CVE-2022-42096

Backdrop CMS versión 1.23.0 Explicación de la vulnerabilidad: Se descubrió que Backdrop CMS versión 1.23.0 contiene una vulnerabilidad de cross-site scripting XSS almacenado a través del contenido Post. Vectores de ataque: El atacante debe publicar algo en "Post content" e insertar el payload XSS...

WordPress Alt Text AI – Automatically generate image alt text for SEO and accessibility plugin <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Post Content Modification vulnerability discovered by Webbernaut in WordPress Plugin Download Alt Text AI versions = 1.10.41...

CVE-2026-104414

Ghost from 2.5.0 before 6.64.0 contains a stored cross-site scripting vulnerability that allows attackers to inject untrusted scripts into post content via oEmbed photo responses. Attackers can host malicious oEmbed photo responses so that embedding their URL stores scripts that run in the Ghost...

CVE-2025-57926

Sink: Según el mecanismo del núcleo de WordPress, el XSS se previene en el contenido de las publicaciones, pero con este plugin, el contenido se codifica y luego se decodifica al renderizarse, creando involuntariamente una vulnerabilidad XSS." PoC: El payload codificado en base64 es...

Exploit for CVE-2026-93485

Laboratorio pedagógico — CVE-2026-93485 "Comment2Shell" W...

PT-2026-98371

Name of the Vulnerable Software and Affected Versions Blog2Social: Social Media Auto Post & Scheduler versions prior to 9.1.1 Description An authorization bypass exists because the software fails to properly verify if a user is authorized to perform specific actions. Authenticated attackers with...

CVE-2026-15731

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15731

The WP Multilang – Translation and Multilingual Plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.31 . The root cause is insufficient input sanitization and output escaping within the post content. This allows authenticated attackers with ...

CVE-2026-15731 WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

EUVD-2026-85837

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15731 WP Multilang – Translation and Multilingual Plugin <= 2.4.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

CVE-2026-15731: Improper Neutralization of Input During Web Page Generation

The WP Multilang – Translation and Multilingual Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the post content in all versions up to, and including, 2.4.31 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers...

PT-2026-97775

Name of the Vulnerable Software and Affected Versions WP Multilang – Translation and Multilingual Plugin versions prior to 2.4.32 Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site...

CVE-2026-87071

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

CVE-2026-87848 MPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure

The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenticated visitors to retrieve the title, content or excerpt o...

WordPress MPCX Lightbox plugin 1.2.2-1.2.5 - Unauthenticated Non-Public Post Content Disclosure vulnerability

Unauthenticated Non-Public Post Content Disclosure vulnerability discovered by Brian Willows in WordPress Plugin MPCX Lightbox versions 1.2.2-1.2.5...

CVE-2026-87071

The Forminator Forms WordPress plugin versions before 1.57.2.1 is vulnerable to Unauthenticated Post Meta Injection . The root cause is the plugin's failure to restrict metadata keys provided during form submissions or to exclude keys reserved by WordPress. Consequently, unauthenticated visitors ...

PT-2026-97273

The Forminator Forms WordPress plugin before 1.57.2.1 does not restrict which metadata keys a form submission may supply, and does not exclude the keys WordPress reserves for its own use, so unauthenticated visitors submitting a public form that collects post content can attach metadata of their...

EUVD-2026-80189

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...

PT-2026-93290

The Schema & Structured Data for WP & AMP WordPress plugin before 1.66 does not check that a user is allowed to edit the specific post they request schema generation for, allowing users with the contributor role and above to obtain the content of other users' draft, pending, private and password...