ByteOS Network

Vulnerability Details :

CVE-2026-66445

Summary

Assigner-Patchstack

Assigner Org ID-21595511-bba5-4825-b968-b78d1f9984a3

Published At-27 Jul, 2026 | 13:59

Updated At-27 Jul, 2026 | 14:59

WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

▼Common Vulnerabilities and Exposures (CVE)

cve.org

Assigner:Patchstack

Assigner Org ID:21595511-bba5-4825-b968-b78d1f9984a3

Published At:27 Jul, 2026 | 13:59

Updated At:27 Jul, 2026 | 14:59

▼CVE Numbering Authority (CNA)

WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

Affected Products

Vendor

100plugins

Product

Open User Map

Collection URL

https://wordpress.org/plugins

Package Name

open-user-map

Default Status

unaffected

Versions

Affected

From n/a through 1.4.46 (custom)
- -> unaffectedfrom1.4.47

Problem Types

Type	CWE ID	Description
CWE	CWE-79	CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Type: CWE

CWE ID: CWE-79

Description: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Metrics

Version	Base score	Base severity	Vector
3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Impacts

CAPEC ID	Description
CAPEC-592	CAPEC-592 Stored XSS

CAPEC ID: CAPEC-592

Description: CAPEC-592 Stored XSS

Solutions

Update the WordPress Open User Map Plugin to the latest available version (at least 1.4.47).

Credits

finder

TurboNexic | Patchstack Bug Bounty Program

References

Hyperlink	Resource
https://patchstack.com/database/wordpress/plugin/open-user-map/vulnerability/wordpress-open-user-map-plugin-1-4-46-cross-site-scripting-xss-vulnerability?_s_id=cve	vdb-entry

Hyperlink: https://patchstack.com/database/wordpress/plugin/open-user-map/vulnerability/wordpress-open-user-map-plugin-1-4-46-cross-site-scripting-xss-vulnerability?_s_id=cve

Resource:

vdb-entry

▼Authorized Data Publishers (ADP)

CISA ADP Vulnrichment

Metrics Other Info

▼National Vulnerability Database (NVD)

nvd.nist.gov

Source:audit@patchstack.com

Published At:27 Jul, 2026 | 15:17

Updated At:27 Jul, 2026 | 17:46

Contributor Cross Site Scripting (XSS) in Open User Map <= 1.4.46 versions.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Secondary	3.1	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
			N/A

Type: Secondary

Version: 3.1

Base score: 6.5

Base severity: MEDIUM

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Type: N/A

Version:

Base score:

Base severity: N/A

Vector:

Weaknesses

CWE ID	Type	Source
CWE-79	Secondary	audit@patchstack.com

CWE ID: CWE-79

Type: Secondary

Source: audit@patchstack.com

References

Hyperlink	Source	Resource
https://patchstack.com/database/wordpress/plugin/open-user-map/vulnerability/wordpress-open-user-map-plugin-1-4-46-cross-site-scripting-xss-vulnerability?_s_id=cve	audit@patchstack.com	N/A

Hyperlink: https://patchstack.com/database/wordpress/plugin/open-user-map/vulnerability/wordpress-open-user-map-plugin-1-4-46-cross-site-scripting-xss-vulnerability?_s_id=cve

Source: audit@patchstack.com

Resource: N/A

Similar CVEs

2723Records found

CVE-2024-32594

Matching Score-10

Assigner-Patchstack

View Details

Matching Score-10

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.30%

7 Day CHG~0.00%

Published-18 Apr, 2024 | 08:34

Updated-28 Apr, 2026 | 16:09

WordPress Attesa Extra plugin <= 1.3.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AttesaWP Attesa Extra allows Stored XSS.This issue affects Attesa Extra: from n/a through 1.3.9.

Vendor-AttesaWP 100plugins

Product-Attesa Extra open_user_map

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-57953

Matching Score-10

Assigner-Patchstack

View Details

Matching Score-10

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 20.70%

7 Day CHG~0.00%

Published-22 Sep, 2025 | 18:24

Updated-28 Apr, 2026 | 16:13

WordPress Open User Map Plugin <= 1.4.14 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 100plugins Open User Map open-user-map allows DOM-Based XSS.This issue affects Open User Map: from n/a through <= 1.4.14.

