CVE-2026-7877

WP Recipe Maker Premium for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in the wprm-call-to-action shortcode, affecting all versions up to and including 10.5.0 . The root cause is insufficient input sanitization and output escaping on user-supplied attributes. Attackers with cont...

Meta Box <= 5.11.1 - Arbitrary File Deletion

The Meta Box plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the ajaxdeletefile function. This makes it possible for authenticated attackers with Contributor-level access and above to delete arbitrary files on the server. id: CVE-2026-3946...

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16788

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16788

The Live Composer – Free WordPress Website Builder plugin (versions up to and including 2.1.19 ) is vulnerable to Stored Cross-Site Scripting via the dslc_module_projects_output shortcode. The root cause is insufficient input sanitization and output escaping: WordPress's shortcode-aware kses filt...

CVE-2026-16788 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-68999

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16786

The Live Composer – Free WordPress Website Builder plugin (versions ≤ 2.1.19) is vulnerable to Stored Cross-Site Scripting via the dslc_module_testimonials_output Shortcode. The root cause is insufficient input sanitization and output escaping: the injected payload survives save-time wp_kses_post...

CVE-2026-16786 Live Composer <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

EUVD-2026-68998

The Live Composer – Free WordPress Website Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode in all versions up to, and including, 2.1.19 due to insufficient input sanitization and output escaping. This makes it possible for...

gitcolombo

Gitcolombo OSINT tool that extracts identities — names, emails, and links between seemingly unrelated accounts — from git repositories and GitHub. Python CLI gitcolombo.py — clones repos, walks git log, and can call the GitHub API for richer signals. Web version gitcolombo.html — a single static...

WordPress WP Recipe Maker Premium plugin <= 10.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'wprm-call-to-action' Shortcode vulnerability discovered by theviper17y in WordPress Plugin WP Recipe Maker Premium versions = 10.5.0...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_testimonials_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduletestimonialsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

WordPress Live Composer plugin <= 2.1.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via dslc_module_projects_output Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via dslcmoduleprojectsoutput Shortcode vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Page Builder: Live Composer versions = 2.1.19...

CVE-2026-75980

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-75980

CVE-2026-75980 is a Stored Cross-Site Scripting (XSS) vulnerability in the BetterDocs WordPress plugin (versions ≤ 4.8.1), discovered by Wordfence PRISM . The flaw resides in the Heading 'id' attribute within post content: entity-encoded quotes bypass wp_kses_post at save time, and the payload ma...

EUVD-2026-68986

The BetterDocs – AI Documentation, Knowledge Base, Docs, Wikis, FAQ with Chatbot plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Heading 'id' Attribute in Post Content in all versions up to, and including, 4.8.1 due to insufficient input sanitization and output escaping. Thi...

CVE-2026-77189

The Charitable WordPress plugin (Donation & Fundraising Platform) is vulnerable to SQL Injection via the 'order' attribute of the [charitable_donors] shortcode in all versions up to and including 1.8.12.1 . The root cause is insufficient escaping of the user-supplied parameter combined with a lac...

EUVD-2026-68983

The Charitable – Donation & Fundraising Platform Donation Forms, Recurring Donations & Fundraising Campaigns plugin for WordPress is vulnerable to generic SQL Injection via 'order' Shortcode Attribute in all versions up to, and including, 1.8.12.1 due to insufficient escaping on the user supplied...

CVE-2026-75965

The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'date' Shortcode Attribute in all versions up to, and including, 4.0.0 due to insufficient input sanitization and output escaping...