CVE-2026-111068 DesignSetGo <= 2.11.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tagName' Block Attribute

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access...

PT-2026-127875

The DesignSetGo plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tagName' parameter in all versions up to, and including, 2.11.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access...

WordPress DesignSetGo cross-site scripting vulnerability

WordPress DesignSetGo versions 2.11.0 and earlier contain a cross-site scripting vulnerability. This flaw stems from insufficient input sanitization and output escaping. Authentication attackers with contributor or higher privileges can inject arbitrary web scripts via the ‘tagName’ parameter,...