CVE-2025-68999-POC

CVE-2025-68999 Happy Addons for Elementor prepare, но затем вставляет $entry-metakey прямо в строку SQL без экранирования: root@kitploit: $records = " $duplicatedpostid, '$entry-metakey', '$value' "; // ... $wpdb-query $query ; Поскольку metakey берется из базы данных, код считает его доверенным...

CVE-2026-76558

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

EUVD-2026-80205

The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration before outputting it back in the chart editor, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any higher-privileged user, such...

CVE-2026-84088 Xpro Elementor Addons < 1.7.9 - Contributor+ Stored XSS via Interactive Circle Widget

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 does not validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call, allowing users with the contributor role and above to inject and store JavaScript that executes in the browse...

CVE-2026-84088

The Xpro Addons — 140+ Widgets for Elementor WordPress plugin before 1.7.9 contains a stored XSS vulnerability in the Interactive Circle Widget . The root cause is the failure to validate or sanitize a widget link setting before storing and using it in a JavaScript navigation call. Users with the...

CVE-2026-76558 WP Import Export Lite < 3.9.33 - Contributor+ Stored DOM XSS via Custom Field Names

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

CVE-2026-76558

The WP Import Export Lite WordPress plugin (versions before 3.9.33 ) fails to escape custom field names retrieved from the database before inserting them into the DOM of an administration screen. This allows users with the Contributor role or higher to perform a Stored DOM XSS attack that execute...

EUVD-2026-80182

The WP Import Export Lite WordPress plugin before 3.9.33 does not escape custom field names retrieved from the database before inserting them into the DOM of one of its administration screens, allowing users with a role as low as contributor to perform Stored XSS attacks which will trigger in the...

WordPress Product XML Feed Manager for WooCommerce plugin < 3.1.1 - Contributor+ Arbitrary Product Deletion vulnerability

Contributor+ Arbitrary Product Deletion vulnerability discovered by Abdullah Kareem cyberkareem in WordPress Plugin Product XML Feed Manager for WooCommerce versions 3.1.1...

EUVD-2026-75969

The Featured Image with URL WordPress plugin before 1.0.6 does not sanitise and escape a stored image attribute value before outputting it, which could allow users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks that execute in the browser of any user viewing the...

CVE-2026-86779 Visualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart

The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification, allowing users with the Contributor role and above to permanently delete any chart on the site, including chart...

WordPress Featured Image with URL plugin < 1.0.6 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin Featured Image with URL versions 1.0.6...

WordPress CoolClock plugin < 4.3.8 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin CoolClock versions 4.3.8...

CVE-2026-19840 Notiqoo < 1.4.14 - Contributor+ Arbitrary Option Update via Multiple AJAX Actions

The Notiqoo WordPress plugin before 1.4.14 does not have capability checks on several of its AJAX actions and builds the name of the option to write from user input, allowing users with a role as low as contributor to modify arbitrary WordPress options, which can be used to deactivate Notiqoo...

WordPress Builderall for WordPress plugin <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Builderall Builder for WordPress versions = 3.0.2...

CVE-2026-75905

The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-83541 Sina Extension for Elementor 3.7.1 - 3.10.3 - Contributor+ Stored XSS via Table Widget

The Sina Extension for Elementor WordPress plugin before 3.10.4 does not properly escape a Table widget setting before outputting it within an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-15690

CVE-2025-15690 is a Stored Cross-Site Scripting (XSS) vulnerability in the Content Mask WordPress plugin, affecting versions 1.7.1 through 1.8.5.5 . The root cause is improper sanitization and escaping of post content—specifically scripts and styles submitted by an author—before being output in g...

CVE-2026-84028

The Bold Page Builder WordPress plugin before 5.9.9 does not sanitise and escape a shortcode attribute before outputting it in an HTML attribute, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84927

The EmbedPress WordPress plugin (versions 4.6.0–4.6.3 ) contains an insufficient authorization check on a Google Reviews REST API route . Users with the Contributor role or higher can modify the site-wide store, deleting entries configured by an administrator and injecting their own , which are r...