Vendor-100plugins

Product-Open User Map

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-2827

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-4.7||MEDIUM

EPSS-0.19% / 8.72%

7 Day CHG~0.00%

Published-11 Jun, 2026 | 01:27

Updated-23 Jul, 2026 | 09:10

Open User Map PRO <= 1.4.31 - Unauthenticated Stored Cross-Site Scripting via 'oum_location_notification'

The Open User Map PRO plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'oum_location_notification' parameter in versions up to, and including, 1.4.31 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vendor-100plugins

Product-Open User Map PRO

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-15755

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-6.4||MEDIUM

EPSS-0.24% / 15.35%

7 Day CHG~0.00%

Published-24 Jul, 2026 | 06:51

Updated-24 Jul, 2026 | 12:16

Open User Map <= 1.4.45 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Open User Map – Interactive Leaflet Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 1.4.45 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack does not require post publication; a Contributor submitting a post for pending review is sufficient, as the payload executes when an Administrator opens the pending-review preview.

Vendor-100plugins

Product-Open User Map – Interactive Leaflet Maps

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-13362

Matching Score-6

Assigner-Wordfence

View Details

Matching Score-6

Assigner-Wordfence

CVSS Score-6.1||MEDIUM

EPSS-0.28% / 19.82%

7 Day CHG~0.00%

Published-01 May, 2026 | 05:29

Updated-01 May, 2026 | 13:23

Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter

Multiple plugins and/or themes for WordPress are vulnerable to Reflected Cross-Site Scripting via the url parameter in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Vendor-yuvalo codesavory spicethemes josevega dashlabsltd webheadllc pluginandplay blackandwhitedigital senols fooplugins prasadkirpekar blockspare pluginsware wpbits pagup premmerce imtiazrayhan gn_themes 5starplugins wpsaad wpjoli mohsinoffline paretodigital wordplus mattpramschufer damian-gora webba-agency kaizencoders samdani peterschulznl nicheaddons cleverplugins meowcrew mte90 inavii gallerycreator streamweasels hasanazizul themelocation smartwpress xplodedthemes mr2p sjaved mikewire_rocksolid nitin247 cyclonecode bensibley wpmagics rebelcode essekia enweby fullworks elliotvs interactivegeomaps cyberhobo takanakui webfactory elespare plugins360 litonice13 uriahs-victor princeahmed oceanwp seezee mapster koen12344 tonyzeoli 100plugins kaira tobias_conrad infornweb toddhalfpenny hkdigitalagency davidanderson passionatebrains invisnet tickera kofimokome tobiasbg saadiqbal sebet gowebsmarty unitecms spiderdevs tripetto wpdever bouncingsprout wpspeedo speedify infosatech theafricanboss mihail-barinov mhmrajib vinod-dalvi pluginscafe bplugins Biplob Adhikari (Oxilab Development)AF themes

