CVE-2026-4577

code-projects Exam Form Submission update_s4.php cross site scripting

A vulnerability was found in code-projects Exam Form Submission 1.0. The affected element is an unknown function of the file /admin/update_s4.php. Performing a manipulation of the argument sname results in cross site scripting. The attack may be initiated remotely. The exploit has been made public and could be used.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Exam Form Submission

CVE-2026-4616

bolo-blog Article Title article cross site scripting

A security flaw has been discovered in bolo-blog up to 2.6.4. The affected element is an unknown function of the file /console/article/ of the component Article Title Handler. Performing a manipulation of the argument articleTitle results in cross site scripting. It is possible to initiate the attack remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Bolo-blog

Products

Bolo-solo

CVE-2026-25349

WordPress Loobek theme < 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Loobek loobek allows Reflected XSS.This issue affects Loobek: from n/a through < 1.5.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Loobek Wordpress

CVE-2026-25018

WordPress NaturaLife Extensions plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows Reflected XSS.This issue affects NaturaLife Extensions: from n/a through <= 2.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Stmcan Wordpress

Products

Naturalife Extensions Wordpress

CVE-2026-25356

WordPress Yobazar theme < 1.6.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Yobazar yobazar allows Reflected XSS.This issue affects Yobazar: from n/a through < 1.6.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Yobazar Wordpress

CVE-2026-3427

Yoast SEO <= 27.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'jsonText' Block Attribute

The Yoast SEO – Advanced SEO with real-time guidance and built-in AI plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the the `jsonText` block attribute in all versions up to, and including, 27.1.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress Yoast

Products

Wordpress Yoast Seo – Advanced Seo With Real-time Guidance And Built-in Ai

CVE-2026-4595

code-projects Exam Form Submission update_s6.php cross site scripting

A vulnerability was determined in code-projects Exam Form Submission 1.0. This vulnerability affects unknown code of the file /admin/update_s6.php. Executing a manipulation of the argument sname can lead to cross site scripting. The attack can be launched remotely. The exploit has been publicly disclosed and may be utilized.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Code-projects

Products

Exam Form Submission

CVE-2026-25355

WordPress Sanzo theme < 2.4.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Sanzo sanzo allows Stored XSS.This issue affects Sanzo: from n/a through < 2.4.3.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Sanzo Wordpress

CVE-2026-25354

WordPress Reebox theme < 1.4.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Reebox reebox allows Reflected XSS.This issue affects Reebox: from n/a through < 1.4.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Reebox Wordpress

CVE-2026-25352

WordPress MyDecor theme < 1.5.9 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyDecor mydecor allows Reflected XSS.This issue affects MyDecor: from n/a through < 1.5.9.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Mydecor Wordpress

CVE-2026-25351

WordPress MyMedi theme < 1.7.7 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup MyMedi mymedi allows Reflected XSS.This issue affects MyMedi: from n/a through < 1.7.7.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Mymedi Wordpress

CVE-2026-25346

WordPress FAQ Builder AYS plugin <= 1.8.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro FAQ Builder AYS faq-builder-ays allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FAQ Builder AYS: from n/a through <= 1.8.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Ays-pro Wordpress

Products

Faq Builder Wordpress

CVE-2026-25341

WordPress RSFirewall! plugin <= 1.1.45 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in RSJoomla! RSFirewall! rsfirewall allows Stored XSS.This issue affects RSFirewall!: from n/a through <= 1.1.45.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Rsjoomla Wordpress

Products

Rsfirewall! Wordpress

CVE-2026-25306

WordPress XStore Core plugin <= 5.6.4 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 8theme XStore Core et-core-plugin allows Reflected XSS.This issue affects XStore Core: from n/a through <= 5.6.4.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

8theme Wordpress

Products

Xstore Core Wordpress

CVE-2026-25013

WordPress Phox Hosting plugin <= 2.0.8 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WHMCSdes Phox Hosting phox-host allows Reflected XSS.This issue affects Phox Hosting: from n/a through <= 2.0.8.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Whmcsdes Wordpress

Products

Phox Hosting Wordpress

CVE-2026-24983

WordPress UpSolution Core plugin <= 8.41 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in UpSolution UpSolution Core us-core allows Reflected XSS.This issue affects UpSolution Core: from n/a through <= 8.41.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Upsolution Wordpress

Products

Upsolution Core Wordpress

CVE-2026-24975

WordPress Organici Library plugin <= 2.1.2 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme Organici Library noo-organici-library allows Reflected XSS.This issue affects Organici Library: from n/a through <= 2.1.2.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nootheme Wordpress

Products

Organici Library Wordpress

CVE-2026-24973

WordPress CitiLights theme <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NooTheme CitiLights noo-citilights allows Reflected XSS.This issue affects CitiLights: from n/a through <= 3.7.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Nootheme Wordpress

Products

Citilights Wordpress

CVE-2026-25350

WordPress Miti theme < 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Miti miti allows Reflected XSS.This issue affects Miti: from n/a through < 1.5.3.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Miti Wordpress

CVE-2026-25353

WordPress Nooni theme < 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in skygroup Nooni nooni allows Reflected XSS.This issue affects Nooni: from n/a through < 1.5.1.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Skygroup Wordpress

Products

Nooni Wordpress