CVE-2026-110014Published
Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status
cve-program ·
Vendor product: Salon Booking System
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
694793 source statements · aliases may refer to the same vulnerabilityCVE-2026-110015Published
Salon Booking System < 10.31.9 - Administrator Account Creation via CSRF
cve-program ·
Vendor product: Salon Booking System
CVE-2026-110039Published
Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite
cve-program ·
Vendor product: Smush
CVE-2026-110135Published
OTP Login & Register Woocommerce < 2.7.3 - Unauthenticated Account Takeover via OTP Brute Force
cve-program ·
Vendor product: OTP Login & Register Woocommerce
CVE-2026-110179Published
affiliate-toolkit < 3.8.9 - Editor+ SQL Injection via orderby Parameter
cve-program ·
Vendor product: affiliate-toolkit
CVE-2026-110191Published
Product Delivery Date for WooCommerce – Lite < 3.3.2 - Contributor+ Order Information Disclosure via Calendar View AJAX Actions
cve-program ·
Vendor product: Product Delivery Date for WooCommerce
CVE-2026-109930Published
MAIO < 7.3.22 - Unauthenticated Crawl Analytics Disclosure via Hardcoded API Key
cve-program ·
https://wordpress.org/plugins: MAIO
CVE-2026-110029Published
Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment
cve-program ·
https://wordpress.org/plugins: Squeeze
CVE-2026-94135Published
Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default
cve-program ·
https://pypi.python.org: apache-airflow-providers-sftp
CVE-2026-111271Published
libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoundFile::ReadAMS2
cve-program ·
Vendor product: libmodplug
CVE-2026-109685Published
WordPress Link Whisper Free plugin <= 0.9.7 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: link-whisper
CVE-2026-105065Published
WordPress XStore theme < 9.7.9 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://themeforest.net: xstore
CVE-2026-106604Published
WordPress YITH WooCommerce Compare plugin <= 3.15.0 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: yith-woocommerce-compare
CVE-2026-93535Published
WP Dark Mode – Improve Accessibility with AI Powered Dark Theme <= 5.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'icon_light' Shortcode Attribute
cve-program ·
Vendor product: Dark Mode – Improve Accessibility with AI Powered Dark Theme
CVE-2026-109990Published
Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content
cve-program ·
Vendor product: Flying Scripts: Delay JavaScript to Improve Site Speed & Performance
CVE-2026-109207Published
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored Cross-Site Scripting via RSS media:thumbnail URL
cve-program ·
Vendor product: RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator
CVE-2026-107758Published
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cross-Site Scripting via Comments
cve-program ·
Vendor product: Colibri Page Builder
CVE-2026-109512Published
Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'content' Parameter
cve-program ·
Vendor product: Mang Board
CVE-2026-109998Published
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scripting via 'content' Parameter via content_reply AJAX
cve-program ·
Vendor product: Mang Board
CVE-2026-103481Published
Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting via 'permalink' Parameter
cve-program ·
Vendor product: Gwolle Guestbook
CVE-2026-96570Published
Schema & Structured Data for WP & AMP <= 1.67 - Unauthenticated Stored Cross-Site Scripting via 'saswp_review_text' Parameter
cve-program ·
Vendor product: Schema & Structured Data for WP & AMP
CVE-2026-100158Published
SQL Chart Builder <= 3.0.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via SQL Chart Label (X-axis) via Stored User Field
cve-program ·
Vendor product: SQL Chart Builder
CVE-2026-110017Published
Quick PayPal Payments: Payment Button & Form <= 6.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'form' Shortcode Attribute
cve-program ·
Vendor product: Quick PayPal Payments: Payment Button & Form
CVE-2026-103999Published
Ultra Addons for Contact Form 7 <= 3.5.54 - Unauthenticated Stored Cross-Site Scripting via File Upload
cve-program ·
Vendor product: Ultra Addons for Contact Form 7
CVE-2026-107748Published
User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter
cve-program ·
Vendor product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
CVE-2026-95686Published
Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'targetUrl' Parameter
cve-program ·
Vendor product: Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
CVE-2026-95809Published
Opti-Behavior <= 1.9.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter
cve-program ·
Vendor product: Opti-Behavior – Self-Hosted Heatmaps, Funnels, A/B Testing & Smart Insights