Product-Post to Google My Business (Google Business Profile)Mapster WP Maps Share This Image Featured Images in RSS for Mailchimp & More Better Messages – Live Chat, Chat Rooms, Real-Time Messaging & Private Messages Go Fetch Jobs (for WP Job Manager)Post Slider and Post Carousel with Post Vertical Scrolling Widget – A Responsive Post Slider Mixed Media Gallery Blocks Five-Star Ratings Shortcode AI Bud – AI Content Generator, AI Chatbot, ChatGPT, Gemini, GPT-4o AI Puffer – Chat. Create. Automate. (formerly AI Power)Auto-Install Free SSL – Generate & Install Free SSL Certificates Carousel, Recent Post Slider and Banner Slider Disable Payment Methods based on cart conditions for WooCommerce XT Floating Cart for WooCommerce Primary Addon for Elementor Unlimited Elements For Elementor Notification Bar, Announcement and Cookie Notice WordPress Plugin – FooBar Easy Appointment Booking & Scheduling System – Webba Booking Calendar XT Quick View for WooCommerce WOW Styler for CF7 – Visual Styler for Contact Form 7 Forms EazyDocs – AI Powered Knowledge Base, Wiki, Documentation & FAQ Builder Message Filter for Contact Form 7 Post SMTP – Complete Email Deliverability and SMTP Solution with Email Logs, Alerts, Backup SMTP & Mobile App TreePress – Easy Family Trees & Ancestor Profiles Easy Age Verify Radio Station by netmix® – Manage and play your Show Schedule in WordPress!GA4WP – Analytics Dashboard for the Website Embedder for Google Reviews Premmerce Permalink Manager for WooCommerce Solid Testimonials – Testimonial Slider, Video Testimonials & Customer Reviews WP Notification Bell Custom WooCommerce Checkout Fields Editor WP fail2ban – Advanced Security Internal Link Juicer: SEO Auto Linker for WordPress Advanced Classifieds & Directory Pro WPBITS Addons For Elementor Page Builder Menu Image, Icons made easy File Manager for Google Drive – Integrate Google Drive WP Meta and Date Remover Geo Mashup Blog Designer Pack – Blog, Post Grid, Post Slider, Post Carousel, Category Post, News Glossary EleSpare – News, Magazine and Blog Addons for Elementor Justified Gallery StreamWeasels Twitch Integration WP Books Gallery – Build Stunning Book Showcases & Libraries in Minutes Premmerce Product Filter for WooCommerce Bulk Auto Image Alt Text (Alt tag, Alt attribute) optimizer (image SEO)Ivory Search – WordPress Search Plugin Announcement & Notification Banner – Bulletin WPIDE – File Manager & Code Editor WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan bBlocks – Essential Gutenberg Blocks & Patterns Collection Dynamic Copyright Year Display Eventbrite Events Restaurant & Cafe Addon for Elementor Spotlight Social Feeds – Block, Shortcode, and Widget Logo Showcase – Responsive Logo Carousel, Logo Slider & Logo Grid WordPress form builder plugin for contact forms, surveys and quizzes – Tripetto WP Coupons and Deals – Coupon Plugin For Affiliate Marketers Thank You Page for WooCommerce Goal Tracker – Custom Event Tracking for GA4 Post List Designer – Category Post, Recent Post, Post List WP Data Access – App Builder for Tables, Forms, Charts, Maps & Dashboards Restrict – membership, site, content and user access restrictions for WordPress Kikote – Location Picker at Checkout & Google Address AutoFill Plugin for WooCommerce Joli Table Of Contents Checkout with Cash App on WooCommerce Independent Analytics Events Addon for Elementor Automatic Internal Links for SEO by Pagup Ultimeter Pay For Post with WooCommerce Team Members – A WordPress Team Plugin with Gallery, Grid, Carousel, Slider, Table, List, and More YASR – Yet Another Star Rating Plugin for WordPress Master Addons For Elementor – Widgets, Extensions, Theme Builder, Popup Builder & Template Kits Role Based Pricing for Woo by Meow Crew Ocean Extra Radio Player – Live Shoutcast, Icecast and Any Audio Stream Player Meta Field Block – Display custom fields in the Block Editor without coding Open User Map Tablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent Code Manager Text To Speech TTS Accessibility Anti-Spam Protection – No API Key, GDPR Friendly Gallery by FooGallery Automatic YouTube Gallery StoreCustomizer – A plugin to Customize all WooCommerce Pages WP Page Templates AidWP – Donation & Payment Forms (Stripe Powered)WP Post Author – Author Box, Multiple Authors, Guest Authors & Custom Avatars Secure Gateway for Authorize.net and WooCommerce by Pledged Plugins Payment Gateway for ACBA BANK Product Layouts for WooCommerce Advanced Scrollbar – Custom Scrollbar Styling and Behavior Security Ninja – WordPress Security & Firewall XT Variation Swatches for WooCommerce Delete Posts automatically Widgets on Pages TablePress – Tables in WordPress made easy Contact Form 7 Multi-Step Forms RevivePress – Keep your Old Content Evergreen HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player AEH Speed Optimization: Browser Cache, Optimized Minify, Lazy Loading & Image Optimization AWCA – The Great Analytics Insights for Your eStore Image Alt Text Manager – Bulk & Dynamic Alt Tags For image SEO Optimization + AI Smart phone field for Gravity Forms Bulk Edit Posts and Products in Spreadsheet Marijuana Age Verify Forumax – AI Powered Advanced Community Forum Plugin Music Player for Elementor – Audio Player & Podcast Player Full Screen Background MapGeo – Interactive Geo Maps Knowledge Base documentation & wiki plugin – BasePress Docs BlockSpare — News, Magazine and Blog Addons for (Gutenberg) Block Editor Coupon Affiliates – Affiliate Plugin for WooCommerce Place Order Without Payment for WooCommerce Lightbox & Modal Popup WordPress Plugin – FooBox WP Mobile Menu – The Mobile-Friendly Responsive Menu Custom PHP Settings Inavii Social Feed Send Users Email – Email Subscribers, Email Marketing Newsletter WP Shortcodes Plugin — Shortcodes Ultimate Dracula Dark Mode – Accessibility, Reading Mode & Dark Mode for WordPress PDF Poster – Display PDF Files with Custom Viewer Easy Social Feed – Social Photos Gallery and Post Feed for WordPress Team Members Showcase URL Shortify – Simple and Easy URL Shortener TopNewsWp – Display Tikcer News, RSS Feed Widget and Many More Remove Add to Cart WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-45056

