UKO

JetFormBuilder <= 3.6.8 - Unauthenticated Stored Cross-Site Scripting via Dynamic Value Block `to_set` Property

Photo Gallery, Sliders, Proofing and Themes <= 4.5.4 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment `title` Attribute via Shutter Lightbox innerHTML

SureCart <= 4.9.4 - Unauthenticated Stored Cross-Site Scripting via 'manual-payment-instructions' Attribute of sc-order-manual-instructions in Comments

User Submitted Posts <= 20260916 - Unauthenticated Stored DOM-Based Cross-Site Scripting via 'user-submitted-content' Parameter via Block-Comment Shortcode Splitting

Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Split Text innerText

Greenshift <= 13.2.1 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Comment Content via Nested Latest Comments Block

HT Mega Addons for Elementor <= 3.2.7 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Tabs Widget href DOM Sink

Ultimate Member <= 2.14.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'user_url' Profile Field

Payment forms, Buy now buttons, and Invoicing System | GetPaid <= 2.8.61 - Unauthenticated Stored Cross-Site Scripting via 'mmdwqzpoxadd' Parameter

User Profile Builder <= 4.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'display_name' Parameter