Lucene search
+L
Catalog
Vendors
Products
Timeline
Vulnerabilities
Sources
Documentation
Blog
Glossary
FAQ
Brand assets
Assessment
Agents dashboard
Agent Scanning
API Scanning
Assessment API
Alerts
Email notifications
Webhook notifications
Alerts API
SBOM package analysis
API Reference
Settings
Sign in
🔥 Daily Hot!
💪🏽 CPE Enhanced Advisories
🕶 Shadow Exploits
🕵🏼 Vulners CPE
🔐 Security news
💻 Exploit updates
📑 Blogs review
🐧 Linux vulnerabilities
🐞 Bugbounty
🤖 AI High Score
📰 CVE Feed
show all

9385 matches found

Cvelist
Cvelist•added 2026/05/27 5:31 a.m.•43 views

CVE-2026-8899 Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thumbnails' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on the shortcode's 'width' and 'height' attributes in the athnthumbnail...

6.4CVSS0.00198EPSS
SaveExploits0References3
CVE
CVE•added 2026/05/27 5:31 a.m.•40 views

CVE-2026-8899

The CVE-2026-8899 entry concerns the WordPress Auto Thumbnail plugin (versions up to 1.0). Affected component is the athn_thumbnails() function handling the thumbnails shortcode; width and height attributes are unsafely concatenated into an HTML tag, leading to Stored Cross-Site Scripting. Explo...

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
EUVD
EUVD•added 2026/05/27 5:31 a.m.•18 views

EUVD-2026-32093

The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thumbnails' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on the shortcode's 'width' and 'height' attributes in the athnthumbnail...

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/05/27 5:31 a.m.•14 views

CVE-2026-8899 Auto Thumbnails <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Auto Thumbnail plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'thumbnails' shortcode in all versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on the shortcode's 'width' and 'height' attributes in the athnthumbnail...

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB•added 2026/05/27 5:31 a.m.•13 views

CVE-2026-8886

The hkshortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title-plane' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankongpostshorttitleplane...

6AI score0.00198EPSS
SaveExploits0References4
Vulnrichment
Vulnrichment•added 2026/05/27 5:31 a.m.•15 views

CVE-2026-8886 hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute

The hkshortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title-plane' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankongpostshorttitleplane...

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
CVE
CVE•added 2026/05/27 5:31 a.m.•45 views

CVE-2026-8886

CVE-2026-8886 affects the WordPress plugin hk_shortcode (v

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/05/27 5:31 a.m.•12 views

CVE-2026-8040 faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute

The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS6AI score0.00187EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB•added 2026/05/27 5:31 a.m.•12 views

CVE-2026-8040

The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6AI score0.00187EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/05/27 5:31 a.m.•59 views

CVE-2026-8040 faq shortocde <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'color' Shortcode Attribute

The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS0.00187EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/05/27 5:31 a.m.•44 views

CVE-2026-8886 hk_shortcode <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'title' Shortcode Attribute

The hkshortcode plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title-plane' shortcode in versions up to, and including, 1.0. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes in the huankongpostshorttitleplane...

6.4CVSS0.00198EPSS
SaveExploits0References3
EUVD
EUVD•added 2026/05/27 5:31 a.m.•21 views

EUVD-2026-32092

The faq shortocde plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'color' shortcode attribute in the 'faq' shortcode in all versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers,...

6.4CVSS6AI score0.00187EPSS
SaveExploits0References3
CVE
CVE•added 2026/05/27 5:31 a.m.•46 views

CVE-2026-8040

CVE-2026-8040 affects the WordPress plugin faq-shortcode (versions

6.4CVSS6AI score0.00187EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB•added 2026/05/27 5:31 a.m.•12 views

CVE-2026-8844

The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' and 'button' shortcode attributes in the rspccheckshortcode...

6AI score0.00204EPSS
SaveExploits0References5
EUVD
EUVD•added 2026/05/27 5:31 a.m.•22 views

EUVD-2026-32088

The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' and 'button' shortcode attributes in the rspccheckshortcode...

6.4CVSS6AI score0.00204EPSS
SaveExploits0References4
CVE
CVE•added 2026/05/27 5:31 a.m.•42 views

CVE-2026-8847

The CVE-2026-8847 entry concerns the WordPress Dideo plugin (version 1.0) with a Stored XSS flaw in the dideo shortcode. The root cause is insufficient input sanitization and output escaping on the id attribute, which is inserted into an iframe src without escaping in the dideo() handler. Attacke...

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
Vulnrichment
Vulnrichment•added 2026/05/27 5:31 a.m.•13 views

CVE-2026-8847 Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute...

6.4CVSS6AI score0.00198EPSS
SaveExploits0References3
Cvelist
Cvelist•added 2026/05/27 5:31 a.m.•41 views

CVE-2026-8844 Responsive Check <= 0.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Responsive Check plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rspcheck' shortcode in versions up to, and including, 0.0.3. This is due to insufficient input sanitization and output escaping on the 'url' and 'button' shortcode attributes in the rspccheckshortcode...

6.4CVSS0.00204EPSS
SaveExploits0References4
Cvelist
Cvelist•added 2026/05/27 5:31 a.m.•41 views

CVE-2026-8847 Dideo <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute...

6.4CVSS0.00198EPSS
SaveExploits0References3
ATTACKERKB
ATTACKERKB•added 2026/05/27 5:31 a.m.•23 views

CVE-2026-8847

The Dideo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'dideo' shortcode in version 1.0. This is due to insufficient input sanitization and output escaping on the 'id' shortcode attribute, which is interpolated directly into an HTML iframe 'src' attribute...

6AI score0.00198EPSS
SaveExploits0References4
Rows per page
Query Builder