Matching Score-6

Assigner-Patchstack

View Details

Matching Score-6

Assigner-Patchstack

CVSS Score-5.9||MEDIUM

EPSS-0.32% / 23.93%

7 Day CHG~0.00%

Published-18 Oct, 2023 | 08:14

Updated-28 Apr, 2026 | 16:08

WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in 100plugins Open User Map plugin <= 1.3.26 versions.

Vendor-100plugins 100plugins

Product-open_user_map Open User Map

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-29797

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.35% / 27.68%

7 Day CHG~0.00%

Published-27 Mar, 2024 | 12:25

Updated-28 Apr, 2026 | 16:09

WordPress Grid Shortcodes plugin <= 1.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Darko Grid Shortcodes allows Stored XSS.This issue affects Grid Shortcodes: from n/a through 1.1.

Vendor-WP Darko

Product-Grid Shortcodes

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33954

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.41% / 33.66%

7 Day CHG~0.00%

Published-02 May, 2024 | 11:18

Updated-28 Apr, 2026 | 16:09

WordPress Pliska theme <= 0.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Atanas Yonkov Pliska allows Stored XSS.This issue affects Pliska: from n/a through 0.3.5.

Vendor-Atanas Yonkov

Product-Pliska

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33951

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.41% / 33.66%

7 Day CHG~0.00%

Published-02 May, 2024 | 11:31

Updated-28 Apr, 2026 | 16:09

WordPress Perfect Pullquotes plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Adam DeHaven Perfect Pullquotes allows Stored XSS.This issue affects Perfect Pullquotes: from n/a through 1.7.5.

Vendor-Adam DeHaven

Product-Perfect Pullquotes

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32576

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.40%

7 Day CHG~0.00%

Published-25 Aug, 2023 | 08:38

Updated-28 Apr, 2026 | 16:08

WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)

Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions.

Vendor-plainwaire Plainware

Product-locatoraid_store_locator Locatoraid Store Locator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-33311

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.40% / 32.35%

7 Day CHG~0.00%

Published-28 May, 2023 | 18:32

Updated-28 Apr, 2026 | 16:08

WordPress Contact Form Entries Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in CRM Perks Contact Form Entries plugin <= 1.3.0 versions.

Vendor-crmperks CRM Perks

Product-contact_form_entries_-_contact_form_7_wpforms_and_more Contact Form Entries

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33934

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.50%

7 Day CHG~0.00%

Published-03 May, 2024 | 07:07

Updated-28 Apr, 2026 | 16:09

WordPress Mini Loops plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kailey Lampert Mini Loops allows Stored XSS.This issue affects Mini Loops: from n/a through 1.4.1.

