PT-2026-86506

The Ninja Forms WordPress plugin from 3.14.10 before 3.15.2 does not prevent shortcodes in request-derived values from being executed when it substitutes them into content it later processes for shortcodes, allowing unauthenticated users to run any shortcode registered on the site...

CVE-2026-76573

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-76573

The Pods – Custom Content Types and Fields WordPress plugin is vulnerable to Stored Cross-Site Scripting (XSS) via the 'not_found' shortcode attribute in all versions up to and including 3.3.9.1 . The root cause is insufficient input sanitization and output escaping . Authenticated attackers with...

CVE-2026-76573 Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

EUVD-2026-71941

The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'notfound' Shortcode Attribute in all versions up to, and including, 3.3.9.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2026-85414

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Gallery : FooGallery plugin <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute vulnerability discovered by UKO - Korea univ. in WordPress Plugin FooGallery versions = 3.3.2...

WordPress Pods plugin <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via 'notfound' Shortcode Attribute vulnerability discovered by Wordfence PRISM - Wordfence in WordPress Plugin Pods versions = 3.3.9.1...

CVE-2026-85414 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-85414 Gallery : FooGallery <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'custom_settings' Shortcode Attribute

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-71932

The Gallery : FooGallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'customsettings' Shortcode Attribute in all versions up to, and including, 3.3.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-85414

Gallery: FooGallery plugin for WordPress (all versions up to, and including, 3.3.2 ) is affected by a Stored Cross-Site Scripting (XSS) vulnerability through the custom_settings shortcode attribute, caused by insufficient input sanitization and output escaping . An authenticated attacker with Con...

CVE-2026-84931

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84022

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...

CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84931 Joli Table Of Contents < 3.0.3 - Author+ Stored XSS via joli-toc Shortcode Theme Attribute

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

EUVD-2026-71872

The Joli Table Of Contents WordPress plugin before 3.0.3 does not sanitise or escape a shortcode attribute value before outputting it inside an HTML element's attribute, allowing users with the Author role and above to inject arbitrary HTML attributes and JavaScript that execute in the browser of...

CVE-2026-84931

The Joli Table Of Contents WordPress plugin, in versions prior to 3.0.3 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to sanitize or escape a shortcode attribute value before it is outputted inside an HTML element's attribute. This allows users with the Auth...

CVE-2026-84022 Bold Page Builder < 5.9.8 - Contributor+ Stored XSS via Multiple Shortcode Element Attributes

The Bold Page Builder WordPress plugin before 5.9.8 does not sanitise and escape several shortcode attributes before outputting them in HTML attributes, allowing users with the Contributor role and above to inject arbitrary web scripts that execute when a user views the affected page...