CVE-2026-97019: mohammed_kaludi AMP for WP – Accelerated Mobile Pages: The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…

The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'headline-' Shortcode Attribute in all versions up to, and including, 1.1.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

WordPress If-So Dynamic Content cross-site scripting vulnerability

WordPress If-So Dynamic Content versions 1.10.2 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and inadequate output escaping for the ‘conversion’ shortcode attribute, potentially enabling stored cross-site scripting attacks. It allo...

WordPress Waitlist Woocommerce cross-site scripting vulnerability

WordPress Waitlist Woocommerce versions 2.9.1 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping for the ‘type’ shortcode attribute, potentially allowing authenticated attackers with contributor or higher...

WordPress Post Snippets cross-site scripting vulnerability

WordPress Post Snippets versions 4.2.4 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. Authenticated attackers with contributor or higher privileges can exploit this by injecting arbitrary web scripts via shortcod...

PT-2026-127843

The GeoDirectory WordPress plugin before 2.8.196 does not properly escape a post badge shortcode attribute for a JavaScript context before placing it in an inline event handler, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks against anyone who...

PT-2026-127880

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsm showTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-77188: xootix Waitlist Woocommerce ( Back in stock notifier ): The Waitlist Woocommerce ( Back in stock notifier ) plugin for WordPress is vulnerable to Stored Cross-Site Scripting…

The Waitlist Woocommerce Back in stock notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

PT-2026-127892

The Waitlist Woocommerce Back in stock notifier plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'type' Shortcode Attribute in all versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-104740: ifso If-So Dynamic Content – Elementor & All Page Builders Personalization: The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored…

The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'conversion' Shortcode Attribute in all versions up to, and including, 1.10.2 due to insufficient input sanitization and output escaping. This makes it...

WordPress WP Inventory Manager SQL injection vulnerability

WordPress WP Inventory Manager versions 2.5.5 and earlier contain an SQL injection vulnerability. This vulnerability stems from a time-based SQL injection flaw in the sortorder shortcode. Due to insufficient sanitization and escaping of user-supplied parameters, as well as inadequate preparation ...

WordPress Travelly cross-site scripting vulnerability

WordPress Travelly versions 2.3.6 and earlier contain a cross-site scripting vulnerability. This vulnerability stems from insufficient input sanitization and output escaping of width, height, and zoom attributes in the ttbm-hotel-map shortcode. The ttbmhotelmapshortcode function concatenates thes...

PT-2026-127839

The MP3 Audio Player WordPress plugin before 5.16 does not escape one of its audio player shortcode attributes before outputting it into an HTML attribute, allowing users with Contributor-level access and above to inject arbitrary JavaScript that executes when another user, such as an administrat...

CVE-2026-116609: osamaesh WP Visitor Statistics (Real Time Traffic): The WP Visitor Statistics (Real Time Traffic) plugin for WordPress is vulnerable to SQL Injection via the 'from' (and…

The WP Visitor Statistics Real Time Traffic plugin for WordPress is vulnerable to SQL Injection via the 'from' and sibling 'to'/'first'/'second' shortcode attribute of the wsmshowTrafficStatsList shortcode in versions up to, and including, 8.8 This is due to insufficient escaping on the...

CVE-2026-76005: chuck1982 WP Inventory Manager: The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sort_order' Shortcode…

The WP Inventory Manager plugin for WordPress is vulnerable to time-based SQL Injection via 'sortorder' Shortcode Attribute in all versions up to, and including, 2.5.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This...

CVE-2026-109590: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce: The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height'…

The Tour Booking Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'width', 'height' and 'zoom' shortcode attributes of the ttbm-hotel-map shortcode in versions up to, and including, 2.3.6 This is due to insufficient input sanitization and output escaping on user...

WordPress Beaver Builder CVE-2026-92084 shortcode execution

CVE-2026-92084 Beaver Builder Lite = 2.11.0.5: posts a comment whose author name contains a registered shortcode; if the builder page Sidebar module renders Recent Comments, doshortcode executes the payload on page render. Requires comment approval auto-approve or moderator. Lab marker shortcode...

WordPress Beaver Builder CVE-2026-92084 detect

Detects Beaver Builder Lite = 2.11.0.5 CVE-2026-92084: Sidebar module widget output may execute registered shortcodes via layout-wide doshortcode. !/usr/bin/env python3 -- coding: utf-8 -- """Detect Beaver Builder Lite CVE-2026-92084 exposure.""" from kittysploit import from...

WordPress Advanced Custom Fields: Extended PRO plugin 0.9.2.4-0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin Advanced Custom Fields: Extended PRO versions 0.9.2.4-0.9.2.7...

WordPress Advanced Custom Fields: Extended plugin 0.9.2.4-0.9.2.7 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin ACF Extended versions 0.9.2.4-0.9.2.7...

CVE-2026-113493

The GeoDirectory WordPress plugin before 2.8.194 does not sanitise and escape some of its map shortcode attributes before outputting them within a style attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of any...