7745 matches found
EUVD-2026-71841
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
CVE-2026-8625 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
CVE-2026-8623
The Dear Flipbook WordPress plugin (all versions up to 2.4.30 ) is vulnerable to an authenticated Stored Cross-Site Scripting (XSS) via the post_content parameter, specifically the class attribute of .dvcss elements. Attackers with Contributor-level access can embed a Base64-encoded JSON object i...
CVE-2026-8623 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
CVE-2026-8623 Dear Flipbook <= 2.4.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
PT-2026-86342
🚨 CVE-2026-83543 The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response. 🎖@cveNotify...
PT-2026-86350
🚨 CVE-2026-84898 The Eventin WordPress plugin before 4.1.21 does not properly validate a template path value before using it to include a local file, allowing users with contributor-level access and above to include and execute arbitrary local PHP files. 🎖@cveNotify...
PT-2026-86349
🚨 CVE-2026-84896 The King Addons for Elementor WordPress plugin before 51.1.77 does not escape a widget display-style setting before outputting it in an HTML attribute, allowing users with Contributor-level access and above to store JavaScript that executes in the browser of any visitor to the...
PT-2026-86315
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post content Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
PT-2026-86352
🚨 CVE-2026-84901 The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contributor-level access and above to change the site's front-page setting to an event they do not own and to create, edit and dele...
PT-2026-86333
🚨 CVE-2026-78150 The Smart Post WordPress plugin before 4.0.8 does not check the type, ownership or status of the post it is asked to duplicate, allowing users with contributor privileges and above to copy any private or password protected post into a draft of their own and read its content and...
PT-2026-86343
🚨 CVE-2026-83544 The Greenshift WordPress plugin before 13.2.0 does not properly escape a block animation attribute before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...
PT-2026-86328
The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the image src attribute of the et pb video slider item shortcode in all versions up to, and including, 4.27.6. This is due to the image src field not being included in the $url options whitelist which only...
PT-2026-86314
The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'post content class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and output...
WordPress Social Chat plugin <= 8.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'consent_message' JSON Attribute in .qlwapp data-box vulnerability
Authenticated Contributor+ Stored Cross-Site Scripting via 'consentmessage' JSON Attribute in .qlwapp data-box vulnerability discovered by suyoung kimAhnLab - AhnLab in WordPress Plugin WP Social Chat versions = 8.6.2...
Divi < 4.27.7 - Authenticated (Contributor+) Server-Side Request Forgery via 'image_src' Parameter
Description The Divi theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.27.6. This is due to the etpbsetvideooembedthumbnailresolution function using wpremoteget instead of wpsaferemoteget to fetch a remote image URL, which does not restrict...
Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.dvcss' Element Class Attribute
Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent class attribute of .dvcss element' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization...
Divi < 4.27.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Video Slider 'image_src' Shortcode Parameter
Description The Divi theme for WordPress is vulnerable to DOM-Based Stored Cross-Site Scripting via the imagesrc attribute of the etpbvideoslideritem shortcode in all versions up to, and including, 4.27.6. This is due to the imagesrc field not being included in the $urloptions whitelist which onl...
Dear Flipbook < 2.4.37 - Authenticated (Contributor+) Stored Cross-Site Scripting via '.df-element' Element Inner HTML
Description The Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'postcontent Custom HTML block inner HTML' parameter in all versions up to, and including, 2.4.30 due to insufficient input sanitization and...