CVE-2026-92409: Improper Neutralization of Input During Web Page Generation

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

PT-2026-113692

The Donation Thermometer WordPress plugin before 2.3.0 does not escape a colour value taken from a shortcode attribute before using it in an attribute of the generated legend markup, allowing users with the Contributor role and above to inject arbitrary event handlers that execute when the page i...

PT-2026-113657

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

CVE-2026-105261: Improper Neutralization of Input During Web Page Generation

The Schedule Post Changes With PublishPress Future: Unpublish, Delete, Change Status, Trash, Change Categories WordPress plugin before 4.10.6 does not enforce a safe HTML-element allowlist on a shortcode attribute and does not neutralise attacker-controlled text placed inside the resulting elemen...

CVE-2026-92097: Improper Control of Generation of Code

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetingsdialog function building the url template placeholder from a sanitizetextfield-filtered $SERVER'REQUESTURI' on archive pages and th...

PT-2026-113600

The Click to Chat for WhatsApp plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up to, and including, 4.44 This is due to the greetings dialog function building the url template placeholder from a sanitize text field-filtered $ SERVER'REQUEST URI' on archive pages a...

CVE-2026-100153: Improper Neutralization of Input During Web Page Generation

The NewStatPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'QUERYSTRING / REQUESTURI' parameter in all versions up to, and including, 1.4.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

WordPress Click to Chat – HoliThemes plugin <= 4.44 - Unauthenticated Arbitrary Shortcode Execution vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Kuba in WordPress Plugin Click to Chat versions = 4.44...

CVE-2026-89269 WP Testimonials <= 1.4.13 - Author+ Stored XSS via wp-testimonials Shortcode

The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses WordPress's HTML sanitization when rendering it, allowing users with the Author role and above to store JavaScript that executes in the session of any user viewing the testimonials,...

CVE-2026-89269

The WP Testimonials WordPress plugin, in versions through 1.4.13 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly escape testimonial content, which effectively reverses WordPress's standard HTML sanitization during rendering. This allows users with ...

VulnCheck KEV: CVE-2026-1666

The Download Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'redirectto' parameter in all versions up to, and including, 3.3.46. This is due to insufficient input sanitization and output escaping on the 'redirectto' GET parameter in the login form shortcode...

CVE-2026-104684

The Envira Gallery WordPress plugin, in versions prior to 1.16.2 , is vulnerable to an Insecure Direct Object Reference (IDOR) via shortcode. The plugin fails to verify if a user is authorized to read a gallery before rendering it. This flaw allows authors to embed and expose non-public gallery m...

CVE-2026-62098

The WordPress Boutique theme (versions

CVE-2026-62098 WordPress Boutique theme <= 2.3.3 - Arbitrary Shortcode Execution vulnerability

Unauthenticated Content Injection in Boutique = 2.3.3 versions...

CVE-2026-102291

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-102291 Kirki – Freeform Page Builder, Website Builder & Customizer <= 6.3.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'display_name'

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-102291

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in versions up to and including 6.3.1 . The root cause is the unfiltered substitution of a user's display_name into the page markup, which is subsequently processed ...

EUVD-2026-96287

The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 6.3.1 This is due to the plugin substituting a user's displayname into the composed page markup unfiltered and then running the...

CVE-2026-18558

The Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'embeddoc' shortcode in all versions up to, and including, 2.7.13 due to insufficient input sanitization and output escaping. This makes it possible for...

CVE-2026-16776

The MP3 Audio Player – Music Player, Podcast Player & Radio by Sonaar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.14.2 due to insufficient input sanitization and output escaping. This makes it possible for...