CVE-2026-3639

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-3639 PPWP – Password Protect Pages <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The PPWP – Password Protect Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's ppwp shortcode attributes in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possibl...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13177

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13177 Eventin < 4.1.20 - Contributor+ Order Information Disclosure via IDOR

The Eventin WordPress plugin before 4.1.20 does not properly restrict access to individual order records, allowing users with contributor-level access and above to read other customers' order data including personal information by iterating order identifiers...

CVE-2026-13177

CVE-2026-13177 concerns the WordPress plugin Eventin before 4.1.20, where an IDOR flaw allows users with contributor-level access and above to read other customers’ order data by iterating order identifiers. Affected component: Eventin WordPress plugin; vulnerability arises from improper access r...

CVE-2026-16974

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16974

The CVE concerns the Kirki – Freeform Page Builder, Website Builder & Customizer WordPress plugin. It is vulnerable to Stored Cross-Site Scripting via the post_meta Shortcode in all versions up to 6.2.0 due to insufficient input sanitization and output escaping. Consequence: authenticated attacke...

CVE-2026-16974

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the postmeta Shortcode in all versions up to, and including, 6.2.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-70056

Name of the Vulnerable Software and Affected Versions Kirki – Freeform Page Builder, Website Builder & Customizer versions prior to 6.2.1 Description Insufficient input sanitization and output escaping in the post meta Shortcode allow authenticated attackers with Contributor-level access or highe...

CVE-2026-15047 s2Member < 260805 - Contributor+ Stored XSS via Shortcode

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

EUVD-2026-54995

The s2Member WordPress plugin before 260805 does not escape several shortcode attributes before outputting them inside an inline script context, allowing users with contributor-level access to inject arbitrary JavaScript that executes when a viewer opens the post stored XSS...

CVE-2026-17018

The CVE-2026-17018 affects the CubeWP Framework WordPress plugin up to version 1.1.30. The REST API endpoint does not perform per-object read authorization and does not restrict which metadata keys may be requested, enabling users with the Contributor role or higher to read arbitrary post metadat...

CVE-2026-17010

The CVE-2026-17010 entry covers a stored XSS vulnerability in the Saitama Addon Pack WordPress plugin (versions up to 1.0.8). The issue arises because post metadata values are not properly sanitised or escaped before output, enabling users with contributor-level access and above to inject payload...

CVE-2026-17010 Saitama Addon Pack <= 1.0.8 - Contributor+ Stored XSS via Post Meta

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-17010

The Saitama Addon Pack WordPress plugin through 1.0.8 does not sanitise and escape certain post metadata values before outputting them, allowing users with contributor-level access and above to inject stored Cross-Site Scripting payloads that execute in the browser of a higher-privileged user who...

CVE-2026-16957

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-17011

The vulnerability affects the Nexter Blocks WordPress plugin, specifically versions prior to 5.0.2. A REST endpoint does not restrict who can save global CSS, allowing users with at least the Contributor role to store arbitrary CSS that is rendered site-wide, enabling defacement, content hiding, ...

EUVD-2026-54888

The Slim SEO WordPress plugin before 4.9.11 does not restrict a post-meta preview feature to posts the user is allowed to edit, verifying only read access, allowing users with the Contributor role to read arbitrary post meta, including protected and private keys, of published posts they do not ow...

CVE-2026-18988

The Easy Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'accordionTitleTag' block attribute in versions up to, and including, 3.1.8. This is due to insufficient input sanitization and output escaping in the accordionheaderrenderer function, which emits the...