CVE-2026-39727

Subscriber Cross Site Scripting XSS in WC Fields Factory = 4.1.12 versions...

CVE-2026-39727 WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WC Fields Factory = 4.1.12 versions...

CVE-2026-39727

The WordPress WC Fields Factory plugin versions

EUVD-2026-93249

Subscriber Cross Site Scripting XSS in WC Fields Factory = 4.1.12 versions...

CVE-2026-39727 WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Subscriber Cross Site Scripting XSS in WC Fields Factory = 4.1.12 versions...

PT-2026-106414

Name of the Vulnerable Software and Affected Versions WC Fields Factory versions prior to 4.1.13 Description Cross Site Scripting XSS allows an attacker with subscriber privileges to execute malicious scripts in the browser of other users. Recommendations Update to a version newer than 4.1.12...

CVE-2026-39727: Improper Neutralization of Input During Web Page Generation

Subscriber Cross Site Scripting XSS in WC Fields Factory = 4.1.12 versions...

WordPress WC Fields Factory plugin <= 4.1.12 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by ParkHyunWoo in WordPress Plugin WC Fields Factory versions = 4.1.12...

CVE-2026-93507

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-93508

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

EUVD-2026-85061

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

EUVD-2026-85060

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

CVE-2026-93507

The WC Fields Factory WordPress plugin (versions before 4.1.11 ) is vulnerable to an authorization bypass because it fails to properly restrict access to or verify a nonce for a post-cloning action. This flaw allows users with Contributor-level privileges and above to duplicate arbitrary posts, r...

CVE-2026-93507 WC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to, or verify a nonce for, a post-cloning action, allowing Contributor-level users and above to duplicate arbitrary posts of any type or status, including other users' private or draft content, and gain read...

WordPress WC Fields Factory plugin < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability

Contributor+ Arbitrary Post Cloning and Private Content Disclosure vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...

WordPress WC Fields Factory plugin < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation vulnerability

Subscriber+ Arbitrary Post Meta Manipulation vulnerability discovered by Farid Narimanov in WordPress Plugin WC Fields Factory versions 4.1.11...

CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-93508 WC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX

The WC Fields Factory WordPress plugin before 4.1.11 does not properly restrict access to its field-management AJAX action, allowing authenticated users with Subscriber-level access and above to create, modify and delete arbitrary post meta on any post, including WooCommerce products, regardless ...

CVE-2026-93508

The WC Fields Factory WordPress plugin, in versions prior to 4.1.11 , is vulnerable to unauthorized access because it fails to properly restrict its field-management AJAX action . This flaw allows authenticated users with Subscriber-level access or higher to perform unauthorized actions, includin...