CVE-2024-12404

CVE-2024-12404 CF Internal Link Shortcode = 1.1.0 - Unauthenticated SQL Injection Description The CF Internal Link Shortcode plugin for WordPress is vulnerable to SQL Injection via the 'posttitle' parameter in all versions up to, and including, 1.1.0 due to insufficient escaping on the user...

CVE-2026-109979

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink handler verifies the nonce and that the current user c...

CVE-2026-109979 Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink handler verifies the nonce and that the current user c...

EUVD-2026-111747

The Related Posts for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.0 via the 'rp4wpcreatelink' parameter of the hidden 'rp4wplinkrelated' admin page. The handlecreatelink handler verifies the nonce and that the current user c...

CVE-2026-109979

The Related Posts for WordPress plugin for WordPress, versions up to and including 3.0.0 , is vulnerable to Sensitive Information Exposure due to a missing authorization check. The handle_create_link() handler fails to verify if a user has permission to read the child post IDs provided via the rp...

CVE-2026-109983

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

EUVD-2026-103276

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-109983 YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-109983 YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

CVE-2026-109983

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting (XSS) in versions up to and including 3.12.19 . The root cause is insufficient input sanitization and output escaping of the 'post_title' parameter. An authenticated attacker with Author-level access or hig...

CVE-2026-109983: Improper Neutralization of Input During Web Page Generation

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level...

WordPress YMC Filter Cross-Site Script Vulnerability

WordPress YMC Filter 3.12.19 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the posttitle parameter. It allows for the injection of arbitrary web scripts by attackers with author-level or higher...

CVE-2026-107650

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107650

The GeoDirectory plugin (WP Business Directory and Classified Listings Directory) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 2.8.190 . The root cause is insufficient input sanitization and output escaping within the post_title parameter. A...

EUVD-2026-100910

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107650 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107650 GeoDirectory <= 2.8.190 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Dynamic Content Field-Token Substitution via Listing Title

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

CVE-2026-107650: Improper Neutralization of Input During Web Page Generation

The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 2.8.190 due to insufficient input sanitization and output escaping. This makes it...

WordPress GeoDirectory cross-site scripting vulnerability

WordPress GeoDirectory 2.8.190 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping. Certified attackers with subscription-level or higher permissions can inject any web script into pages through the...

CVE-2026-85271

Open edX Platform enables the authoring and delivery of online learning at any scale. From Redwood until Ulmo and Verawood.1, the addadditionalattributestonotifications function in openedx/core/djangoapps/notifications/email/utils.py assigns notification content without sanitizing discussion-titl...