CVE-2026-85575
6.4 · Medium
Stored XSS in ShopEngine through the product title heading tag
Our Author-role PoC confirmed stored XSS in ShopEngine 4.8.9, from Elementor storage to execution in a visitor’s browser.
Language and package
PHP
PHP projects (Composer, WordPress).
7 write-ups, 12 vulnerabilities
CVE-2026-6504 +5
6.4 · Medium
Six stored XSS in WordPress plugins: when a tag name becomes an attack vector
Variant analysis of six WordPress plugins that printed an HTML tag name chosen by a Contributor without an allow-list, each leading to stored XSS.
CVE-2026-84191
6.1 · Medium
Stored XSS in LibreNMS through SNMP-sourced VRF names and descriptions
LibreNMS rendered VRF names, descriptions and route distinguishers polled over SNMP without escaping, so a rogue device could run script in an operator’s browser.
CVE-2026-34049
3.3 · Low
Command injection in Coolify MongoDB backups, an incomplete fix of CVE-2025-66209
The CVE-2025-66209 fix escaped database names in Coolify backups but not MongoDB collection names, which still reached a root shell on the server.
CVE-2026-33715
7.2 · High
Unauthenticated SSRF and open mail relay in Chamilo LMS through install.ajax.php
A leftover installer endpoint in Chamilo LMS 2.0 let anyone make the server open SMTP connections to any host and send mail through it.
CVE-2026-34160
8.6 · HighUnauthenticated SSRF in the Chamilo LMS PENS plugin through package and callback URLs
The PENS endpoint of Chamilo LMS 2.0 fetched package URLs and posted callbacks to addresses chosen by anyone, internal hosts and cloud metadata included.
pfSense-SA-26_03.webgui
Highlighted 5.2 · Medium
PfSense-SA-26_03: stored XSS in the ARP table through a DHCP-supplied hostname
A DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-85575 | ShopEngine (Elementor WooCommerce Builder) | Stored XSS through the product title heading tag | 6.4 Medium | |
| CVE-2026-18988 | Easy Accordion | Stored XSS through accordionTitleTag in Easy Accordion | 6.4 Medium | |
| CVE-2026-84191 | LibreNMS | Stored XSS in VRF pages from SNMP data | 6.1 Medium | |
| CVE-2026-11390 | News Kit Addons for Elementor | Stored XSS through the Site Logo Title and Single Author Box tags in News Kit Addons | 6.4 Medium | |
| CVE-2026-34049 | Coolify | Command injection through MongoDB collection names in database backups | 3.3 Low | |
| CVE-2026-8607 | myCred | Stored XSS through the wrap shortcode attribute in myCred | 6.4 Medium | |
| CVE-2026-8613 | aThemes Addons for Elementor | Stored XSS through title_tag in aThemes Addons | 6.4 Medium | |
| CVE-2026-8677 | Prime Elementor Addons | Stored XSS through widget HTML tag settings in Prime Elementor Addons | 6.4 Medium | |
| CVE-2026-6504 | Royal Addons for Elementor | Stored XSS through title_tag in Royal Addons | 6.4 Medium | |
| CVE-2026-34160 | Chamilo LMS | Unauthenticated SSRF through PENS package and callback URLs | 8.6 High | |
| CVE-2026-33715 | Chamilo LMS | Unauthenticated SSRF and mail relay through test_mailer | 7.2 High | |
| pfSense-SA-26_03.webgui | Netgate pfSense | Stored XSS in diag_arp.php via an ISC DHCP hostname | 5.2 Medium |
