CVEs rated high severity.
High-severity (CVSS 7.5) CWE-209 information disclosure in the Gantry 5 Framework WordPress plugin through 5.6.4 lets unauthenticated remote attackers retrieve embedded sensitive data from error messages. Discovered by neurotx via the Patchstack Bug Bounty…
CVE-2026-110384 is a reflected XSS (CWE-79) in the Heateor Support Fancy Comments WordPress plugin (fancy-facebook-comments), affecting all versions through 1.2.21 with a CVSS 3.1 score of 7.1 HIGH. Discovered by Pablo González Pérez via…
Stored cross-site scripting (CWE-79) in the European VAT Compliance Assistant for WooCommerce plugin through 1.36.10: unauthenticated attackers inject web scripts via a malicious CF-IPCountry header during guest checkout; the value is persisted verbatim into…
Stored XSS (CWE-79) in the GetPaid invoicing plugin for WordPress affecting all versions up to and including 2.8.61: unauthenticated attackers can inject scripts via the mmdwqzpoxadd parameter because the required nonce is publicly emitted…
CVE-2026-39800 is an unauthenticated XSS (CWE-79) in the Additional Order Filters for WooCommerce WordPress plugin, affecting versions up to and including 1.24 and rated HIGH at CVSS 7.1. Discovered by Tawatchai Pinsuwan via the…
Unauthenticated cross-site scripting (CWE-79) in the Qode Real Estate WordPress plugin affecting versions up to and including 1.1.7.3, scored 7.1 HIGH with changed scope. Discovered by Rafie Muhammad via the Patchstack Bug Bounty Program;…
CVE-2026-42631 is a high-severity (CVSS 7.1) unauthenticated Cross-Site Scripting vulnerability in the Qode Music WordPress plugin affecting all versions up to and including 2.1.8.2, discovered by Rafie Muhammad through the Patchstack Bug Bounty Program.
CVE-2026-40803 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the Jotform – AI Chatbot WordPress plugin affecting all versions up to and including 3.8.2, scored 7.1 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Discovered by daroo via the Patchstack…
Unauthenticated cross-site scripting (CWE-79) in the WP File Download WordPress plugin affecting all versions up to and including 6.3.6, scored 7.1 HIGH (CVSS 3.1) with changed scope. No privileges are required but victim interaction…
Reflected XSS (CWE-79) in the drfuri Martfury WooCommerce Marketplace WordPress theme, affecting all versions through 3.3.9. CVSS 7.1 High: network-exploitable with no privileges required, but user interaction is needed.