CVE-2026-85575
6.4 · Medium
Stored XSS in ShopEngine through the product title heading tag
Our Author-role PoC confirmed stored XSS in ShopEngine 4.8.9, from Elementor storage to execution in a visitor’s browser.
Vulnerability class
XSS
Stored cross-site scripting: HTML or JavaScript rendered unescaped in another user’s browser.
4 write-ups, 9 vulnerabilities
CVE-2026-6504 +5
6.4 · Medium
Six stored XSS in WordPress plugins: when a tag name becomes an attack vector
Variant analysis of six WordPress plugins that printed an HTML tag name chosen by a Contributor without an allow-list, each leading to stored XSS.
CVE-2026-84191
6.1 · Medium
Stored XSS in LibreNMS through SNMP-sourced VRF names and descriptions
LibreNMS rendered VRF names, descriptions and route distinguishers polled over SNMP without escaping, so a rogue device could run script in an operator’s browser.
pfSense-SA-26_03.webgui
Highlighted 5.2 · Medium
PfSense-SA-26_03: stored XSS in the ARP table through a DHCP-supplied hostname
A DHCP client on the local network could store a hostname carrying JavaScript that ran in a pfSense administrator’s browser when they opened the ARP table.
Vulnerabilities
| Identifier | Product | Vulnerability | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-85575 | ShopEngine (Elementor WooCommerce Builder) | Stored XSS through the product title heading tag | 6.4 Medium | |
| CVE-2026-18988 | Easy Accordion | Stored XSS through accordionTitleTag in Easy Accordion | 6.4 Medium | |
| CVE-2026-84191 | LibreNMS | Stored XSS in VRF pages from SNMP data | 6.1 Medium | |
| CVE-2026-11390 | News Kit Addons for Elementor | Stored XSS through the Site Logo Title and Single Author Box tags in News Kit Addons | 6.4 Medium | |
| CVE-2026-8607 | myCred | Stored XSS through the wrap shortcode attribute in myCred | 6.4 Medium | |
| CVE-2026-8613 | aThemes Addons for Elementor | Stored XSS through title_tag in aThemes Addons | 6.4 Medium | |
| CVE-2026-8677 | Prime Elementor Addons | Stored XSS through widget HTML tag settings in Prime Elementor Addons | 6.4 Medium | |
| CVE-2026-6504 | Royal Addons for Elementor | Stored XSS through title_tag in Royal Addons | 6.4 Medium | |
| pfSense-SA-26_03.webgui | Netgate pfSense | Stored XSS in diag_arp.php via an ISC DHCP hostname | 5.2 Medium |
