high8.7
CVE-2026-62990
Shopper: same-origin SVG and HTML uploads enable stored XSS and persistent administrator creation
shopperlabs · shopper
Your agent Now with CVE context
Find published vulnerabilities, affected versions, and available fixes.
Bring the source evidence into your coding agent to investigate what affects your project.
Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.Opens in a new tabORIGINAL EVIDENCE. READY FOR YOUR WORKFLOW.CVE / OSV / CISA KEV
Find vulnerabilities that affect you.
Explore advisories by severity, ecosystem, and known exploitation. Take the evidence into your next agent session.
Severity
446 matching advisories · 30 shown
Follow substantive record changes →SEVERITYVULNERABILITY / AFFECTED PACKAGESPUBLISHED
medium5.3
CVE-2026-117645
Phoenix.HTML vulnerable to attribute injection via unvalidated attribute names in attributes_escape/1
phoenixframework · phoenix_html / phoenixframework · phoenix_html
medium6.1
medium6.5
CVE-2026-116854
WordPress WP Customer Area plugin <= 8.4.0 - Cross Site Scripting (XSS) vulnerability
Aguila Technologies · WP Customer Area
high7.1
CVE-2026-116851
WordPress eCommerce Product Catalog plugin <= 3.6.5 - Cross Site Scripting (XSS) vulnerability
impleCode · eCommerce Product Catalog
high7.1
CVE-2026-116847
WordPress Mang Board WP plugin <= 2.4.6 - Cross Site Scripting (XSS) vulnerability
Kitae Park · Mang Board WP
high7.1
CVE-2026-116405
WordPress VikRentCar plugin <= 1.4.9 - Cross Site Scripting (XSS) vulnerability
e4jvikwp · VikRentCar
medium6.5
CVE-2026-114711
WordPress MultiVendorX plugin <= 5.0.20 - Cross Site Scripting (XSS) vulnerability
MultiVendorX · MultiVendorX
high7.1
CVE-2026-105077
WordPress Ad Inserter plugin <= 2.8.19 - Cross Site Scripting (XSS) vulnerability
Spacetime · Ad Inserter
high7.1
CVE-2026-94175
WordPress All In One Login plugin <= 2.4.1 - Cross Site Scripting (XSS) vulnerability
Saad Iqbal · All In One Login
high7.1
CVE-2026-54855
WordPress Profile Builder plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerability
Cozmoslabs · Profile Builder
high7.1
CVE-2026-48201
WordPress Fast Velocity Minify plugin <= 3.5.7 - Cross Site Scripting (XSS) vulnerability
Raul P. · Fast Velocity Minify
high7.1
CVE-2026-39786
WordPress BA Book Everything plugin <= 1.8.33 - Cross Site Scripting (XSS) vulnerability
bookingalgorithms · BA Book Everything
high7.1
CVE-2026-28160
WordPress VikRentCar plugin <= 1.4.10 - Cross Site Scripting (XSS) vulnerability
e4jvikwp · VikRentCar
medium6.5
CVE-2026-27061
WordPress User Registration plugin <= 5.3.0 - Cross Site Scripting (XSS) vulnerability
wpeverest · User Registration
medium6.5
CVE-2026-39739
WordPress Ultimate Addons for Elementor - Lite plugin <= 2.9.5 - Cross Site Scripting (XSS) vulnerability
Brainstorm Force · Ultimate Addons for Elementor - Lite
high7.4
CVE-2026-119764
Mythic 3.2.16 through 3.4.0.61 Stored XSS via Agent-Downloaded File Preview
its-a-feature · Mythic
medium6.1
CVE-2026-119761
Axigen Mail Server before 10.6.39 and 10.7.1 Stored XSS via Sender Display Name
Axigen · Axigen Mail Server
medium6.4
CVE-2026-119113
GeoDirectory <= 2.8.199 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'post_content' Parameter
paoltaia · GeoDirectory – WP Business Directory Plugin and Classified Listings Directory
medium6.4
CVE-2026-115869
Themify Builder <= 7.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'variations' Repeater Field
themifyme · Themify Builder
medium5.4
CVE-2026-109984
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'ad' Shortcode Attribute in Comments
foliovision · FV Flowplayer Video Player
high7.2
CVE-2026-104744
Independent Analytics Pro <= 2.15.5 - Unauthenticated Stored Cross-Site Scripting via 'utm_campaign' Parameter
Independent Analytics · Independent Analytics Pro
high7.2
CVE-2026-112365
easy.jobs <= 2.8.4 - Unauthenticated Stored Cross-Site Scripting via 'cover_letter' Parameter
wpdevteam · easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution
medium6.4
CVE-2026-102918
Redux Framework <= 4.5.15 - Authenticated (Subscriber+) Stored Cross-Site Scripting via multi_media Field and Client-Supplied checkuser_id
davidanderson · Redux Framework
medium6.4
CVE-2026-110533
FV Flowplayer Video Player <= 7.5.55.7212 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Shortcode Attributes
foliovision · FV Flowplayer Video Player
high7.2
CVE-2026-96894
ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.10 - Unauthenticated Stored Cross-Site Scripting via Inbound Email Body
wedevs · ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce
medium6.4
CVE-2026-9239
Meow Gallery <= 5.5.1 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Alt Text (aria-label attribute)
tigroumeow · Meow Gallery
medium4.7
CVE-2026-116552
Like Button Rating ♥ LikeBtn <= 2.6.64 - Unauthenticated Stored Cross-Site Scripting via 'Client-IP' Header
likebtn · Like Button Rating ♥ LikeBtn
medium5.4
CVE-2026-110001
FV Flowplayer Video Player <= 7.5.55.7212 - Unauthenticated Stored Cross-Site Scripting via 'align' Shortcode Attribute
foliovision · FV Flowplayer Video Player
medium6.4
CVE-2026-119176
CP Multi View Events Calendar <= 1.4.43 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'Subject' Parameter
codepeople · CP Multi View Events Calendar