CVE-2026-15726

The Serious Slider WordPress plugin is vulnerable to Stored Cross‑Site Scripting via the theme shortcode attribute in all versions up to and including 1.4.0, caused by insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject a...

CVE-2026-15726

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-15726 Serious Slider <= 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'theme' Shortcode Attribute

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

EUVD-2026-59867

The Serious Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'theme' Shortcode Attribute in all versions up to, and including, 1.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level...

CVE-2026-18385

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

CVE-2026-18385 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

EUVD-2026-59853

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

CVE-2026-18385 Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content <= 4.16.19 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via First Name / Last Name Profile Field

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

CVE-2026-18385

The CVE-2026-18385 entry concerns the ProfilePress WordPress plugin (Paid Membership, Ecommerce, User Registration/Form/Restrict Content) up to version 4.16.19. The vulnerability allows authenticated users with subscriber-level access and above to execute arbitrary shortcodes via do_shortcode, du...

CVE-2026-18385: Improper Control of Generation of Code

The The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 4.16.19. This is due to the software allowing users to execute an...

CVE-2026-16758: Improper Neutralization of Input During Web Page Generation

The Snippet Shortcodes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Shortcode Attributes in all versions up to, and including, 5.2.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level acce...

PT-2026-73099

Name of the Vulnerable Software and Affected Versions ProfilePress versions prior to 4.16.20 Description Authenticated attackers with subscriber-level access and above can execute arbitrary shortcodes. This occurs because the software fails to properly validate values before executing the do...

PT-2026-73108

Name of the Vulnerable Software and Affected Versions Youtube Showcase versions prior to 4.0.5 Description Stored Cross-Site Scripting occurs via the emd mb meta shortcode due to insufficient input sanitization and output escaping on attachment titles. The function EMD MB Helper::image info retur...

PT-2026-73136

Name of the Vulnerable Software and Affected Versions Bold Page Builder versions prior to 5.6.9 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes within the bt bb shortcode shortcode. Authenticated attackers with...

CVE-2026-16775: Improper Neutralization of Input During Web Page Generation

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'id' Shortcode Attribute in all versions up to, and including, 4.9.0 due to insufficient input sanitization and output escaping. This makes it possible for...

PT-2026-73110

Name of the Vulnerable Software and Affected Versions Smash Balloon Social Post Feed versions prior to 4.9.1 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access or higher can inject...

PT-2026-73092

Name of the Vulnerable Software and Affected Versions Serious Slider versions prior to 1.4.1 Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting...

CVE-2026-15948

The CVE-2026-15948 entry concerns the Hydra Booking WordPress plugin. A Stored Cross-Site Scripting vulnerability exists in the first_name parameter for all versions up to and including 1.2.2 due to insufficient input sanitization and output escaping. The tfhb_host role can be self-assigned via t...

WordPress Embed Google Photos Album Easily plugin <= 2.2.1 - Contributor+ Stored XSS via link Shortcode Attribute vulnerability

Contributor+ Stored XSS via link Shortcode Attribute vulnerability discovered by testoun in WordPress Plugin Embed Google Photos album versions = 2.2.1...

WordPress PPWP - Password Protect Pages plugin <= 1.9.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes vulnerability

WordPress PPWP - Password Protect Pages plugin = 1.9.21 - Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode Attributes vulnerability discovered by Muhammad Yudha - DJ in WordPress Plugin PPWP versions = 1.9.21...