PULSE
ES
FEED
ransomvexy ransomware reclama a Guarufilme · BR · Otherransomauditteam reclama a AD***ed · GB · Not Foundransomauditteam reclama a Ze***ce · IT · Not Foundransomauditteam reclama a Sa***ge · GB · Not Foundransompanzer reclama a Valode & Pistre · FR · Professional Servicesransompanzer reclama a Zenidoc · Professional Servicesransomn0n reclama a MarieBelle New York · US · Retail & E-Commerceransomn0n reclama a PG Group (Pure Options) · Financial Servicesransomemperador reclama a CMC AUDITORES SRL · AR · Professional Servicesransombyod reclama a Decorolala · Retail & E-Commerceransomaurora reclama a The Buckner Company, Inc. · US · Otherransomplay reclama a The Innovation Group · US · Otherransomplay reclama a DFK Group · DE · Professional Servicesransomplay reclama a Saddlers Court MFG · GB · Manufacturingransomvexy ransomware reclama a Guarufilme · BR · Otherransomauditteam reclama a AD***ed · GB · Not Foundransomauditteam reclama a Ze***ce · IT · Not Foundransomauditteam reclama a Sa***ge · GB · Not Foundransompanzer reclama a Valode & Pistre · FR · Professional Servicesransompanzer reclama a Zenidoc · Professional Servicesransomn0n reclama a MarieBelle New York · US · Retail & E-Commerceransomn0n reclama a PG Group (Pure Options) · Financial Servicesransomemperador reclama a CMC AUDITORES SRL · AR · Professional Servicesransombyod reclama a Decorolala · Retail & E-Commerceransomaurora reclama a The Buckner Company, Inc. · US · Otherransomplay reclama a The Innovation Group · US · Otherransomplay reclama a DFK Group · DE · Professional Servicesransomplay reclama a Saddlers Court MFG · GB · Manufacturing
← All CVEs
CVE WatchOct 12, 2026

CVE-2026-108168

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-t

CVSS

6.5

Medium

EPSS

0.2%

p5

KEV

—

Exploit Today

1

0-100

Published: Oct 12, 2026 · Last modified: Oct 12, 2026 · CWE-79

EPSS · 30d

Not enough EPSS history yet.

Technical description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DLX Plugins Custom Query Blocks post-type-archive-mapping allows Stored XSS.This issue affects Custom Query Blocks: from n/a through 5.6.0.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1088344.3 MED
—
——0A vulnerability was detected in Cairo-dock Glx-Dock up to 3.4.0. This issue affects some unknown processing of the file ww_page.php of the component Query Parameter Handler. Performing a manipulation of the argument p results in cross site scripting. The attack is possible to be carried out remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.1dCVE-2026-1054108.7 HIG
—
——0A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.1dCVE-2026-1054098.7 HIG
—
——0A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.1dCVE-2026-1054088.7 HIG
—
——0A Stored Cross-site Scripting (XSS) vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5 could allow an attacker to execute arbitrary script code in user's browser session.1dCVE-2026-1088153.5 LOW
13.9%
——4A vulnerability has been found in idcCMS 1.70. Affected is an unknown function of the file admin/member_deal.php. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used.1dCVE-2026-1078666.5 MED
4.7%
——1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetElements For Elementor jet-elements allows Stored XSS.This issue affects JetElements For Elementor: from n/a through 2.9.2.3.1d