WordPress Featured Image with URL plugin < 1.0.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Featured Image with URL versions 1.0.6...

EUVD-2026-75969

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

EUVD-2026-75967

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

EUVD-2026-75968

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

WordPress AI Builder plugin 2.4.1-2.7.7 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by md. minaruzzaman shovon in WordPress Plugin AI Builder versions 2.4.1-2.7.7...

CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

CVE-2026-85678 AI Builder 2.4.1 - 2.7.7 - Contributor+ Stored XSS via Post JavaScript

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-86780 Featured Image with URL < 1.0.6 - Contributor+ Stored XSS via Image Alt Text

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

CVE-2026-85677 Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript...

EUVD-2026-75966

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript...

CVE-2026-85677 Gutenverse News < 3.3.3 - Unauthenticated Stored XSS via Comment Content

The Gutenverse News WordPress plugin before 3.3.3 does not restrict the extra HTML it adds to WordPress's allowed elements to the context it is meant for, applying the same relaxed list to every sanitisation context including untrusted comments, allowing unauthenticated users to store JavaScript...

CVE-2026-74925 MultiVendorX 5.0.0 - 5.0.15 - Store Owner+ Privilege Escalation to Administrator

The MultiVendorX WordPress plugin before 5.0.16 does not restrict who can update its role and capability settings, allowing users holding its vendor role to grant that role administrator-level capabilities and take over the site...

CVE-2026-14565 Advanced Customized Prompts <= 1.0.1 - Subscriber+ Stored XSS via Product Popup Configuration

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-14565

The advanced-customized-prompts WordPress plugin (versions through 1.0.1 ) is vulnerable to a Stored XSS flaw. The issue arises because the plugin fails to perform necessary capability, ownership, or nonce checks before saving popup configurations to a product, and it fails to escape stored value...

WordPress YITH WooCommerce Wishlist plugin < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename vulnerability

Unauthenticated Arbitrary Wishlist Rename vulnerability discovered by Abdullah Kareem in WordPress Plugin YITH WooCommerce Wishlist versions 4.18.1...

WordPress Advanced Customized Prompts plugin <= 1.0.1 - Subscriber+ WooCommerce Order Item Metadata Tampering vulnerability

Subscriber+ WooCommerce Order Item Metadata Tampering vulnerability discovered by 0xBassia in WordPress Plugin Advanced Customized Prompts versions = 1.0.1...

EUVD-2026-75962

The advanced-customized-prompts WordPress plugin through 1.0.1 does not perform any capability, ownership, or nonce check before saving popup configuration to a product, nor escape the stored values on output, allowing any authenticated user such as a subscriber to store JavaScript that executes ...

CVE-2026-74925

The MultiVendorX WordPress plugin (versions 5.0.0-5.0.15 ) contains a privilege escalation vulnerability because it fails to restrict who can update its role and capability settings . This allows users with the vendor role to grant that role administrator-level capabilities , potentially leading ...

CVE-2026-82305 YITH WooCommerce Wishlist < 4.18.1 - Unauthenticated Arbitrary Wishlist Rename via change_wishlist_title

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...

EUVD-2026-75965

The YITH WooCommerce Wishlist WordPress plugin before 4.18.1 does not verify that a user is authorised to rename a given wishlist, allowing unauthenticated users to rename any wishlist on the site...