CVE-2026-7436 WPC Badge Management for WooCommerce <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'text' Attribute

The WPC Badge Management for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'text' attribute of the wpcbmbestseller shortcode in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-56039 WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in Quick Interest Slider = 3.1.6 versions...

EUVD-2026-39701

Unauthenticated Cross Site Scripting XSS in Quick Interest Slider = 3.1.6 versions...

WordPress Quick Interest Slider plugin <= 3.1.6 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by hivesec in WordPress Plugin Quick Interest Slider versions = 3.1.6...

CVE-2025-68022

Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Plugin BlueX for WooCommerce: from n/a through = 3.1.6...

CVE-2025-32290 WordPress Sticky HTML5 Music Player plugin <= 3.1.6 - SQL Injection Vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in LambertGroup Sticky HTML5 Music Player lbg-audio3-html5 allows SQL Injection.This issue affects Sticky HTML5 Music Player: from n/a through = 3.1.6...

PT-2024-16312 · WordPress · The Page Builder Gutenberg Blocks – Coblocks

Name of the Vulnerable Software and Affected Versions: The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress versions up to, and including, 3.1.6 Description: The issue is related to Stored Cross-Site Scripting via the plugin's Icon Widget due to insufficient input sanitization and...