Reflected-Xss

WordPress — Pre-Auth XSS to RCE Chain via Login Page Parser Differential (CVE-2026-64638, "XSS2Shell") new EPSS 31%CVE-2026-64638webHIGH 8.9Unverified2026-08-09WordPress "List Site Contributors" Plugin Reflected XSS Scanner (CVE-2026-0594) newCVE-2026-0594webMEDIUMUnverified2026-07-05School Management System 1.0 — Reflected XSS in register.php (CVE-2026-37750) newCVE-2026-37750webMEDIUM 6.1Unverified2026-07-05OpenSTAManager Reflected XSS via `righe` Parameter (CVE-2026-24415) newCVE-2026-24415webMEDIUMPatched2026-07-05Gravity Forms Unauthenticated Reflected XSS via `gform_get_config` `form_ids` Parameter (CVE-2026-4406) newCVE-2026-4406webMEDIUM 6.1Patched2026-07-05