CVE-2025-15693

CVE-2025-15693 is a path traversal vulnerability in the JCH Optimize WordPress plugin, affecting versions 4.2.1 through 5.0.0 . The flaw occurs in an administrative image-browsing feature that fails to restrict directory paths to the site's web root, allowing high-privilege users (administrators ...

EUVD-2025-210850

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

CVE-2025-15694 Joli Table Of Contents 2.0.0 - 2.8.0 - Admin+ Stored XSS

The Joli Table Of Contents WordPress plugin before 2.8.1 does not sanitise and escape some of its settings before outputting them in an admin page, which could allow high-privilege users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability ...

WordPress Joli Table Of Contents plugin 2.0.0-2.8.0 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Krugov Artyom in WordPress Plugin Joli Table Of Contents versions 2.0.0-2.8.0...

CVE-2026-77263 iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more <= 3.13.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-71844

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-18404

CVE-2026-18404 affects the Social Chat – Click To Chat App Button (WP WhatsApp Chat) WordPress plugin, versions up to and including 8.6.2 . The vulnerability is a Stored Cross-Site Scripting (XSS) caused by insufficient input sanitization and output escaping of the consent_message JSON attribute ...

EUVD-2026-71843

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-77233

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin is affected by an unauthenticated Stored Cross-Site Scripting (XSS) via Comment Content via AdSense Regex Rewrite in all versions up to and including 3.13.4 . The root cause is insufficient input sanitizati...

CVE-2026-18404 Social Chat <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box

The Social Chat – Click To Chat App Button plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box in all versions up to, and including, 8.6.2 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-71842

The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via AdSense Regex Rewrite in all versions up to, and including, 3.13.4 due to insufficient input sanitization and output escaping. This...

CVE-2025-14945 Events Manager - Calendar, Bookings, Tickets, and more! <= 7.3.3 - Unauthenticated Stored Cross-Site Scripting via Event Attributes

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

CVE-2026-8625

Dear Flipbook (PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer) for WordPress is vulnerable to Authenticated Stored XSS in all versions up to and including 2.4.30 . An attacker with Contributor-level access can inject a crafted .df-element div with data-df-lightbox='thumb' via a Custom HTML bloc...

CVE-2026-83628

Theme My Login plugin for WordPress (versions

CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2025-210848

The Events Manager - Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to Stored Cross-Site Scripting via event attribute values in all versions up to, and including, 7.3.3. This is due to insufficient input sanitization when storing attribute values using only wpunslash...

EUVD-2026-71841

The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...

EUVD-2026-71840

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2026-83628 Theme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage

The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due to the tmlmssignuphandler function's gimmeanotherblog branch failing to enforce the network's activesignup registration policy, checking...

CVE-2025-14945

The Events Manager plugin for WordPress (versions ≤ 7.3.3) is vulnerable to Stored Cross-Site Scripting via event attribute values. The root cause is insufficient input sanitization—attribute values are processed with only wp_unslash() without further sanitization—and a lack of output escaping wh...