applications that render strip_tags output from untrusted input inside an HTML attribute, for example in a title attribute or a <meta content> tag, are affected. Output rendered as element content is not affected. This issue is fixed in versions 8.1.4.1 and 8.0.5.2.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Rails

Products

Rails

CVE-2026-14565

Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes in the browser of visitors viewing the affected product.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Advanced-customized-prompts

CVE-2026-85677

Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript that will execute in the browser of any administrator who reviews the comment queue, and of any visitor to the post once the comment is approved.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Gutenverse News

CVE-2026-85678

AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views the post, including the editor or administrator who reviews it.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Ai Builder

CVE-2026-86780

Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the affected post, including higher-privileged users such as Editors and Administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Featured Image With Url

CVE-2026-83532

Custom Menu Wizard <= 3.3.1 - Contributor+ Stored XSS via Shortcode Attributes

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Custom Menu Wizard

CVE-2026-81742

BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in the browser of any user visiting the site.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Be Rest Endpoints

CVE-2026-82847

Masteriyo LMS < 3.4.1 - Instructor+ Stored XSS via Course Highlights

The Masteriyo LMS WordPress plugin before 3.4.1 does not sanitise and escape one of its course fields before outputting it back in the course editor, allowing users with the instructor role to perform Stored Cross-Site Scripting attacks against higher privileged users such as administrators.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Masteriyo Lms

CVE-2026-86790

WP Highlight Box <= 1.0 - Contributor+ Stored XSS via highlight-box Shortcode

The WP Highlight Box WordPress plugin through 1.0 does not escape some shortcode attributes before outputting them in a page where the shortcode is embedded, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Wp Highlight Box

CVE-2026-87888

YayPricing < 3.5.7 - Subscriber+ Stored XSS via save_page_data REST Route

The YayPricing WordPress plugin before 3.5.7 does not perform an authorization check on a REST route that saves its pricing rules, allowing users with the subscriber role and above to store JavaScript that executes in the browser of an administrator who opens the YayPricing WordPress plugin before 3.5.7's settings page.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Yaypricing

CVE-2026-85129

Hoo Companion 1.0.2 - Unauthenticated Stored XSS via Theme Settings Import

The Hoo Companion WordPress plugin 1.0.2 does not have any authorisation or validation checks in one of its import features, and does not sanitise the data submitted to it before storing it as the active theme's settings, allowing unauthenticated attackers to inject arbitrary web scripts which will execute for anyone viewing the site, including administrators. The same request destroys the site's existing theme settings.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Hoo Companion

CVE-2026-88793

YouTube Embed 10.0 - 10.3 - Unauthenticated Stored XSS via youram_server

The YouTube Embed WordPress plugin from 10.0 to 10.3 does not perform any authorisation check on one of its AJAX actions, relying only on a nonce it prints on every front-end page, and does not escape the stored data before rendering it, allowing unauthenticated attackers to store arbitrary web scripts which will execute in the session of any user viewing the affected content, including an administrator.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Youtube Embed