Vendor-Kailey Lampert WordPress.org

Product-Mini Loops mini_loops

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33926

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.54%

7 Day CHG~0.00%

Published-03 May, 2024 | 07:13

Updated-28 Apr, 2026 | 16:09

WordPress GWP-Histats plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Karl Kiesinger GWP-Histats allows Stored XSS.This issue affects GWP-Histats: from n/a through 1.0.

Vendor-Karl Kiesinger

Product-GWP-Histats

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32956

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 24.99%

7 Day CHG~0.00%

Published-24 Apr, 2024 | 08:23

Updated-28 Apr, 2026 | 16:09

WordPress RomethemeKit For Elementor plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rometheme RTMKit rometheme-for-elementor.This issue affects RTMKit: from n/a through <= 1.4.1.

Vendor-Rometheme

Product-RTMKit

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33649

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 25.84%

7 Day CHG~0.00%

Published-29 Apr, 2024 | 04:53

Updated-28 Apr, 2026 | 16:09

WordPress Opal Widgets For Elementor plugin <= 1.6.9 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WpOpal Opal Widgets For Elementor allows Stored XSS.This issue affects Opal Widgets For Elementor: from n/a through 1.6.9.

Vendor-WpOpal wpopal

Product-Opal Widgets For Elementor opal_widgets_for_elementor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32746

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.37% / 30.03%

7 Day CHG~0.00%

Published-30 Aug, 2023 | 11:39

Updated-28 Apr, 2026 | 16:08

WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Brands plugin <= 1.6.45 versions.

Vendor-WooCommerce

Product-woocommerce_brands WooCommerce Brands

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32578

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.40%

7 Day CHG~0.00%

Published-04 Sep, 2023 | 11:30

Updated-28 Apr, 2026 | 16:08

WordPress Column-Matic Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Twinpictures Column-Matic plugin <= 1.3.3 versions.

Vendor-column-matic_project Twinpictures

Product-column-matic Column-Matic

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33932

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.75%

7 Day CHG~0.00%

Published-03 May, 2024 | 07:08

Updated-28 Apr, 2026 | 16:09

WordPress Login Logout Register Menu plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vinod Dalvi Login Logout Register Menu allows Stored XSS.This issue affects Login Logout Register Menu: from n/a through 2.0.

Vendor-Vinod Dalvi

Product-Login Logout Register Menu

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32793

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.37% / 30.03%

7 Day CHG~0.00%

Published-30 Aug, 2023 | 11:34

Updated-28 Apr, 2026 | 16:08

WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WooCommerce WooCommerce Pre-Orders plugin <= 2.0.0 versions.

Vendor-WooCommerce

Product-woocommerce_pre-orders WooCommerce Pre-Orders

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2025-31851

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 25.60%

7 Day CHG~0.00%

Published-01 Apr, 2025 | 14:52

Updated-28 Apr, 2026 | 16:12

WordPress Beds24 Online Booking plugin <= 2.0.27 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in markkinchin Beds24 Online Booking beds24-online-booking allows Stored XSS.This issue affects Beds24 Online Booking: from n/a through <= 2.0.27.

Vendor-markkinchin

Product-Beds24 Online Booking

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32600

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 25.63%

7 Day CHG~0.00%

Published-05 Aug, 2023 | 23:00

Updated-28 Apr, 2026 | 16:08

WordPress Rank Math SEO Plugin <= 1.0.119 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Rank Math SEO plugin <= 1.0.119 versions.

Vendor-rankmath Rank Math

Product-seo Rank Math SEO

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33631

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.44% / 36.13%

7 Day CHG~0.00%

Published-29 Apr, 2024 | 05:07

Updated-28 Apr, 2026 | 16:09

WordPress Piotnet Addons For Elementor Pro plugin <= 7.1.17 - Authenticated Stored Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Piotnet Piotnet Addons For Elementor Pro allows Stored XSS.This issue affects Piotnet Addons For Elementor Pro: from n/a through 7.1.17.

Vendor-Piotnet

Product-Piotnet Addons For Elementor Pro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33539

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.40% / 33.09%

7 Day CHG~0.00%

Published-29 Apr, 2024 | 05:23

Updated-28 Apr, 2026 | 16:09

WordPress WPZOOM Addons for Elementor plugin <= 1.1.35 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor (Templates, Widgets) allows Stored XSS.This issue affects WPZOOM Addons for Elementor (Templates, Widgets): from n/a through 1.1.35.

