CVE-2026-85678

The AI Builder WordPress plugin (versions 2.4.1 through 2.7.7 ) contains a stored cross-site scripting (XSS) vulnerability. Custom JavaScript saved against a post is not sanitised before being echoed inside a [removed] tag on the front end. Users with Contributor level access or above can inject ...

CVE-2026-86780

The Featured Image with URL WordPress plugin, in versions before 1.0.6 , fails to sanitise and escape a stored image alt text attribute before outputting it. This allows users with the Contributor role (or higher) to perform Stored Cross-Site Scripting (XSS) attacks that execute in the browser of...

EUVD-2026-75967

The AI Builder WordPress plugin before 2.7.8 does not sanitise custom JavaScript saved against a post before echoing it inside a script tag on the front end, allowing users with contributor level access and above to store arbitrary JavaScript that will execute in the browser of anyone who views t...

CVE-2026-83546

The CoolClock WordPress plugin before 4.3.8 fails to properly escape a skin setting before outputting it within an HTML attribute (the skin class attribute), enabling stored XSS . An attacker with contributor-level access or higher can inject arbitrary scripts that execute when a visitor views th...

EUVD-2026-75957

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-83546 CoolClock < 4.3.8 - Contributor+ Stored XSS via Skin Class Attribute

The CoolClock WordPress plugin before 4.3.8 does not properly escape a skin setting before outputting it within an HTML attribute, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the content is viewed...

CVE-2026-83545

CVE-2026-83545 affects the CoolClock WordPress plugin in versions before 4.3.8 . The root cause is improper escaping of a custom skin setting before output within an inline script, enabling stored XSS . Users with contributor-level access or above can inject arbitrary JavaScript that executes whe...

CVE-2026-83545 CoolClock < 4.3.8 - Contributor+ Stored XSS via Custom Skin JSON

The CoolClock WordPress plugin before 4.3.8 does not properly escape a custom skin setting before outputting it inside an inline script, allowing users with contributor-level access and above to inject arbitrary JavaScript that executes when the content is viewed...

CVE-2026-7438

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

CVE-2026-7438 Bold Timeline Lite <= 1.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

EUVD-2026-75940

The Bold Timeline Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the supertitle and subtitle attributes of the boldtimelineitem shortcode in all versions up to, and including, 1.2.8 due to insufficient input sanitization and output escaping on user supplied attributes...

WordPress Booking for Appointments and Events Calendar – Amelia plugin <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Nguyen Anh Quan prototw in WordPress Plugin Amelia versions = 2.4.9...

CVE-2026-15889

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-15889

The Aruba HiSpeed Cache WordPress plugin is affected by a Stored Cross-Site Scripting (XSS) vulnerability in all versions up to and including 3.0.14 , caused by insufficient input sanitization and output escaping in the Post Content field. An authenticated attacker with Contributor-level access o...

CVE-2026-15889 Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

EUVD-2026-75366

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-81431 Registration Form for WooCommerce 1.1.0 - 1.1.2 - Contributor+ Privilege Escalation via Unvalidated tgwcfb_id

The Registration Form for WooCommerce WordPress plugin before 1.1.3 does not validate that the form referenced during registration is a legitimate registration form, reading the permitted-role allow-list from an arbitrary attacker-controlled post instead. A user able to create a post Contributor...

CVE-2026-15820

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Photo Module 'attributes' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-15796

The Builderall for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'bgvideoserviceurl' Setting in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...