tag
Cwe-79
High
WP Time Slots Booking Form Unauthenticated Stored XSS (CVE-2026-40791)
CVE-2026-40791·
WP Time Slots Booking Form (wp-time-slots-booking-form WordPress plugin)
patched
Medium
TypiCMS Core — Stored XSS via Unsanitized SVG File Upload (CVE-2026-27621)
CVE-2026-27621 (GHSA-xfvg-8v67-j7wp)·
TypiCMS Core (typicms/core)
patched
Medium
School Management System 1.0 — Reflected XSS in register.php (CVE-2026-37750)
CVE-2026-37750·
School Management System (mahmoudai1) 1.0
unpatched
High
Saleor Rich Text (EditorJS) Field Stored XSS (CVE-2026-22849)
CVE-2026-22849 (GHSA-8jcj-r5g2-qrpv)·
Saleor (open-source e-commerce platform), rich text fields (EditorJS content on pages/products)
unpatched
High
oRPC OpenAPI Reference Plugin Stored XSS via Unescaped Spec Embedding (CVE-2026-33331)
CVE-2026-33331 (GHSA-7f6v-3gx7-27q8)·
middleapi/orpc — OpenAPI documentation reference plugin (packages/openapi/src/plugins/openapi-reference.ts)
patched
Medium
OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415)
CVE-2026-24415 (GHSA-jfgp-g7x7-j25j)·
OpenSTAManager (devcode-it/openstamanager)
patched
Medium
Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406)
CVE-2026-4406·
Gravity Forms (WordPress plugin) by Rocketgenius, Inc.
patched
Medium
ElementsKit Elementor Addons Authenticated Stored XSS via REST API (CVE-2026-2600)
CVE-2026-2600·
ElementsKit Elementor Addons (WordPress plugin)
patched
High
Bookly Booking Form Cookie-Based Stored XSS — CVE-2026-5513
CVE-2026-5513·
Bookly — Online Scheduling and Appointment Booking System (WordPress plugin)
patched