Vendor-wpzoom WPZOOM

Product-wpzoom_elementor_addons WPZOOM Addons for Elementor (Templates, Widgets)

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33945

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.50%

7 Day CHG~0.00%

Published-03 May, 2024 | 06:57

Updated-28 Apr, 2026 | 16:09

WordPress Eleblog – Elementor Blog And Magazine Addons plugin <= 1.8 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in solverwp.Com Eleblog – Elementor Blog And Magazine Addons allows Stored XSS.This issue affects Eleblog – Elementor Blog And Magazine Addons: from n/a through 1.8.

Vendor-solverwp.com

Product-Eleblog – Elementor Blog And Magazine Addons

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32103

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.40%

7 Day CHG~0.00%

Published-18 Aug, 2023 | 13:46

Updated-28 Apr, 2026 | 16:08

WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Theme Palace TP Education plugin <= 4.4 versions.

Vendor-themepalace Theme Palace

Product-tp_education TP Education

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-32291

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.50% / 39.69%

7 Day CHG~0.00%

Published-30 Nov, 2023 | 12:29

Updated-28 Apr, 2026 | 16:08

WordPress MonsterInsights Pro Plugin <= 8.14.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MonsterInsights Pro allows Stored XSS.This issue affects MonsterInsights Pro: from n/a through 8.14.1.

Vendor-MonsterInsights, LLC

Product-monsterinsights MonsterInsights Pro

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33953

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.41% / 33.38%

7 Day CHG~0.00%

Published-02 May, 2024 | 11:21

Updated-28 Apr, 2026 | 16:09

WordPress Adventure Journal theme <= 1.7.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Matt van Andel Adventure Journal allows Stored XSS.This issue affects Adventure Journal: from n/a through 1.7.2.

Vendor-Matt van Andel

Product-Adventure Journal

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-2888

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.34% / 26.10%

7 Day CHG~0.00%

Published-26 Mar, 2024 | 05:41

Updated-28 Apr, 2026 | 16:09

WordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BoldGrid Post and Page Builder by BoldGrid – Visual Drag and Drop Editor allows Stored XSS.This issue affects Post and Page Builder by BoldGrid – Visual Drag and Drop Editor: from n/a through 1.26.2.

Vendor-BoldGrid (InMotion Hosting, Inc.)

Product-post_and_page_builder Post and Page Builder by BoldGrid – Visual Drag and Drop Editor

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32961

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.63%

7 Day CHG~0.00%

Published-25 Apr, 2024 | 09:16

Updated-28 Apr, 2026 | 16:09

WordPress Blocksy theme <= 2.0.33 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in creativethemeshq Blocksy blocksy.This issue affects Blocksy: from n/a through <= 2.0.33.

Vendor-creativethemes creativethemeshq

Product-blocksy Blocksy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33916

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 23.79%

7 Day CHG~0.00%

Published-03 May, 2024 | 07:18

Updated-28 Apr, 2026 | 16:09

WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0.

Vendor-MachoThemes

Product-CPO Companion

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-30784

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.40%

7 Day CHG~0.00%

Published-16 Aug, 2023 | 09:56

Updated-28 Apr, 2026 | 16:08

WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Kaya Studio Kaya QR Code Generator plugin <= 1.5.2 versions.

Vendor-kayastudio Kaya Studio

Product-kaya_qr_code_generator Kaya QR Code Generator

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33952

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.41% / 33.38%

7 Day CHG~0.00%

Published-02 May, 2024 | 11:22

Updated-28 Apr, 2026 | 16:09

WordPress Unique theme <= 0.3.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Tadlock Unique allows Stored XSS.This issue affects Unique: from n/a through 0.3.0.

Vendor-Justin Tadlock WordPress.org

Product-Unique unique_theme

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-31213

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.38% / 30.94%

7 Day CHG~0.00%

Published-22 Jun, 2023 | 10:05

Updated-28 Apr, 2026 | 16:08

WordPress WPBakery Page Builder Plugin < 6.13.0 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in WPBakery Page Builder plugin <= 6.13.0 versions.

