CVE-2026-6243Published
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
cve-program ·
Vendor product: Frontend Admin by DynamiApps
Security
Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.
Advisory catalog
Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.
Collected statements
695772 source statements · aliases may refer to the same vulnerabilityCVE-2026-100196Published
LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content
cve-program ·
Vendor product: LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
CVE-2026-107742Published
10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
cve-program ·
Vendor product: 10Web Booster – Website speed optimization, Cache & Page Speed optimizer
CVE-2026-96572Published
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
cve-program ·
Vendor product: WP Meteor Website Speed Optimization Addon
CVE-2026-103427Published
Simple Membership <= 4.8.4 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Country Field
cve-program ·
Vendor product: Simple Membership
CVE-2026-96278Published
WP Photo Album Plus <= 9.3.03.002 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Session History
cve-program ·
Vendor product: WP Photo Album Plus
CVE-2026-100147Published
FunnelKit <= 3.16.0.5 - Unauthenticated Stored Cross-Site Scripting via Order Fields (shipping/billing)
cve-program ·
Vendor product: FunnelKit – Funnel Builder for WooCommerce Checkout
CVE-2026-101920Published
Molongui Authorship <= 5.2.12 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment href Attribute
cve-program ·
Vendor product: Molongui Authorship – Author Boxes, Guest Authors & Co-Authors for WordPress
CVE-2026-101921Published
WPForms <= 2.0.2.1 - Reflected Cross-Site Scripting via 'query_var' Smart Tag in iframe srcdoc Attribute
cve-program ·
Vendor product: WPForms – AI Form Builder for WordPress – Contact Forms, Payment Forms, Survey Form, Quiz & More
CVE-2026-97396Published
Email Marketing for WordPress and WooCommerce <= 1.0.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'data' Parameter to /updateOptions REST Endpoint
cve-program ·
Vendor product: Email Marketing for WordPress and WooCommerce – Retainful
CVE-2026-96765Published
WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN) <= 44.1 - Unauthenticated Stored Cross-Site Scripting via 'id_token' Parameter (iss / unique_name JWT claims)
cve-program ·
Vendor product: WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN)
CVE-2026-100178Published
WPAdverts <= 2.3.4 - Unauthenticated Stored Cross-Site Scripting via 'adverts_location' Parameter
cve-program ·
Vendor product: WPAdverts – Classifieds Plugin
CVE-2026-102774Published
SureDash <= 1.12.1 - Authenticated (Subscriber+) Stored DOM-Based Cross-Site Scripting via Image 'alt' Attribute in Community Post Content
cve-program ·
Vendor product: SureDash – Community, Courses & Member Dashboard
CVE-2026-97340Published
Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field
cve-program ·
Vendor product: Avada | Website Builder For WordPress & WooCommerce
CVE-2026-103478Published
Premium Packages <= 7.2.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkout[billing][phone]' Parameter
cve-program ·
Vendor product: Premium Packages – Sell Digital Products Securely
CVE-2026-4791Published
PeproDev Ultimate Profile Solutions <= 8.2.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'button' Attribute
cve-program ·
Vendor product: PeproDev Ultimate Profile Solutions
CVE-2026-107657Published
HivePress <= 1.7.31 - Unauthenticated Stored Cross-Site Scripting via Custom User Attribute Value via Registration Form
cve-program ·
Vendor product: HivePress – Business Directory, Listings & Classified Ads Plugin
CVE-2026-93944Published
WordPress Camelia theme <= 1.2.15 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: camelia
CVE-2026-93945Published
WordPress Balance theme <= 1.12.0 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: balance
CVE-2026-104398Published
WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.10 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: affi-affiliate-marketing-for-woo
CVE-2026-105892Published
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.13 - Arbitrary File Deletion vulnerability
cve-program ·
https://wordpress.org/plugins: buddypress-media
CVE-2026-96341Published
WordPress Forminator plugin <= 1.57.3 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: forminator
CVE-2026-97076Published
WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability
cve-program ·
https://wordpress.org/plugins: wp-rocket
CVE-2026-96336Published
WordPress Forminator plugin <= 1.57.2 - Payment Bypass vulnerability
cve-program ·
https://wordpress.org/plugins: forminator
CVE-2026-96539Published
WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability
cve-program ·
https://wordpress.org/plugins: ultimate-member
CVE-2026-95597Published
WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability
cve-program ·
https://wordpress.org/plugins: pgall-for-woocommerce
CVE-2026-94666Published
WordPress Generate PDF using Contact Form 7 plugin <= 4.2.1 - Arbitrary File Download vulnerability
cve-program ·
https://wordpress.org/plugins: generate-pdf-using-contact-form-7
CVE-2026-96334Published
WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: user-registration
CVE-2026-107419Published
WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: automatic-translations-for-polylang
CVE-2026-105872Published
WordPress Product Configurator for WooCommerce plugin <= 1.7.5 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: product-configurator-for-woocommerce
CVE-2026-106602Published
WordPress Jetpack plugin <= 16.2 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: jetpack
CVE-2026-62028Published
WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability
cve-program ·
https://wordpress.org/plugins: before-after-image-compare
CVE-2026-94064Published
WordPress Neo | Barber Shop WordPress Theme theme <= 3.5 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: neocut
CVE-2026-94065Published
WordPress ColorFolio theme <= 1.3 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: colorit
CVE-2026-106606Published
WordPress YITH WooCommerce Affiliates plugin <= 3.31.0 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: yith-woocommerce-affiliates
CVE-2026-93949Published
WordPress Grocery Shopping Store theme <= 1.3.3 - Broken Authentication vulnerability
cve-program ·
https://wordpress.org/plugins: grocery-shopping-store
CVE-2026-93950Published
WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability
cve-program ·
https://themeforest.net: motors
CVE-2026-93927Published
WordPress Veto theme <= 1.6.0 - PHP Object Injection vulnerability
cve-program ·
https://wordpress.org/plugins: veto
CVE-2026-93929Published
WordPress Travesia theme <= 1.1.16 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: travesia
CVE-2026-93930Published
WordPress Tantra theme <= 2.9.0 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: tantra
CVE-2026-93931Published
WordPress Smash theme <= 1.12.0 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: smash
CVE-2026-93932Published
WordPress Smart Casa theme <= 1.0.12 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: smart-casa
CVE-2026-93933Published
WordPress Rosalinda theme <= 1.2.4 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: rosalinda
CVE-2026-93934Published
WordPress Partiso theme <= 1.1.13 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: partiso
CVE-2026-93935Published
WordPress Let's Play theme <= 1.1.15 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: playhockey
CVE-2026-93936Published
WordPress IPharm theme <= 1.2.4 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: ipharm
CVE-2026-93937Published
WordPress Hygia theme <= 1.21.0 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: hygia
CVE-2026-93938Published
WordPress Hogwords theme <= 1.2.7 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: hogwords
CVE-2026-93940Published
WordPress Greeny theme <= 2.10.0 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: greeny
CVE-2026-93941Published
WordPress Edema theme <= 1.2.2.2 - PHP Object Injection vulnerability
cve-program ·
https://themeforest.net: edema
A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.