CVE-2026-109232Published
Salon Booking System <= 10.31.9 - Unauthenticated Stored Cross-Site Scripting via Custom Checkout Field (Html/File Type) via Public Booking AJAX
cve-program ·
Vendor product: Salon Booking System – Appointment Booking for Salons, Barbershops & Spas
CVE-2026-89051Published
Hide My WP Ghost <= 7.0.12 - Unauthenticated Stored Cross-Site Scripting via Comment Content
cve-program ·
Vendor product: Hide My WP Ghost – Security & Firewall
CVE-2026-111122Published
SiteOrigin CSS <= 1.6.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Anchor href via Visual Inspector
cve-program ·
Vendor product: SiteOrigin CSS
CVE-2026-88963Published
Tutor LMS <= 4.0.8 - Authenticated (Subscriber+) Reflected DOM-Based Cross-Site Scripting via 'redirect_url' Parameter
cve-program ·
Vendor product: Tutor LMS – eLearning and online course solution
CVE-2026-100186Published
User Profile Builder <= 4.0.3 - Unauthenticated Stored Cross-Site Scripting via First Name Field
cve-program ·
Vendor product: User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor
CVE-2026-110664Published
Premium Packages <= 7.2.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Order Notes
cve-program ·
Vendor product: Premium Packages – Sell Digital Products Securely
CVE-2026-111069Published
GeoDirectory <= 2.8.192 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'twitterusername' Custom Field
cve-program ·
Vendor product: GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
CVE-2026-110290Published
WebberZone Top 10 <= 4.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'other_attributes' Block Attribute
cve-program ·
Vendor product: WebberZone Top 10 — Popular Posts
CVE-2026-109388Published
HivePress <= 1.7.32 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'message' Attribute of the hivepress_user_login_form Shortcode
cve-program ·
Vendor product: HivePress – Business Directory, Listings & Classified Ads Plugin
CVE-2026-107768Published
TranslatePress <= 3.3.7 - Unauthenticated Stored Cross-Site Scripting via Comment Anchor href with trp-gettext/TRPLINKPROCESSED Markers
cve-program ·
Vendor product: TranslatePress – Translate Multilingual sites with AI Translation
CVE-2026-109193Published
HivePress <= 1.7.32 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value
cve-program ·
Vendor product: HivePress – Business Directory, Listings & Classified Ads Plugin
CVE-2026-110252Published
WPeMatico RSS Feed Fetcher <= 2.9 - Unauthenticated Stored Cross-Site Scripting via RSS Feed Content Import
cve-program ·
Vendor product: WPeMatico RSS Feed Fetcher
CVE-2026-97640Published
WPConsent <= 1.1.9 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS)
cve-program ·
Vendor product: WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice)
CVE-2026-87111Published
User Registration PRO <= 6.2.9 - Unauthenticated Stored Cross-Site Scripting via HTTP Referer Header
cve-program ·
Vendor product: User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin
CVE-2026-100108Published
Social Share Buttons <= 1.30 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'share_url' Network Setting
cve-program ·
Vendor product: Social Share Buttons
CVE-2026-93681Published
Tutor LMS <= 4.1.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via display_name Parameter
cve-program ·
Vendor product: Tutor LMS – eLearning and online course solution
CVE-2026-109224Published
SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via sc-cart-loader 'template' Attribute in Comment
cve-program ·
Vendor product: SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments
CVE-2026-104726Published
Name Directory <= 1.34.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'dir' Shortcode Attribute
cve-program ·
Vendor product: Name Directory
CVE-2026-96768Published
GoSMTP Pro <= 1.2.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Email Log Body
cve-program ·
Vendor product: GoSMTP Pro
CVE-2026-107649Published
Events Made Easy <= 3.2.22 - Unauthenticated Stored Cross-Site Scripting via 'event[location_name]' Parameter
cve-program ·
Vendor product: Events Made Easy
CVE-2026-107648Published
WP Sessions Time Monitoring Full Automatic <= 1.1.5 - Unauthenticated Stored Cross-Site Scripting via 'action' GET Parameter
cve-program ·
Vendor product: WP Sessions Time Monitoring Full Automatic
CVE-2026-110903Published
WordPress The Events Calendar plugin <= 6.18.1 - Cross Site Scripting (XSS) vulnerability
cve-program ·
https://wordpress.org/plugins: the-events-calendar
CVE-2026-97470Published
Tourfic <= 3.0.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Comment Content via unfiltered_html Grant to Customer Role
cve-program ·
Vendor product: Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.