CVE-2026-119054 Multiple Pages Generator by Themeisle before 4.2.5 Stored XSS via Shortcode base-url

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the mpg and mpgmatch shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by...

CVE-2026-119054

The Multiple Pages Generator by Themeisle plugin, versions prior to 4.2.5 , is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the base-url attribute of the [mpg] and [mpg_match] shortcodes. An attacker with Contributor-level privileges can inject entity-encoded payloads that...

PT-2026-130675

The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'search-string' parameter in all versions up to, and including, 3.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2026-130679

The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.0.5. This is due to the /wp-json/mapster-wp-maps/save-mapmaker REST route being registered with a permission callback that unconditionally returns true no capability check, no...

PT-2026-132128

Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows Contributor-level users to inject script via the mpg and mpg match shortcode base-url attribute. Attackers can store entity-encoded payloads that pass kses but are decoded by html...

CVE-2026-77188

The Waitlist Woocommerce Back in stock notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-77871

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-116609

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-109590

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the ttbm-hotel-map shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user...

CVE-2026-76005 WP Inventory Manager <= 2.5.5 - Authenticated (Contributor+) SQL Injection via 'sort_order' Shortcode Attribute

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-76005

The WP Inventory Manager plugin for WordPress (all versions up to and including 2.5.5 ) is vulnerable to a time-based SQL Injection via the 'sort_order' shortcode attribute. The root cause is insufficient escaping of user-supplied parameters and a lack of sufficient preparation on existing SQL qu...

CVE-2026-77871 Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-77871

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress (versions up to and including 4.2.4 ) is vulnerable to Stored Cross-Site Scripting (XSS) via shortcode attributes. The root cause is insufficient input sanitization and output escaping; specifically, entity-encoded...

EUVD-2026-111606

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-77871 Post Snippets <= 4.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-110071 Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-110071 Mang Board <= 2.4.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'align' Shortcode Attribute

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'align' parameter in all versions up to, and including, 2.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and...

CVE-2026-110071

The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.5 . The root cause is insufficient input sanitization and output escaping specifically related to the 'align' shortcode attribute. An authenticated attacker with contributor-...

CVE-2026-104729 Avada (Fusion) Builder <= 3.16.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tab_index' and 'empty_notice' Shortcode Attributes

The Avada Fusion Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tabindex, emptynotice' parameter in all versions up to, and including, 3.16.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-77188

The Waitlist Woocommerce (Back in stock notifier) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.9.1 . The root cause is insufficient input sanitization and output escaping of the 'type' shortcode attribute . Because shortcode attribute v...