EUVD-2026-71861

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84022

The Bold Page Builder WordPress plugin, in versions before 5.9.8 , is vulnerable to a Stored XSS flaw because it fails to sanitize and escape several shortcode attributes before outputting them into HTML attributes. This oversight allows users with Contributor roles or higher to inject arbitrary ...

PT-2026-86345

🚨 CVE-2026-84022 The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected...

CVE-2026-84022: Improper Neutralization of Input During Web Page Generation

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2024-3773

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

EUVD-2024-55747

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2024-3773 LiveJournal Shortcode <= 1.1.1 - Contributor+ Stored XSS via Shortcode

The LiveJournal Shortcode WordPress plugin through 1.1.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attack...

CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

EUVD-2026-67649

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

CVE-2026-5510 GiveWP <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'giveform' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continuebuttontitle and...

WordPress GiveWP plugin <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by daroo in WordPress Plugin GiveWP versions = 4.14.4...

PT-2026-83072

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'give form' shortcode in all versions up to, and including, 4.14.4. This is due to insufficient input sanitization and output escaping on the continue button title and...

CVE-2025-9878 Password Protect WordPress Lite <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting

The PPWP – Password Protect WordPress | 1 Most-Reviewed Password Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ppwp' shortcode in all versions up to, and including, 1.9.21 due to insufficient input sanitization and output escaping on user supplied...

WordPress Child Pages Card plugin < 1.09 - Contributor+ Stored XSS via Shortcode Attributes vulnerability

Contributor+ Stored XSS via Shortcode Attributes vulnerability discovered by Pablo González Pérez, Francisco José Ramírez Vicente, and Iñigo Sánchez Enciso in WordPress Plugin Child Pages Card versions 1.09...

WordPress Snippet Shortcodes plugin <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Snippet Shortcodes versions = 5.2.0...

CVE-2026-16758 Snippet Shortcodes <= 5.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

CVE-2026-16758

CVE-2026-16758 affects the WordPress plug-in “Snippet Shortcodes” up to version 5.2.0. It enables a Stored Cross-Site Scripting attack via Shortcode Attributes, allowing an authenticated attacker with contributor-level access or higher to inject and trigger scripts when users visit affected pages...

EUVD-2026-59898

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

CVE-2026-16758: Improper Neutralization of Input During Web Page Generation

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...