Vendor-wpbakery WPBakery

Product-page_builder WPBakery Page Builder

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33648

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.37% / 29.95%

7 Day CHG~0.00%

Published-29 Apr, 2024 | 04:54

Updated-28 Apr, 2026 | 16:09

WordPress Recencio Book Reviews plugin <= 1.66.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kemory Grubb Recencio Book Reviews recencio-book-reviews allows DOM-Based XSS.This issue affects Recencio Book Reviews: from n/a through <= 1.66.0.

Vendor-Kemory Grubb

Product-Recencio Book Reviews

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33948

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-5.5||MEDIUM

EPSS-0.29% / 20.80%

7 Day CHG~0.00%

Published-02 May, 2024 | 16:47

Updated-28 Apr, 2026 | 16:09

WordPress TweetScroll Widget plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixel Industry TweetScroll Widget allows Stored XSS.This issue affects TweetScroll Widget: from n/a through 1.3.7.

Vendor-Pixel Industry

Product-TweetScroll Widget

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33949

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.33% / 25.84%

7 Day CHG~0.00%

Published-02 May, 2024 | 16:46

Updated-28 Apr, 2026 | 16:09

WordPress Min and Max Purchase for WooCommerce plugin <= 2.0.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vark Min and Max Purchase for WooCommerce allows Stored XSS.This issue affects Min and Max Purchase for WooCommerce: from n/a through 2.0.0.

Vendor-Vark

Product-Min and Max Purchase for WooCommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33540

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.34% / 26.41%

7 Day CHG~0.00%

Published-29 Apr, 2024 | 05:20

Updated-28 Apr, 2026 | 16:09

WordPress ColorNews theme <= 1.2.6 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeGrill ColorNews allows Stored XSS.This issue affects ColorNews: from n/a through 1.2.6.

Vendor-ThemeGrill themegrill

Product-ColorNews colornews

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-31079

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.40%

7 Day CHG~0.00%

Published-17 Aug, 2023 | 14:31

Updated-28 Apr, 2026 | 16:08

WordPress Tippy Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Chris Roberts Tippy plugin <= 6.2.1 versions.

Vendor-thechrisroberts Chris Roberts

Product-tippy Tippy

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33936

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.75%

7 Day CHG~0.00%

Published-03 May, 2024 | 07:02

Updated-28 Apr, 2026 | 16:09

WordPress Print-O-Matic plugin <= 2.1.10 - Auth. Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Twinpictures Print-O-Matic allows Stored XSS.This issue affects Print-O-Matic: from n/a through 2.1.10.

Vendor-Twinpictures

Product-Print-O-Matic

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-33935

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.30% / 22.79%

7 Day CHG~0.00%

Published-03 May, 2024 | 07:04

Updated-28 Apr, 2026 | 16:09

WordPress PB MailCrypt plugin <= 3.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pascal Bajorat PB MailCrypt allows Stored XSS.This issue affects PB MailCrypt: from n/a through 3.1.0.

Vendor-Pascal Bajorat

Product-PB MailCrypt

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-30492

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.23%

7 Day CHG~0.00%

Published-26 Oct, 2023 | 11:58

Updated-28 Apr, 2026 | 16:08

WordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Vark Minimum Purchase for WooCommerce plugin <= 2.0.0.1 versions.

Vendor-varktech Vark varktech

Product-minimum_purchase_for_woocommerce Minimum Purchase for WooCommerce minimum_purchase_for_woocommerce

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-30780

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.72%

7 Day CHG~0.00%

Published-18 May, 2023 | 10:02

Updated-28 Apr, 2026 | 16:08

WordPress User IP and Location Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in TheGuideX User IP and Location plugin <= 2.2 versions.

Vendor-theguidex TheGuideX

Product-user_ip_and_location User IP and Location

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32800

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.25% / 16.13%

7 Day CHG~0.00%

Published-17 May, 2024 | 06:10

Updated-28 Apr, 2026 | 16:09

WordPress Popup – Popup More Popups plugin <= 2.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Felix Moira Popup More Popups allows Stored XSS.This issue affects Popup More Popups: from n/a through 2.3.1.

