Lucene search
+L

9220 matches found

EUVD
EUVD
added 7 hours ago3 views

EUVD-2026-52161

The Simply Schedule Appointments WordPress plugin before 1.6.12.11 does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users, allowing users with the Contributor role and above to disclose all customers'...

5.4AI score
SaveExploits0References1
CVE
CVE
added 7 hours ago4 views

CVE-2026-15254

The CVE-2026-15254 entry concerns the Simply Schedule Appointments WordPress plugin before 1.6.12.11. The vulnerability: the plugin does not perform a capability check on an administrative appointment-listing shortcode, and its per-user result scoping fails open for non-staff users. As a result, ...

5.4AI score
SaveExploits0References1
Nuclei
Nuclei
added 8 hours ago23 views

ShortCode Addons - Unauthenticated Options Update

WordPress plugin Shortcode Addons = 3.0.2 contains an unauthenticated arbitrary option update caused by insufficient access controls in the plugin, letting attackers modify options without authentication. id: CVE-2022-34487 info: name: ShortCode Addons - Unauthenticated Options Update author:...

9.8CVSS6AI score0.03225EPSS
SaveExploits0References3
Nuclei
Nuclei
added 8 hours ago25 views

WordPress UIX Shortcodes <= 1.9.7 - Unauthenticated Shortcode Execution

The The Uix Shortcodes – Compatible with Gutenberg plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 1.9.9. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode...

7.3CVSS6AI score0.0147EPSS
SaveExploits0References5
Nuclei
Nuclei
added 8 hours ago27 views

Ocean Extra <= 2.4.6 - Unauthenticated Shortcode Execution

The Ocean Extra plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 2.4.6. This is due to the software allowing users to supply arbitrary shortcodes in the contentrechdata parameter that is then executed. This makes it possible for...

9.8CVSS8.2AI score0.01933EPSS
SaveExploits0References4
Nuclei
Nuclei
added 8 hours ago62 views

Download Manager < 3.3.04 - Unauthenticated Arbitrary Shortcode Execution

The The Download Manager plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.3.03. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for...

7.3CVSS8.2AI score0.01888EPSS
SaveExploits0References4
Nuclei
Nuclei
added 8 hours ago47 views

SupportCandy < 2.2.7 - Reflected Cross-Site Scripting

The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back in pages with the wpsccreateticket shortcode embed, leading to a Reflected Cross-Site Scripting issue id: CVE-2021-24878 info: name: SupportCandy 2.2.7 - Reflected Cross-Site...

6.1CVSS6.3AI score0.01165EPSS
SaveExploits2References3
NVD
NVD
added yesterday7 views

CVE-2026-14864

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

0.00153EPSS
SaveExploits0References1
EUVD
EUVD
added yesterday10 views

EUVD-2026-51929

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

5.6AI score0.00153EPSS
SaveExploits0References1
Cvelist
Cvelist
added yesterday21 views

CVE-2026-14864 JetEngine < 3.8.12 - Contributor+ Stored XSS via jet_engine Shortcode

The JetEngine WordPress plugin before 3.8.12 does not escape a post meta value before outputting it through one of its shortcodes, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute in the context of higher-privileged users such as...

0.00153EPSS
SaveExploits0References1
CVE
CVE
added yesterday16 views

CVE-2026-14864

The CVE describes a Stored XSS in the JetEngine WordPress plugin (versions before 3.8.12). The issue arises because a post meta value is not escaped before being output via a JetEngine shortcode, allowing users with the Contributor role and above to inject scripts that run in the context of highe...

5.6AI score0.00153EPSS
SaveExploits0References1
ATTACKERKB
ATTACKERKB
added 2 days ago5 views

CVE-2026-15644

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS5.7AI score0.00206EPSS
SaveExploits0References9
EUVD
EUVD
added 2 days ago10 views

EUVD-2026-51793

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'style' Shortcode Attribute in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

6.4CVSS5.7AI score0.00206EPSS
SaveExploits0References8
CVE
CVE
added 2 days ago12 views

CVE-2026-15644

The CVE concerns the Powerkit WordPress plugin (Powerkit – Supercharge your WordPress Site) with a Stored Cross-Site Scripting vulnerability via the 'style' shortcode attribute. Affects all versions up to 3.1.0 due to insufficient input sanitization and output escaping. Exploitation is possible b...

6.4CVSS5.7AI score0.00206EPSS
SaveExploits0References8
EUVD
EUVD
added 2 days ago10 views

EUVD-2026-51763

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipressrank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2 days ago8 views

CVE-2026-16091

The GamiPress – Gamification plugin to reward points, achievements, badges & ranks in WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'gamipressrank' Shortcode in all versions up to, and including, 7.9.9.1 due to insufficient input sanitization and output...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References8
EUVD
EUVD
added 2 days ago7 views

EUVD-2026-51764

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
CVE
CVE
added 2 days ago9 views

CVE-2026-16091

The CVE-2026-16091 entry concerns the GamiPress WordPress plugin (versions up to 7.9.9.1). It describes a Stored Cross-Site Scripting (XSS) vulnerability in the gamipress_rank shortcode caused by insufficient input sanitization and output escaping. Impact: authenticated attackers with contributor...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References7
ATTACKERKB
ATTACKERKB
added 2 days ago8 views

CVE-2026-15649

The Powerkit – Supercharge your WordPress Site plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References7
CVE
CVE
added 2 days ago12 views

CVE-2026-15649

Technical details are not publicly available in the provided documents. Monitor for updates from authoritative sources for affected versions, impact, and remediation.

6.4CVSS5.7AI score0.00201EPSS
SaveExploits0References6
Rows per page
Query Builder