EUVD-2026-53186

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

CVE-2026-7441

Technical details are not publicly available in the provided documents. Monitor for updates.

CVE-2026-6972

The SKT Skill Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the chartsize attribute of the skillwrapper shortcode in all versions up to, and including, 2.6. This is due to insufficient input sanitization and output escaping on the chartsize attribute, which is...

EUVD-2026-53178

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

CVE-2026-17505 TranslatePress <= 3.2.5 - Reflected Cross-Site Scripting

The Translate Multilingual sites – TranslatePress plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in versions up to, and including, 3.2.5. This is due to the translatepage function unconditionally replacing the plugin's internal !trpst and !trpen marker...

CVE-2026-17532

Summary: CVE-2026-17532 affects the Seraphinite Accelerator WordPress plugin (≤ 2.29.15). It allows unauthenticated users to perform a reflected XSS via the seraph_accel_prep parameter. Root cause per the CVE description: a loose PHP comparison in CacheExtractPreparePageParams() (using != against...

CVE-2026-5116 Contact Form 7 – Dynamic Text Extension <= 5.0.5 - Authenticated (Editor+) Stored Cross-Site Scripting

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116

The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.5. This is due to insufficient output escaping on form shortcode keys displayed in the admin "Scan Forms for Post Meta and User Data Keys" page...

CVE-2026-5116

The vulnerability CVE-2026-5116 affects the WordPress plugin Contact Form 7 – Dynamic Text Extension (versions

EUVD-2026-53169

The Super Progressive Web Apps plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the superpwasettingsofflinemessagetxt setting in all versions up to, and including, 2.2.43. This is due to insufficient input sanitization and output escaping. The offline message value is stored...

CVE-2026-5108

The CVE concerns the WordPress plugin Super Progressive Web Apps (versions

CVE-2026-8790

The Football Pool plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the shouttext POST parameter of the Shoutbox widget in all versions up to, and including, 2.13.4 due to insufficient input sanitization and output escaping. When a shoutbox form submission fails the nonce...

CVE-2026-16143

The VikRentItems – Flexible Rental Management System plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer email field of the booking checkout form in versions up to, and including, 1.2.1. This is due to insufficient input sanitization and output escaping in the...

EUVD-2025-210616

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2025-15677 GeoDirectory < 2.8.110 - Editor+ Stored XSS via Place Categories

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2025-15677

The GeoDirectory WordPress plugin prior to 2.8.110 does not sanitize/escape a place-category setting before output in an admin page, enabling stored XSS by high-privilege users (e.g., editors+) even when unfiltered_html is disallowed (such as in multisite). Exploitation details, affected environm...

CVE-2026-16942

CVE-2026-16942 affects the WP Custom HTML Page WordPress plugin up to version 0.6.2. The vulnerability arises because HTML stored via a custom page handler is not sanitized and is not restricted to users allowed to post unfiltered HTML, enabling authors to store JavaScript that is served unescape...

CVE-2026-16573 Bit Form < 3.2.0 - Unauthenticated Stored XSS via SVG Signature Upload

The Bit Form WordPress plugin before 3.2.0 does not sanitize an uploaded signature image before storing it, allowing unauthenticated attackers to upload a crafted SVG file containing JavaScript that executes when the file is viewed, leading to Stored Cross-Site Scripting...

CVE-2026-16573

The CVE-2026-16573 vulnerability affects the Bit Form WordPress plugin prior to version 3.2.0. An unauthenticated attacker can upload a crafted SVG signature image that contains JavaScript, which is not sanitized before storage and executes when viewed, enabling Stored XSS. This is tied to the pl...

CVE-2026-16583

CVE-2026-16583 affects the Orbit Fox by ThemeIsle WordPress plugin prior to 3.0.8. The SVG upload feature does not sanitize uploaded SVG files, enabling stored XSS: authenticated users with upload capability (Author and above by default, without unfiltered_html) can upload SVGs containing JavaScr...