Vendor-Felix Moira felixmoira

Product-Popup More Popups popup_more_popups\,_lightboxes\,_and_more_popup_modules

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32571

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.31%

7 Day CHG~0.00%

Published-18 Apr, 2024 | 09:41

Updated-28 Apr, 2026 | 16:09

WordPress WP Stripe Checkout plugin <= 1.2.2.41 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in naa986 WP Stripe Checkout allows Stored XSS.This issue affects WP Stripe Checkout: from n/a through 1.2.2.41.

Vendor-naa986

Product-WP Stripe Checkout

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-30482

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.36% / 28.40%

7 Day CHG+0.05%

Published-08 Aug, 2023 | 12:11

Updated-28 Apr, 2026 | 16:08

WordPress WPBulky Plugin < 1.0.10 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in VillaTheme WPBulky plugin <= 1.0.10 versions.

Vendor-VillaTheme

Product-wpbulky WPBulky

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32552

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.32% / 24.30%

7 Day CHG~0.00%

Published-18 Apr, 2024 | 10:20

Updated-28 Apr, 2026 | 16:09

WordPress Tagbox – UGC Galleries, Social Media Widgets, User Reviews & Analytics plugin <= 3.2 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Tagbox Taggbox allows Stored XSS.This issue affects Taggbox: from n/a through 3.2.

Vendor-Tagbox

Product-Taggbox

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32527

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 21.28%

7 Day CHG~0.00%

Published-17 Apr, 2024 | 09:46

Updated-28 Apr, 2026 | 16:09

WordPress Jotform Online Forms plugin <= 1.3.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jotform Jotform Online Forms allows Stored XSS.This issue affects Jotform Online Forms: from n/a through 1.3.1.

Vendor-Jotform jotform

Product-Jotform Online Forms jotform_online_forms

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2024-32130

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.29% / 21.28%

7 Day CHG~0.00%

Published-17 Apr, 2024 | 09:59

Updated-28 Apr, 2026 | 16:09

WordPress Payment Forms for Paystack plugin <= 3.4.1 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Paystack Payment Forms for Paystack allows Stored XSS.This issue affects Payment Forms for Paystack: from n/a through 3.4.1.

Vendor-Paystack

Product-Payment Forms for Paystack

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2023-31217

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.31% / 23.24%

7 Day CHG~0.00%

Published-18 Oct, 2023 | 12:47

Updated-28 Apr, 2026 | 16:08

WordPress User Location and IP Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in MyTechTalky User Location and IP plugin <= 1.6 versions.

Vendor-user_location_and_ip_project MyTechTalky

Product-user_location_and_ip User Location and IP

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-65473

Matching Score-4

Assigner-Patchstack

View Details

Matching Score-4

Assigner-Patchstack

CVSS Score-6.5||MEDIUM

EPSS-0.17% / 6.73%

7 Day CHG~0.00%

Published-23 Jul, 2026 | 11:18

Updated-23 Jul, 2026 | 16:17

WordPress Virtue/Ascend/Pinnacle Toolkit plugin <= 4.9.12 - Cross Site Scripting (XSS) vulnerability

Contributor Cross Site Scripting (XSS) in Virtue/Ascend/Pinnacle Toolkit <= 4.9.12 versions.

Vendor-Nexcess

Product-Virtue/Ascend/Pinnacle Toolkit

CWE ID-CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2026-66445

Credits

WordPress Open User Map plugin <= 1.4.46 - Cross Site Scripting (XSS) vulnerability

Vendors

Products

Metrics (CVSS)

Weaknesses

Attack Patterns

Solution/Workaround

References

EPSS History

Score

Latest Score

N/A

Percentile

Latest Percentile

N/A

Stakeholder-Specific Vulnerability Categorization (SSVC)

Affected Products

Affected

Problem Types

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

Affected Products

Metrics

Metrics Other Info

Impacts

Solutions

Configurations

Workarounds

Exploits

Credits

Timeline

Replaced By

Rejected Reason

References

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History

Similar CVEs