EUVD-2026-50099

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'currentPostId' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-17161 WowStore <= 4.4.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'filterMobileText' Block Attribute

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-17161

The WowStore – Store Builder & Product Blocks for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'filterMobileText' Block Attribute in all versions up to, and including, 4.4.24 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

CVE-2026-12939 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'link' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

EUVD-2026-50096

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

CVE-2026-12939

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'link' attribute of the postthumbnail and newsletterspostthumbnail shortcodes in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postthumbnai...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

CVE-2026-15735

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12938 Newsletters <= 4.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'target' Shortcode Attribute

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

EUVD-2026-50094

The Contact Form to Any API plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'cf7anyapiformfield' Post Meta in all versions up to, and including, 3.0.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-12938

The CVE-2026-12938 entry describes a Stored XSS in the WordPress Newsletters Lite plugin (versions up to 4.15). The vulnerability stems from insufficient input sanitization and output escaping in the posts_single() function (injects attacker-controlled target into $wpml_target) and in the shortco...

EUVD-2026-50095

The Newsletters Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'target' attribute of the newsletterspost shortcode in versions up to and including 4.15. This is due to insufficient input sanitization and output escaping in the postssingle function which propagates...

CVE-2026-15735

The vulnerability CVE-2026-15735 affects the WordPress plugin Contact Form to Any API (all versions up to 3.0.6). It is a Stored Cross-Site Scripting (XSS) flaw in the Post Meta field named cf7anyapi_form_field , caused by insufficient input sanitization and output escaping. Authenticated attacke...

PT-2026-65905

Name of the Vulnerable Software and Affected Versions Sourcecodester Fantastic Blog CMS version 1.0 Description Cross Site Scripting XSS occurs in the 'pageEditMember.php' endpoint through the address field. XSS is a flaw that allows an attacker to inject malicious scripts into web pages viewed b...

PT-2026-65727

The Database for CF7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Array Form Field Values in all versions up to, and including, 1.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

PT-2026-65781

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbm best seller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

PT-2026-65696

The WOLF WordPress plugin before 1.1.0 does not perform a nonce or capability check on one of its AJAX actions, allowing an unauthenticated attacker to trick a logged-in administrator into writing arbitrary content, including a malicious script, into a post via a cross-site request, resulting in...

PT-2026-65772

The Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Name Field Nested password Member in all versions up to, and including, 6.2.7 due to insufficient input sanitization and output escaping...

CVE-2025-65337: Improper Neutralization of Input During Web Page Generation

Sourcecodester Fantastic Blog CMS 1.0 is vulnerable to Cross Site Scripting XSS in pageEditMember.php via the address field...