CVE-2026-111967

The MP3 Audio Player WordPress plugin (versions 5.9 through 5.15 ) contains a vulnerability where it fails to escape an audio player shortcode attribute before outputting it into an HTML attribute. This allows users with Contributor-level access and above to perform a Stored Cross-Site Scripting ...

CVE-2026-111967 MP3 Audio Player by Sonaar 5.9 - 5.15 - Contributor+ Stored XSS via Shortcode Attribute

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

EUVD-2026-111713

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site...

CVE-2026-110524

The Copy Anything to Clipboard for WordPress plugin (versions before 5.5.5 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize and escape a shortcode attribute (specifically the 'success-text' attribute) before it is stored and subsequently rendered vi...

CVE-2026-116613 Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute

The Animated Text Block plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.6 via the 'animated-text' shortcode. This is due to the atbshortcodehandler function fetching an arbitrary post by attacker-supplied ID and, in the 'publish' branch,...

CVE-2026-116613

The Animated Text Block plugin for WordPress (versions up to and including 1.2.6 ) is vulnerable to Sensitive Information Exposure via the animated-text shortcode. The root cause is that the atb_shortcode_handler() function fetches an arbitrary post using an attacker-supplied ID and executes disp...

CVE-2026-97019

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97019 AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97019 AMP for WP <= 1.1.17 - Unauthenticated Stored Cross-Site Scripting via 'headline-*' Shortcode Attribute

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

EUVD-2026-111562

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2026-97019

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting (XSS) in versions up to and including 1.1.17 . The root cause is insufficient input sanitization and output escaping regarding the 'headline-*' Shortcode Attribute . Specifi...

PT-2026-127793

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

Mohammed Kaludi AMP for WP cross-site scripting vulnerability

Mohammed Kaludi AMP for WP versions 1.1.17 and earlier contain a cross-site scripting vulnerability. This flaw arises from insufficient input sanitization and output escaping via the ‘headline-’ shortcode attribute. Unauthenticated attackers can inject arbitrary web scripts into pages, which are...

CVE-2026-77871: saadiqbal Post Snippets – Custom WordPress Code Snippets Customizer: The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site…

The Post Snippets – Custom WordPress Code Snippets Customizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 4.2.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-111967: Unknown MP3 Audio Player: The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before…

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

CVE-2026-113488: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a…

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

WordPress If-So Dynamic Content cross-site scripting vulnerability

WordPress If-So Dynamic Content versions 1.10.2 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and inadequate output escaping for the ‘conversion’ shortcode attribute, potentially enabling stored cross-site scripting attacks. It allo...

WordPress Waitlist Woocommerce cross-site scripting vulnerability

WordPress Waitlist Woocommerce versions 2.9.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for the ‘type’ shortcode attribute, potentially allowing authenticated attackers with contributor or higher...

PT-2026-127889

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort order' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-110524: Unknown Copy Anything to Clipboard for WordPress: The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode…

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site...