9219 matches found
CVE-2025-15696 Real3D Flipbook Lite < 5.4 - Author+ Stored XSS
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
CVE-2025-15696 Real3D Flipbook Lite < 5.4 - Author+ Stored XSS
The Real3D Flipbook WordPress plugin before 5.4 does not sanitize or escape several flipbook editor fields before rendering them back in the admin editor, allowing users with the Author role and above to inject arbitrary web scripts that execute in the browser of any user who later opens the...
CVE-2026-94500: Improper Neutralization of Input During Web Page Generation
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...
PT-2026-97467
Contributor Cross Site Scripting XSS in ElementsKit Elementor addons Lite = 4.0.5 versions...
WordPress WP Import Export Lite plugin < 3.9.35 - Authenticated Privilege Escalation vulnerability
Authenticated Privilege Escalation vulnerability discovered by mak3breadMinseong Kim in WordPress Plugin WP Import Export Lite versions 3.9.35...
CVE-2026-15098
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...
CVE-2026-15098
The Real3D Flipbook Lite WordPress plugin (up to 5.1.1 ) has a Stored Cross-Site Scripting flaw in the on_shortcode() and print_global_options() functions. Shortcode attribute values (e.g. lightboxtext) are copied into $this->flipbook_options and emitted via wp_json_encode() inside a sequence...
EUVD-2026-83560
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...
CVE-2026-76554
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...
CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...
CVE-2026-76554
The WP Import Export Lite WordPress plugin (versions before 3.9.35 ) is vulnerable to an authenticated privilege escalation due to improper privilege management. The plugin fails to verify if a user running an import is authorized to create or modify user accounts and assign roles. This allows us...
CVE-2026-76554 WP Import Export Lite < 3.9.35 - Authenticated Privilege Escalation via User Import
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...
EUVD-2026-83500
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...
CVE-2026-15098: Improper Neutralization of Input During Web Page Generation
The Real3D Flipbook Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'lightboxtext' shortcode attribute and other unsanitized attributes handled by onshortcode in versions up to, and including, 5.1.1. This is due to insufficient input sanitization and output escaping...
CVE-2026-76554: Improper Privilege Management
The WP Import Export Lite WordPress plugin before 3.9.35 does not verify that the user running an import is permitted to create or modify user accounts and assign roles, allowing users granted a delegated WP Import Export Lite WordPress plugin before 3.9.35 permission, who cannot otherwise manage...
PT-2026-95778
Name of the Vulnerable Software and Affected Versions Real3D Flipbook Lite versions prior to 5.1.2 Description Stored Cross-Site Scripting is possible due to insufficient input sanitization and output escaping in the on shortcode and print global options functions. The issue occurs when shortcode...
PT-2026-95753
Name of the Vulnerable Software and Affected Versions WP Import Export Lite WordPress plugin versions prior to 3.9.35 Description The plugin fails to verify if the user performing an import has the necessary permissions to create or modify user accounts and assign roles. This allows users with...
WordPress Hotel Booking Lite plugin < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint vulnerability
Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint vulnerability discovered by Haitam Lazaar in WordPress Plugin Hotel Booking Lite versions 6.2.3...
WordPress WPForms Lite plugin < 1.10.0.5 - Unauthenticated PayPal Webhook Forgery vulnerability
Unauthenticated PayPal Webhook Forgery vulnerability discovered by Sudhanshu Chauhan RedHunt Labs in WordPress Plugin Contact Form by WPForms versions 1.10.0.5...