1123852 matches found
EUVD-2026-53728
The EONSR AEO Agent WordPress plugin through 3.7.9 does not perform any authorisation check on one of its REST API routes and disables HTML sanitisation before saving the post, allowing unauthenticated attackers to create administrator-attributed published posts containing arbitrary web scripts...
CVE-2026-18395
The CVE refers to the WordPress plugin Child Pages Card, affected before version 1.09. The flaw is improper sanitisation/escaping of shortcode attributes, enabling Stored XSS for users with the contributor role and above when rendering pages. No exploit details or patches are provided in the conn...
EUVD-2026-53733
The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...
CVE-2026-18395 Child Pages Card < 1.09 - Contributor+ Stored XSS via Shortcode Attributes
The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2026-16537
The Slick Slider WordPress plugin before 0.5.3 does not sanitize and escape a shortcode attribute value before outputting it in an HTML attribute, allowing users with the Contributor role and above to perform Stored Cross-Site Scripting attacks that execute when a user views the affected post...
CVE-2026-16537
The CVE details a Stored XSS vulnerability in the Slick Slider WordPress plugin, version before 0.5.3. The issue arises because a shortcode attribute value is not sanitized/escaped before being output into an HTML attribute, enabling attackers with the Contributor role or higher to execute script...
EUVD-2026-53732
The Child Pages Card WordPress plugin before 1.09 does not sanitise and escape some of its shortcode attributes before outputting them back in a page, allowing users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
EUVD-2026-53714
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-18400 Slider, Gallery, and Carousel by MetaSlider <= 3.111.0 - Authenticated (Author+) Stored Cross-Site Scripting via 'delay' Post Meta Setting
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...
EUVD-2026-53715
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content URL-encoded gettext markers in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This make...
CVE-2026-18510 TranslatePress <= 3.2.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The TranslatePress – Translate Multilingual sites with AI Translation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content URL-encoded gettext markers in all versions up to, and including, 3.2.6 due to insufficient input sanitization and output escaping. This make...
CVE-2026-18400
The Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'delay' Post Meta Setting in all versions up to, and including, 3.111.0 due to insufficient input sanitization and output escaping. This makes it...
CVE-2026-18510
CVE-2026-18510 affects TranslatePress – Translate Multilingual (WordPress) up to version 3.2.6. Root cause: insufficient input sanitization and output escaping, enabling unauthenticated stored XSS via Comment Content. Attackers can inject arbitrary scripts in pages viewed by users; payloads use W...
CVE-2026-18400
The CVE covers the WordPress plugin “Slider, Gallery, and Carousel by MetaSlider – Image Slider, Video Slider” (ml-slider) up to version 3.111.0. The issue is a Stored Cross-Site Scripting vulnerability via the delay post meta setting, caused by insufficient input sanitization and output escaping...
CVE-2026-16636
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...
EUVD-2026-53704
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...
CVE-2026-18325
CVE-2026-18325 affects Forminator Forms for WordPress, specifically versions
CVE-2026-18325 Forminator Forms <= 1.56.1 - Unauthenticated Stored Cross-Site Scripting via Forged Upload Record via Select Field
The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Forged Upload Record via Select Field in all versions up to, and including, 1.56.1 due to insufficient input sanitization and output escaping. This makes i...
EUVD-2026-53702
The FluentSMTP – WP SMTP Plugin with Amazon SES, SendGrid, MailGun, Postmark, Google and Any SMTP Provider plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Recipient Display Name to.name in Email Logs in all versions up to, and including, 2.2.95 due to insufficient input...